Research highlights data protection breaches in UK online gaming sector
The study alleges that 86 per cent of Gambling Commission-licensed websites breached General Data Protection Regulation (GDPR) requirements.
Key takeaways:
- An audit of 624 licensed UK gambling sites found 86 per cent allegedly violating GDPR, with 67 per cent collecting personal data before consent and 24 per cent offering no option to refuse tracking.
- Most consent banners nudged users toward acceptance, with 60 per cent highlighting accept buttons and 47 per cent hiding reject options.
- Common banner designs are said to have made users three to four times more likely to accept tracking, even when choices conflicted with their true privacy preferences.
UK.- New research from Swansea University’s Gambling Research, Education and Treatment (GREAT) Centre claims to have found widespread data protection failings across the UK’s online gambling sector. The study found 86 per cent of Gambling Commission-licensed websites allegedly operating in breach of General Data Protection Regulation (GDPR) requirements.
The researchers examined the cookie consent banners and network activity of all 624 casino and sports betting websites licensed in Great Britain. They concluded that many operators were collecting and sharing personal data before obtaining user consent, while others made it difficult or impossible for visitors to reject tracking technologies.
According to the findings, 67 per cent of sites began gathering personally identifiable information before consent had been granted, transmitting unique user identifiers to third-party analytics and marketing services. Meanwhile, 24 per cent of websites provided no option for users to refuse tracking, including 2 per cent that displayed no consent banner at all.
The audit also found that only 29 per cent of consent banners allowed users to reject tracking as easily as they could accept it. On some gambling websites, users were required to make as many as 15 clicks to decline tracking technologies.
Researchers said the majority of websites relied on so-called “dark patterns”, interface designs intended to influence user behaviour towards less privacy-friendly choices. Common practices included visually highlighting the accept button, a tactic observed on 60 per cent of sites, hiding the reject option behind an additional menu layer on 47 per cent of sites, and pre-selecting settings that favoured data collection on 29 per cent of sites.
The research team also conducted an experiment involving 615 UK online gamblers to assess how different consent banner designs affected user decision-making. Participants were shown a simulated betting website featuring one of six consent banner formats.
The study found that the banner design most commonly used by gambling operators made users three to four times more likely to accept tracking compared with a neutral alternative that offered a simple one-click choice.
Researchers further reported that participants who accepted tracking rated their decision as a significantly poorer reflection of their actual privacy preferences than those who rejected it. Those agreeing to tracking scored the decision at 4.4 out of 10 for reflecting their true preferences, compared with 7.9 among users who opted out. The effect was consistent regardless of an individual’s level of gambling risk.
The authors argue that data obtained through these consent processes forms the basis of personalised advertising and cross-site tracking throughout the gambling industry. They also contend that the behavioural data used to identify commercially valuable customers can overlap with indicators associated with gambling-related harm.
The study, published in Computers in Human Behavior Reports, was led by PhD researcher Jack McGarrigle under the supervision of Professor Simon Dymond, Dr Martyn Quigley and Dr Jamie Torrance.
McGarrigle said: “We audited every licensed gambling site in the UK and the picture was stark. Most aren’t giving customers a fair choice about tracking. Some make it a single click to accept and up to fifteen to refuse. Our follow-up experiment showed this isn’t incidental; it works exactly as you’d expect, nudging people toward decisions they don’t actually agree with.”
