Data Scandal in UK: Online Casinos Accused of Privacy Breaches

The UK online gambling industry is facing intense scrutiny following a report detailing systemic failures in data privacy compliance. According to researchers at the University of Swansea's GREAT Centre, 86 percent of licensed British gambling websites appear to be flouting the General Data Protection Regulation (GDPR). The study, which analyzed 624 websites, suggests that the gambling sector lags significantly behind other industries in protecting consumer data. While a broader analysis of the internet showed a non-compliance rate of 54 percent, the gambling industry’s rate of 86 percent indicates a specific and deep-rooted problem within the sector.

At the heart of the issue are the cookie banners that greet users when they first land on a site. These banners are legally required to offer clear choices about data collection. However, the study found that many operators use psychological nudges and technical obstructions to bypass these protections. By harvesting data before a user has made a choice, or by making it difficult to opt-out, these companies are accused of engaging in "data surveillance" to maintain player engagement and maximize consumer losses.

Numbers and facts

The study’s findings are stark. Nearly a quarter (24 percent) of the 624 websites tested provided no option at all to turn off tracking software. This software allows advertisers to follow users across the web and target them with tailored marketing. Operators mentioned in this context include Hollywood Bets and Admiral Casino. Furthermore, two-thirds of the operators began harvesting data the moment a user accessed the site, prior to any consent being given. High-profile brands such as William Hill and Ladbrokes were among those identified as participating in this practice.

Visual manipulation, known as "dark patterns," is also prevalent. The researchers found that 60 percent of the websites visually emphasized the least privacy-friendly option. In 29 percent of cases, privacy-unfriendly settings were pre-selected by default, and 47 percent hid the "reject" button behind a second layer of the interface. Ravi Naik, legal director at AWO, highlighted the severity of the situation:

"The most striking thing to arise from this report is the light it casts on the failure of the Information Commissioner's Office to take meaningful enforcement action against the online gambling sector." - Ravi Naik, Legal Director at AWO

Background

The Information Commissioner's Office (ICO) has been working on a multi-year project to improve cookie banner compliance across the UK's top 1,000 websites. While the regulator claims a 95 percent success rate among the most visited sites, the gambling industry remains a significant outlier. A notable enforcement action occurred in September 2024, when the ICO issued a reprimand to Bonne Terre Limited, trading as SkyBet. The investigation revealed that between January 10 and March 3, 2023, SkyBet shared personal information with advertising technology companies without prior consent.

The complaint against SkyBet was initiated by the campaign group Clean Up Gambling. They were particularly concerned about the use of behavioral data to target vulnerable individuals. In one instance, a customer’s early-morning gambling habits were used as a signal to send personalized inducements, which was viewed as a sign of harm. While SkyBet implemented changes by March 2023, the wider industry appears slow to follow suit, as evidenced by the high percentage of non-compliant sites in the Swansea report.

Why it matters for German players

For players in Germany, this report serves as a reminder of the importance of strict national regulation. The German State Treaty on Gambling 2021 (GlüStV 2021) was designed specifically to prevent the kind of data exploitation seen in the UK. Operators licensed by the GGL (Gemeinsame Glücksspielbehörde der Länder) must adhere to rigid privacy standards. The central LUGAS system monitors limits and play behavior, but it does so under strict legal oversight to prevent predatory marketing practices.

In Germany, the monthly deposit limit is capped at 1,000 euros, and stakes on virtual slot machines are limited to 1 euro per spin. These regulations, combined with the GGL's whitelist, ensure that only companies that respect both player safety and data privacy are allowed to operate. The data surveillance risks mentioned in the UK study—where profitable behavioral patterns are conflated with harmful gambling behaviors—are mitigated in Germany through transparent regulatory frameworks and mandatory player protection tools.

What it means for GGL-licensed casinos

Casinos operating with a GGL license can use their compliance as a competitive advantage. The UK scandal demonstrates that trust is easily lost when data is mishandled. GGL-licensed sites must ensure their cookie banners are "clean," meaning the "Reject all" option must be as easy to access and as prominent as the "Accept all" button. Any attempt to use dark patterns or pre-consent tracking would likely result in heavy fines or the revocation of the license in the German market. As the GGL continues to monitor the whitelist, the emphasis remains on transparency and the protection of player rights.