UK Gambling Operators Face Data Privacy Questions After Large-Scale Audit

Researchers examined 624 licensed British gambling websites, including online bookmakers and casinos, and determined that 86 percent appear to be flouting GDPR rules on data collection, storage, and processing, according to findings reported in early September 2026. The audit highlighted specific patterns where operators collected personal information without meeting consent standards, and the results placed several well-known names under renewed attention. Ladbrokes, William Hill, Hollywood Bets, which sponsors Brentford FC, and Admiral Casino were among those cited in the review.

Nearly a quarter of the tested sites did not provide users with any option to disable tracking software used for targeted advertising, while two-thirds began harvesting user data before obtaining proper consent. These practices run counter to GDPR requirements that emphasize clear user control and prior agreement for processing activities. Observers note that the scale of the review, covering hundreds of licensed platforms, offers a broad snapshot of current compliance levels across the British online gambling sector.

Key Findings From the Audit

The testing process revealed consistent gaps in how data flows through these platforms, particularly around cookie deployment and initial data capture. Many sites initiated tracking scripts immediately upon user arrival, bypassing the step where individuals could review and accept privacy terms. This approach contrasts with GDPR mandates that require affirmative consent before non-essential data processing begins, and the figures indicate that a significant portion of operators have yet to align their systems accordingly.

Hollywood Bets and Admiral Casino appeared in the list of operators whose sites showed these early data collection patterns, alongside Ladbrokes and William Hill. The presence of major brands in the results underscores that the issues extend beyond smaller or lesser-known entities. Researchers documented instances where users encountered pre-checked boxes or hidden consent mechanisms that failed to meet the standard of freely given agreement.

Implications for User Data Practices

Two-thirds of the platforms started data harvesting prior to consent, a detail that points to systemic workflow problems in the sign-up and browsing experience. Nearly 25 percent omitted any mechanism for turning off advertising trackers, leaving visitors without straightforward tools to limit how their activity informs personalized promotions. These elements combine to create environments where personal information moves quickly into marketing pipelines, often before users realize the extent of collection.

Those who have studied similar regulatory audits observe that such patterns can persist when technical setups prioritize speed over layered consent flows. The September 2026 report draws attention to the fact that licensed operators, already subject to oversight from the UK Gambling Commission, still display these discrepancies in data handling. The findings do not allege intentional misconduct but instead document measurable deviations from GDPR expectations across the sampled group.

Regulatory Context and Next Steps

GDPR applies uniformly to data controllers operating within or targeting UK users, and the audit results suggest many gambling sites have not fully implemented required safeguards. The report links back to The Guardian coverage for additional detail on methodology. Operators named in the review now face questions about how they will adjust consent interfaces and data retention policies to close the identified gaps.

Further examination of the 624 sites showed variation in how quickly tracking began and whether users received clear notice of data use for advertising. While some platforms offered toggles for analytics cookies, others defaulted to full tracking without visible alternatives. This range of approaches illustrates differing interpretations of what constitutes valid consent under current rules.

Conclusion

The audit of 624 licensed British gambling websites produced clear statistics on GDPR compliance shortfalls, with 86 percent showing apparent issues, nearly a quarter lacking tracking opt-out options, and two-thirds initiating data collection before consent. Specific operators including Ladbrokes, William Hill, Hollywood Bets, and Admiral Casino appeared among the examples. These results, emerging in September 2026, supply regulators and users with concrete data points about current practices in data collection, storage, and processing across the sector.