A Swansea University study of 624 UK-licensed gambling websites found widespread concerns around cookie consent and tracking practices. Researchers reported dark patterns on 86% of banners, while 67% of sites allegedly processed identifiable data before consent. The findings reflect an audit conducted between April and June 2025 and represent researchers’ interpretations, not enforcement decisions by the ICO or UKGC.
Researchers reviewed 624 websites licensed to operate in Great Britain
86% of banners contained at least one dark pattern
24% offered users no option to reject tracking
67% reportedly processed identifiable data before consent
The 2025 audit may not reflect subsequent operator changes
The peer-reviewed study examined whether banner design made accepting tracking easier or more prominent than refusing it. Examples included visually emphasising the less privacy-protective choice, preselecting settings and placing rejection behind an additional layer.
A second study involved 615 participants using a simulated gambling platform. The most common banner identified in the audit increased tracking acceptance and weakened alignment between participants’ stated preferences and their final choices.
A banner can therefore present several options while still influencing users through colour, position, wording or extra clicks. Consent management belongs within product design, legal review and customer-experience governance, rather than being treated as a one-off technical task.
The issue also extends beyond cookies. The UKGC’s financial risk assessment pilot has focused attention on how player information is accessed and shared without creating unnecessary friction.
Tracking technologies support attribution, campaign measurement, personalisation and retargeting across affiliate operations. Those functions create additional risk when information is transmitted to analytics or advertising partners before a player has made a valid choice.
Current ICO guidance says organisations must provide clear information and obtain consent before using non-essential cookies or comparable storage and access technologies. Online advertising technologies used for tracking and profiling also require consent.
The findings matter to affiliate managers because several parties may process behavioural signals. Operators must understand which technologies activate, what they collect and where the information is sent. Contracts and platform settings alone do not resolve that responsibility across acquisition, retention and compliance workflows.
Attention is also shifting towards marketing. The AI-based monitoring of gambling advertising introduced by the UKGC and CAP in 2026 shows how digital campaigns increasingly face automated and human scrutiny.
The impact is not limited to regulatory exposure. A consent flow is often a visitor’s first decision on a gambling website, and an interface perceived as manipulative can undermine confidence before registration or deposit.
This concern sits alongside wider unease about sensitive information. A BGC-commissioned survey reporting consumer resistance to intrusive financial checks showed how privacy concerns can shape attitudes towards controls intended to improve player safety.
Marketing teams may favour higher consent rates, while legal and compliance functions must ensure consent is freely given, informed and demonstrable. Product teams must translate those requirements into balanced choices without obstructing the customer journey.
The websites were observed between April and June 2025, more than a year before publication. Operators may have since changed consent platforms, removed third-party trackers or redesigned banners. Any reporting about individual brands should therefore give them an opportunity to describe remedial work completed after the audit.
The paper does not establish that the ICO or UKGC has ruled against every website classified as non-compliant. The ICO enforces data-protection and electronic-communications rules, while gambling licensing and consumer-protection obligations fall within the UKGC’s remit.
Compliance teams can nevertheless use the findings to support renewed technical testing across their operations. Reviews should cover pre-consent network requests, tag-manager settings, affiliate pixels, rejection paths, consent records and vendor data flows. Testing should be repeated after website releases, campaign launches and changes to third-party tools, rather than relying on the banner’s visible appearance alone.
