86% of UK Gambling Sites Accused of Breaking Data Privacy Rules

According to new research from Swansea University, just one in seven UK-licensed gambling sites may be fully compliant with GDPR.

In the newly published study, researchers examined 624 gambling sites. They found that 86% appeared to breach at least one GDPR requirement relating to cookie consent and the collection of personal data.

The study also found that 24% of gambling websites gave users no option to reject tracking, while 67% processed personally identifiable information before consent had been given. A further 2% offered users no consent choice at all.

Gambling Sites Using ‘Dark Patterns’ to Gain Consent

One of the most surprising results from the study surrounded the idea of ‘dark patterns’. Dark patterns are deliberate design choices that encourage users of the site towards a particular decision. In the case of cookie banners, that might be as simple as making the ‘accept’ button much more prominent than the option to ‘reject.

The study found that 86% of the gambling websites examined used at least one ‘dark pattern’.

It’s important to remember that dark patterns are not inherently illegal. However, UK rules require ‘valid consent’ for most non-essential tracking technologies.

The Information Commissioner’s Office (ICO) says websites should make rejecting tracking as easy as accepting it. Non-exempt tracking technologies should also not be activated until a user has positively opted in.

Going a step further, the researchers also completed a separate experiment on 615 people. This experiment found that the types of cookie banners commonly used by gambling sites increased the likelihood that users would accept tracking.

Rejecting Cookies Could Take Up to 15 Clicks

Despite the aforementioned guidance from the ICO, the study found many sites make it much harder to reject tracking than to accept.

Almost half of the sites studied, 47%, used what researchers described as an ‘Accept/Settings’ banner. These typically offered users an immediate option to accept all cookies, or the option to enter settings in order to reject.

On these sites, it took an average of 3.38 clicks to reject tracking. Though, in the most extreme examples, users had to click 15 times before they could opt out.

Overall, just 29% of gambling sites allowed users to reject tracking within one click.

Cookie Banner Design Changes Player Behaviour

While the statistics surrounding design choice are certainly interesting, it’s even more important to see the impact those design choices make.

In a following study, 615 UK participants were shown one of six different cookie banners on a simulated gambling site.

Participants shown an ‘Accept/Settings’ banner were around three to four times more likely to accept all cookies than those shown a neutral banner offering a straightforward choice between accepting and rejecting tracking.

Those who accepted tracking were also considerably less likely to feel that their eventual decision reflected what they actually wanted.

Participants who accepted cookies rated the alignment between their choice and their ideal privacy preferences at an average of 4.36 out of 10. Among those who rejected tracking, that rose to 7.86.

In other words, the design of the banner did not simply change which button users clicked. Researchers found evidence that it encouraged people to make choices that conflicted with their own stated privacy preferences.

Researchers Call for Stricter Gambling Privacy Rules

The researchers argue that existing privacy laws leave too much room for interpretation. GDPR requires consent to be freely given, informed and unambiguous. But, it does not prescribe one standard cookie banner that every website must use.

The authors suggest that more specific design requirements could remove some of that ambiguity. They point to recent Gambling Commission changes to direct marketing rules, where operators must give customers clear choices and cannot opt them into marketing by default.

They suggest similar principles could be applied when gambling websites first ask users for permission to collect personal data.