Study Shows Most UK Online Betting Sites Violate Data‑Protection Laws

A recent investigation by the Gambling Research, Education and Treatment (GREAT) Centre at Swansea University indicates that 86 % of online gambling operators licensed in the UK are not complying with the EU General Data Protection Regulation (GDPR), highlighting a pervasive compliance gap throughout the industry.

Published in the peer‑reviewed journal *Computers*, the study surveyed a representative selection of gambling websites holding UK licences. By comparing each site’s privacy statements, data‑processing methods and consent mechanisms with GDPR standards, the researchers found that only a tiny fraction of operators fully satisfied the regulation.

The GDPR, which has applied across the European Economic Area since 2018, sets out rigorous duties for any entity that gathers, stores or processes personal information. Core requirements include obtaining unambiguous consent, granting individuals the right to view and erase their data, and reporting breaches within 72 hours. For online gambling companies that routinely manage sensitive financial and behavioural data, adherence is more than a legal checkbox—it underpins consumer confidence.

These results raise alarms for the millions of Britons who place bets online. Weak data safeguards can leave players vulnerable to identity theft, unsolicited marketing, and broader privacy violations. Consumer advocacy groups have long warned that the sector’s swift digital expansion is outpacing its capacity to protect personal data, and the new findings give weight to those concerns.

Regulators are expected to take notice. The UK Gambling Commission, responsible for licensing and oversight, has previously singled out data security as a key focus. While the body can impose fines and require corrective measures, its enforcement history has centered on gambling‑related harms rather than privacy infractions. The GREAT Centre’s report could trigger a shift toward tighter scrutiny of data‑protection practices.

Industry representatives have reacted with a blend of caution and resolve. Some operators have vowed to audit their data‑handling processes and refresh privacy notices, pointing to the study as a spur for change. Others contend that the regulatory environment is already intricate and that achieving GDPR alignment across multiple jurisdictions poses practical difficulties.

Looking forward, the authors advocate a coordinated strategy that incorporates regular independent audits, clearer guidance from the Gambling Commission, and harsher penalties for breaches. As the online gambling market continues to expand, safeguarding personal information will remain a vital test of both industry accountability and regulatory efficacy.