67% of UK Gambling Sites Sent IDs Before Consent: Run the Same Check on Yours

The paper appeared in Computers in Human Behavior Reports in August 2026, open access, and reached a general audience through the Guardian on 6 September. Most coverage has led with the dark-pattern figures. The more useful part for anyone running a site is the method, because it is precise, cheap and reproducible.

What the audit actually measured

The sample started from the Gambling Commission’s licensee list, 934 entries, and removed lottery operators, bingo sites, inactive and duplicate domains, leaving 624 casino and sports betting sites. Each was visited between April and June 2025 in Chrome 126, incognito, with no extensions and no VPN, from a UK IP address. The network log was captured in DevTools on page load, before anyone touched the consent banner.

The criterion is worth quoting exactly, because it is narrower and better than “tracked before consent”. A request counted as pre-consent processing where it “contained a persistent unique identifier and was directed to a non-essential third-party service (e.g. Google Analytics, Meta Pixel, advertising networks) prior to any user interaction.”

Three things follow from that wording. It is about requests, not cookies — a site that sets nothing can still fail it. It needs a persistent identifier, not just any parameter that looks like an ID. And it applies only to non-essential third parties, so a payment processor or a CDN does not count.

The numbers

Sent a persistent ID to a third party before interaction   418 / 624   67%
No consent banner at all                                          12    2%
Banner with no way to refuse ("no option")                       137   22%
Refusal as easy as acceptance (one click)                              29%
Clicks needed to refuse, worst case                               15
At least one dark pattern                                        538   86%
Fails at least one of four GDPR consent criteria                 536   86%

On the first line, the authors note that “many of these requests corresponded to Google Analytics 4 (GA4) tracking endpoints.” They give no ranking of vendors, and the paper names no operators. Two limits are stated plainly and should travel with the figures: the banners were coded by a single researcher without an inter-rater check, and the compliance figure “reflects a research-based evaluation rather than a formal legal determination”.

The regulator’s position

Asked by the Guardian, an ICO spokesperson said the regulator was committed to “monitoring compliance across the UK’s most visited websites and driving long-term adherence to lawful cookie practices”, adding: “We will take action where necessary to protect people’s information rights.”

The first half of that is the interesting part. The ICO’s cookie programme has been built around the most visited sites, and by its own account it has worked: in April 2026 it said 99% of the UK’s top 1,000 websites now meet its cookie banner standards. A sector list is a different sample. Most licensed gambling domains are not in anyone’s top 1,000, and the gap between those two figures is roughly the gap between being on the regulator’s list and not being on it. It is not a sector the ICO has ignored — it reprimanded Sky Betting and Gaming in 2024 for sharing data with adtech before visitors could accept or reject.

What has changed since the crawl

The audit ran before the Data (Use and Access) Act 2025 changed the UK cookie rule. Its new exceptions, including one for statistical purposes, came into force on 5 February 2026. That matters for reading the 67% today, because some pre-consent analytics can now be lawful in the UK without consent. Only some, though, and the ICO’s guidance on the exceptions sets out the conditions:

• The output has to be aggregate statistical information, used only to improve your own service.
• If a third-party analytics provider is involved, “your third party provider must be a processor, not a joint controller”, and must not link the data with anything else it holds.
• The exception “does not apply to purposes related to online advertising”. Conversion measurement for ad partners needs consent.
• You must tell visitors, and give them a simple, free way to object.

None of that covers a Meta Pixel or an ad network firing on page load, which the audit also counted. The EU position is unchanged: Article 5(3) of the ePrivacy Directive has no statistics exception of this kind.

The detail that decides the result: persistence

If you run this check on a site using Google Consent Mode, you will find that GA4 still sends a page_view to google-analytics.com/g/collect before consent, and that the request still carries a cid parameter. Taken at face value, that looks like a failure under the paper’s criterion. It is not necessarily one, and the only way to tell is to load the page twice.

We built two fixture pages with the same GA4 tag. One has no Consent Mode. The other sets ad_storage, analytics_storage, ad_user_data and ad_personalization to denied before gtag.js loads. We cleared cookies and storage, then loaded each page twice in Chromium on 11 September 2026:

                       load 1                  load 2                  cookies
No Consent Mode        cid 1753528527.1789…    cid 1753528527.1789…    _ga, _ga_<id>
                       (no gcs)                (no gcs)
All four denied        cid 729748750.1789…     cid 923665691.1789…     none
                       gcs=G100                gcs=G100

Without Consent Mode the cid is written to the _ga cookie and comes back identical on the second load. That is a persistent unique identifier in exactly the paper’s sense. With every signal denied, no cookie or localStorage entry is written and the cid is regenerated on every page load, so it cannot link one visit to the next. Same parameter name, same endpoint, a different finding.

This is why a checker that flags “request to Google Analytics before consent” overcounts, and one that looks only for cookies undercounts. The question is whether the same value comes back. Whether a denied-state ping is acceptable at all is a separate argument, and gcs=G100 is how you confirm what state the tag believed it was in — we covered reading it in verifying Consent Mode from the network tab.

Running the audit’s check on your own site

1. Open a private window with no extensions. If your banner is geo-targeted, test from the region you care about; the researchers used a UK IP for that reason.
2. Open DevTools, Network tab, tick Preserve log, then load the page. Do not touch the banner.
3. Filter for third-party hosts. For GA4 that is collect; for everything else, sort by domain and look at anything that is not yours.
4. For each third-party request, find the parameter that looks like an identifier. Reload the page and compare it. If it is the same value, you have what the audit counted.
5. Repeat on a page that is not your homepage. Tags are often configured differently on landing pages, checkout and account areas.

Doing this by hand across a whole site gets tedious quickly. The same check can be scripted — our Playwright script for pre-consent tracking captures every request made before interaction — and the reload comparison is a few more lines on top. Keep in mind that third parties which are not tags at all, such as fonts and embedded maps, sit outside Consent Mode entirely; we measured those separately.

The Swansea researchers did this by hand, one site at a time, with DevTools. Run the same pre-consent check across your pages with CookieInspector’s audit tool.