Consent banners, dark patterns, and GDPR infringements in online gambling : Evidence from a systematic audit and online experiment

Abstract

Online gambling operators collect vast amounts of consumer data to track behaviour and personalise inducements. Under the General Data Protection Regulation (GDPR), access to these data requires user consent, obtained via pop-up consent banners. However, such banners tend to exhibit “dark patterns” or designs which nudge users towards accepting data sharing. To date, little is known about the extent of such dark patterns in online gambling. Here, we investigated the format of consent banners used on UK gambling websites and assessed how they may influence behaviour. Study 1 reports an audit of all UK-licensed gambling sites ( n = 624). We found that 86% of banners exhibited at least one dark pattern, while GDPR infringements were also identified: 24% of sites offered no option to reject tracking and over two-thirds (67%) processed personally identifiable data prior to obtaining consent. Only 1 in 7 or 14% of sites were GDPR compliant. In Study 2, an online randomised experiment was conducted, whereby participants ( n = 615) were assigned to different consent banners within a simulated gambling platform. The most common banner identified in Study 1 significantly increased acceptance of tracking and produced significantly lower alignment between user choices and preferences. No association between banner decisions and self-reported gambling harm severity was detected. Overall, our findings reveal widespread dark patterns and non-compliance of GDPR requirements on UK online gambling sites, influencing users towards unintended data sharing. These findings highlight the need for stronger regulatory enforcement and stricter consent banner design standards to protect consumers.