Swansea audit of all 624 UK-licensed gambling sites puts 86% in breach of GDPR

Multiply 624 by 0.86 and you get about 537 sites ^[1][2][1]. The denominator here is the Gambling Commission's licence register itself, so there is no sampling error to argue about and no question of whether the non-compliant sites were the ones that happened to get picked ^[2]. The 67% that sent unique user identifiers to third-party analytics and marketing platforms before consent was given works out at about 418 sites ^[3][4].

The second half of the paper is a different kind of evidence. Each of 615 UK online gamblers saw a simulated betting site carrying one of six consent banners, so the site was held constant and the interface varied ^[7]. The design most common across the industry made participants three to four times more likely to accept tracking than a neutral, one-click alternative ^[8]. Because the site was a mock-up, what it measures is a click on a simulation by participants who were not in the middle of a real bet ^[7].

Participants who accepted rated their choice 4.4 out of 10 as a reflection of their real privacy preferences. Those who rejected rated theirs 7.9 ^[9]. The authors take the 3.5-point gap as evidence that the design drove the outcome ^[9][5]. A rating collected after the click cannot fully separate the banner's push from ordinary regret. The effect held regardless of participants' level of gambling risk, so the lower-risk gamblers in the sample were moved as much as the higher-risk ones ^[10].

The audit also counted the dark patterns, interface designs that steer users toward the least private option: 60% of banners gave the accept button visual emphasis, 47% hid the reject option behind a second layer and 29% preselected privacy-unfriendly settings ^[6]. Only 29% let a user refuse as easily as accept; that leaves about 443 sites ^[5][2]. McGarrigle, the doctoral student who led the work ^[12], said: "Some make it a single click to accept and up to 15 to refuse. Our follow-up experiment showed this isn't incidental; it works exactly as you'd expect, nudging people toward decisions they don't actually agree with." ^[13]

The paper's harm argument goes further than the audit measured. The authors argue that the characteristics used to identify commercially valuable players overlap substantially with the behavioural markers of gambling harm ^[11]. Dymond said: "Our research shows that the data being harvested through these designs isn't neutral; it's the same kind of behavioral signal that can flag risk." ^[15] The audit shows identifiers leaving browsers before consent and the experiment shows the banners work on gamblers. Tracing one data point through to a marketing decision about a particular customer is a step beyond both ^[3][8]. The published report of the study does not describe any regulatory action against the sites ^[18].