Betting Sites Accused of Tracking Users Before They Agree to It

Hundreds of gambling websites operating in Britain appear to be collecting information about visitors before those people have agreed to be tracked, exposing a significant gap between privacy rules and practices inside an industry built around keeping customers gambling.

Consent That Comes Too Late

The problems began with whether users were offered a meaningful choice at all.

About 24% of the sites examined provided no way to disable tracking software. Hollywood Bets, a sponsor of Brentford FC, and Admiral Casino were among the operators identified in that category.

A smaller group, representing about 2% of the websites tested, provided no consent choice whatsoever. Dafabet, which sponsors Celtic FC, was among them.

Other sites technically presented visitors with a decision but structured it in ways that encouraged them to surrender more privacy.

Researchers found that 60% visually promoted the option providing less privacy. Almost three in 10 had privacy-unfriendly choices selected by default, while 47% placed the rejection option behind an additional layer rather than making it immediately available.

Those design techniques, commonly described as dark patterns, are not automatically illegal. Their prevalence becomes more significant alongside the researchers’ separate conclusion that 86% of the gambling sites appeared to have committed at least one GDPR violation.

That rate was substantially above findings from earlier research covering the wider web, where apparent non-compliance was put at 54%.

Data Moving Before the Click

Among the better-known operators caught by the researchers’ pre-consent tests were Ladbrokes and William Hill.

Not every piece of information collected before consent represents a privacy violation. Gambling operators can have legitimate reasons to process limited data, including determining whether somebody accessing a service is located in Britain.

The Swansea researchers found something more consequential. Information was also being passed to third-party analytics systems used for marketing purposes.

Entain, which owns Ladbrokes, disputed the implication that its pre-consent collection was feeding advertising activity. The company maintained that information gathered at that stage was not used for advertising or marketing.

The Regulator’s Compliance Problem

The scale of the findings also puts Britain’s privacy regulator under scrutiny.

The Information Commissioner’s Office has spent years pushing major websites toward compliance with rules covering cookies and online tracking. The regulator says that effort has resulted in 95% of the 1,000 most-visited UK websites complying with the relevant requirements.

The gambling sector documented by the Swansea study looks markedly different.

Ravi Naik, legal director at data protection specialist AWO, characterised the findings as evidence of a broad and entrenched compliance problem. His criticism extended beyond individual gambling companies to the ICO, which he believes has failed to take sufficiently meaningful enforcement action against the sector.

There is already precedent for regulatory intervention.

In 2024, the ICO reprimanded Sky Bet after finding that it had unlawfully shared customers’ personal information with advertising technology companies. The case followed concerns pursued by the campaign organisation Clean Up Gambling with assistance from AWO.

That episode exposed the particularly sensitive intersection between gambling-harm monitoring and personalised marketing. Behaviour that can help identify a potentially vulnerable gambler may also provide commercially valuable information about when and how that customer plays.

Sky Bet was not among the companies accused of GDPR violations in the new Swansea research.

When Behaviour Becomes Commercial Intelligence

What makes the broader findings harder to dismiss as a conventional dispute over cookies is the economic structure behind the tracking.

Online gambling companies have strong incentives to understand when customers play, how they behave and what keeps them active. The researchers concluded that data collection can be directed toward preserving engagement and, ultimately, the losses from which gambling businesses generate revenue.

That creates a particularly sensitive use case for behavioural surveillance.

Patterns valuable to an operator because they predict continued gambling can overlap with patterns associated with damaging gambling behaviour. A consent interface tilted toward greater data collection therefore carries implications beyond the advertising mechanics familiar from ordinary shopping or media websites.

Enforcement Has Yet to Close the Gap

The ICO maintains that it continues to monitor heavily visited British websites and is pursuing longer-term compliance with lawful tracking practices. It also says enforcement remains available when necessary to protect people’s information rights.

The Swansea research suggests that, across much of online gambling, the distance between those regulatory efforts and what visitors actually encounter remains substantial.

On many of the sites tested, the decision presented by a cookie banner was already compromised: the easiest button favoured tracking, the alternative was harder to find, or data collection had begun before the customer had made a choice at all.

Source: theguardian.com

Betting Sites Accused of Tracking Users Before They Agree to It

Consent That Comes Too Late

Data Moving Before the Click

The Regulator’s Compliance Problem

When Behaviour Becomes Commercial Intelligence

Enforcement Has Yet to Close the Gap

Comments