Gambling websites accused of widespread cookie and tracking failures
A study of 624 websites operated by British-licensed bookmakers and online casinos has alleged widespread non-compliance with privacy requirements governing cookies and online tracking.
Researchers at Swansea University’s GREAT Centre found that 86% of the websites appeared to commit at least one infringement. Almost one-quarter did not provide an option to disable tracking, while 2% offered users no consent choice at all.
Two-thirds of the websites allegedly began collecting information before the user had consented. Although some pre-consent processing may be necessary – for example, to establish whether a visitor is located in the UK – the researchers found that information was also being transmitted to third-party analytics services used for marketing.
The study also identified widespread use of interface designs capable of steering users towards acceptance. These included giving greater visual prominence to privacy-intrusive options, preselecting settings and placing the rejection option behind an additional layer.
Not every interface design that encourages acceptance will necessarily invalidate consent. However, organisations must assess the experience as a whole and ensure that refusing non-essential tracking is not more difficult, confusing or time-consuming than accepting it.
The findings are particularly significant in gambling because behavioural information may reveal vulnerability or problematic patterns of play. Using those patterns to encourage continued engagement can create risks extending beyond conventional advertising compliance into fairness and consumer protection.
The ICO said that it remains committed to monitoring the UK’s most visited websites and securing long-term compliance with cookie and tracking rules. It said that it would take action where necessary to protect information rights.
Website operators should conduct technical testing from a fresh browser or device to identify every request, identifier and third-party transmission occurring before consent. Reviewing the wording of a banner without examining the underlying network activity will not establish whether the implementation is compliant.
Consent-management records should also demonstrate which choice the user made, when it was made and which technologies were subsequently activated. Organisations should repeat this testing whenever marketing tags, analytics services or consent-management platforms are changed.
Readers reviewing their own tracking practices may also wish to attend the Workshop ‘Cookies, Consent and (Marketing) Communications: What You Need To Know Post-DUAA’, available in person on 24th September and virtually on 25th September at PDP’s 25th Annual Data Protection Compliance Conference.
For more information, see our Cookies, Consent and (Marketing) Communications: What You Need To Know Post-DUAA workshop description.
