Swansea University Audit Uncovers GDPR Breaches on UK Gambling Websites

The GREAT Centre at Swansea University conducted an audit of 624 licensed UK gambling websites, and the results show that 86 percent committed at least one GDPR breach tied to cookie consent banners, a figure that stands well above the 54 percent violation rate recorded in wider website studies across other sectors.

Audit Details and Methodology

Researchers examined cookie consent mechanisms on each site, focusing on whether banners obtained proper user agreement before data collection began, and the process revealed multiple categories of noncompliance that affected operators of varying sizes. The study took place amid ongoing regulatory developments in the UK gambling sector during 2026, where data protection requirements continue to intersect with licensing obligations from the Gambling Commission.

These practices fall under the category of dark patterns, where interface choices make privacy-protective options harder to locate or complete, and the audit documented such tactics across a substantial portion of the sample.

Comparison With Broader Industry Data

The 86 percent breach rate in gambling sites exceeds the 54 percent found in general website audits, and this gap points to sector-specific challenges in implementing consent flows that meet GDPR standards for clear, granular control. The research team categorized violations into distinct types, allowing observers to see how pre-consent data gathering and missing opt-out features clustered together on many platforms, while the widespread presence of dark patterns added another layer of concern for regulators monitoring user autonomy.

Implications for Licensed Operators

Operators named in the findings now face the task of revising their consent mechanisms, since continued noncompliance could trigger enforcement actions from the Information Commissioner's Office alongside existing gambling licensing rules. The audit covered only licensed UK sites, which means the results reflect entities already subject to both gambling and data protection oversight, and the high incidence of issues suggests that existing compliance checks have not fully addressed cookie banner design across the market.

Further review of the data shows that even sites attempting to display banners often failed to pause tracking until users made a choice, and this timing problem alone accounted for the majority of the two-thirds figure. Sites lacking any disable option for tracking left users with no practical way to limit data flows, a situation the study flagged as a direct breach of GDPR consent requirements for non-essential cookies.

Context Within 2026 Regulatory Environment

September 2026 brings additional layers of scrutiny to the sector, as tax changes and safety measures roll out, yet the Swansea findings stand separate from those fiscal adjustments and focus strictly on data handling practices already required under GDPR. Licensed operators continue to navigate overlapping rules from multiple bodies, and the audit provides a snapshot of where cookie consent processes currently fall short of legal thresholds.

Conclusion

The GREAT Centre audit supplies concrete evidence of systemic gaps in how UK gambling websites handle cookie consent, with 86 percent of 624 sites showing at least one breach and specific problems around pre-consent collection, absent opt-out tools, and manipulative interface designs documented across the sample. According to coverage in the news report on the study, these patterns exceed violation rates seen elsewhere online, giving regulators and operators clear data points for targeted improvements in consent banner implementation.