Nine in 10 UK gambling websites appear to breach data privacy rules, with cookie banners designed to push customers towards being tracked, researchers say.
Nearly nine in 10 online gambling websites licensed in the UK are failing to meet data protection requirements, according to research by Swansea University.
Researchers from the university’s Gambling Research, Education and Treatment (GREAT) Centre examined all 624 casino and sports betting websites licensed by the Gambling Commission, looking at both their cookie consent banners and the data being sent to third parties.
They found that 86% appeared to be operating in breach of the General Data Protection Regulation (GDPR).
In many cases, customers were being tracked before they had agreed to it. Two-thirds of the websites (67%) sent unique identifiers to third-party analytics and marketing companies before users had given their consent.
Almost a quarter (24%) offered no way to refuse tracking, while 2% did not display a cookie consent banner at all.
Even where users were given a choice, rejecting tracking was often much harder than accepting it.
Only 29% of websites made the two options equally easy. On some sites, researchers found that refusing tracking required as many as 15 clicks.
The study also found widespread use of so-called ‘dark patterns’ – website designs intended to nudge people towards a particular choice.
Six in 10 sites (60%) made the accept button more visually prominent, while 47% hid the reject option behind another layer of menus. Nearly three in 10 (29%) had privacy-unfriendly settings pre-selected.
The researchers then tested whether these designs actually changed people’s behaviour.
They showed 615 UK online gamblers simulated betting websites using one of six different cookie banners. The design most commonly found in the industry audit made participants three to four times more likely to accept tracking than a neutral design where accepting and rejecting required just one click.
Those who accepted tracking were also less likely to feel that their decision reflected what they actually wanted. They rated their choice at an average of 4.4 out of 10, compared with 7.9 among those who rejected tracking.
The researchers said the findings suggested that the design of the consent process could be influencing people’s decisions, rather than simply recording their existing privacy preferences. The effect was seen regardless of participants’ level of gambling risk.
The findings raise wider questions about how gambling companies use personal data.
The research, published in Computers in Human Behavior Reports, was led by PhD student Jack McGarrigle, supervised by Professor Simon Dymond, Dr Martyn Quigley and Dr Jamie Torrance.
Jack McGarrigle said: ‘We audited every licensed gambling site in the UK and the picture was stark. Most aren’t giving customers a fair choice about tracking. Some make it a single click to accept and up to fifteen to refuse. Our follow-up experiment showed this isn’t incidental; it works exactly as you’d expect, nudging people toward decisions they don’t actually agree with.’
Professor Dymond added: ‘Our research shows that the data being harvested through these designs isn’t neutral, it’s the same kind of behavioural signal that can flag risk. Getting consent right isn’t just a data protection issue for the industry, it’s an important part of preventing gambling harm.’
Photo: Rob Hampson
Leave a Reply