Both percentages can be true at once, and that is the more useful finding. One counts websites selected by traffic rank inside the regulator's own multi-year project and judged against its own criteria [4]. The other counts 624 licensed gambling sites against a threshold test of at least one apparent GDPR breach [1][2]. The pairing tells you how the ICO project defines its universe: its spokesperson described the work as "monitoring compliance across the UK's most visited websites" [12], which is a selection rule built on audience size rather than licence category or product risk.
Applied to the 624 sites, the percentages become countable populations. About 537 sites carry at least one apparent breach [1], roughly 150 offer no way to switch tracking off [2], around 416 begin collecting before consent [3], and about 12 present no consent choice at all [4]. Against the earlier study that looked at all types of website and found 54% non-compliance [11], gambling runs 32 percentage points higher, close to 1.6 times the rate [5].
A banner audit is not an adjudication, and the report itself concedes ground on that: dark patterns such as visual emphasis of the least private option, pre-selected settings and a reject button behind a second layer [8] do not in themselves constitute breaches [9], and the study's language is that sites "appear" to be flouting the rules [1]. Two of the remaining findings are about consent mechanics rather than design choices: no option to disable tracking at all [5], and no consent choice presented at all [7]. A third is about data flow: transmission to third-party analytics platforms used for marketing before consent was given [6]. All three sit squarely in the categories the cookie project exists to police.
The enforcement history in the sector, as reported, is thin and reactive. In 2024 the ICO reprimanded SkyBet for unlawfully sharing user data with advertising companies, after Clean Up Gambling raised concerns through the firm AWO; SkyBet was not among the operators the Swansea report places in breach [13]. Ravi Naik, AWO's legal director, said the most striking thing about the new findings is the light they cast on the ICO's failure to take meaningful enforcement action against online gambling [10]. Complaint-led enforcement needs a documented complaint, and the study now supplies one covering 624 sites [2].
Coverage by traffic rank is a defensible allocation for a regulator with finite staff, because it protects the most users per hour worked. The cost of that choice lands where the audience is smaller and the per-user stake is higher, which is the case the study's authors make when they describe the purpose of the data collection as "maintaining engagement and consumer losses" and point to the overlap between profitable behavioural patterns and harmful gambling [14]. That trade-off identifies who absorbs the cost, not whether the ICO chose wrongly.
The board-deck version writes itself: 86% of the sector is in the same position [1], the ICO has said only that it will act where necessary [12], and Evoke, which owns William Hill, declined to comment on the findings [15]. It is incomplete because regulators do not grade on a curve, and because the operators the study names by name, among them Hollywood Bets and Admiral Casino on the tracking finding [5] and Dafabet on the absence of any consent choice [7], are the cheapest cases for anyone to bring. The decision available this quarter is banner configuration; the decision that follows next year belongs to whoever reads the file first.
