86% of UK gambling sites are breaking data privacy law
Swansea University study found most licensed UK gambling sites use dark patterns to harvest user data before consent
Nearly nine out of ten licensed British gambling websites appear to be violating GDPR, according to a new study from Swansea University's GREAT Centre, which audited 624 gambling sites and found 86% had committed at least one breach tied to how their cookie consent banners operate.
The study showed that 24% of the websites examined had no option for disabling any tracking software, including the Hollywood Bets site, which sponsors Brentford FC, and the Admiral Casino website.
Further, two-thirds of operators, including major brands such as Ladbrokes and William Hill, collected data from users prior to consent, sending it to third-party marketing analytics platforms, not to the limited purposes for which GDPR allows, such as verifying the user's UK identity.
Two per cent of websites, including Dafabet, the sponsor of Celtic FC, provided no option for consent at all.
Designed to make you click "accept"
In addition, researchers have found that a significant number of manipulative design techniques are used: 60% of sites highlight the most privacy-invasive setting, 29% automatically selected privacy-invasive settings, and 47% made users click to reject cookies.
While these "dark patterns" do not constitute illegal behaviour in themselves, they appear to be concentrated among the very same operators which break GDPR rules.
The staggering 86% violation rate contrasts sharply with the 54% found in a separate study on websites overall, implying that gambling companies fall significantly behind others in terms of regulation adherence, even while Britain's Information Commissioner's Office boasts that 95 percent of the country’s top 1,000 websites have been brought in line with cookie legislation.
Ravi Naik, legal director at data protection firm AWO, called the findings evidence of "widespread and systemic non-compliance" and pointed to what he described as the ICO's failure to take meaningful enforcement action against the sector specifically.
