Online casino data privacy

Online casino data privacy: why casinos collect more than other sites

Most websites collect data because it helps them sell. Licensed casinos collect much of theirs because the law tells them to. Gambling Commission licence conditions require casinos to confirm you are 18 or over and who you are, to watch for signs of gambling harm, to prevent money laundering, and to honour self-exclusions across the industry. Each of those duties needs personal data, and some need data from outside the casino, such as credit reference or public records.

That does not make privacy irrelevant. It means the useful questions are narrower: what is collected beyond the legal minimum, who it is shared with, how it is used for marketing, and how long it is kept. This page is part of our UK casino guides and complements our guide to casino account security, which covers protecting that data from criminals.

What data online casinos collect and the reason for each

The right-hand column is the key to reading any casino privacy notice. Data collected because the law requires it cannot be refused if you want an account. Data collected for analytics, personalisation or advertising is where your choices make a difference.

Age and identity checks: what happens to your details

Since May 2019, online casinos have had to verify your age and identity before you can deposit or gamble, and since then even free-to-play demo games sit behind age verification. The minimum is your name, address and date of birth. According to the Commission’s guide to age and ID verification (opens in a new tab), casinos usually check these against databases such as credit reference agencies and the electoral roll first, and ask for documents only if that fails.

An identity check through a credit reference agency is not a credit application. It confirms you exist at the address you gave and are over 18; it is not a lending decision. Our guide to casino verification explains each stage, and why casinos ask for documents covers the document requests that follow.

Financial checks and how much they reveal

Financial data is where most players’ privacy worries focus, and where most misinformation circulates. The rule in force is the financial vulnerability check: since 28 February 2025, when your net deposits pass £150 within a rolling 30 days, the casino must check public records for signs of financial difficulty such as bankruptcy or county court judgments. The threshold was £500 when the rule began on 30 August 2024. The detail is in licence condition 3.4.4 on financial vulnerability checks (opens in a new tab).

A worked example: you deposit £100 on 3 March, withdraw £20 on 10 March and deposit £80 on 20 March. Your net deposits for the period are £160, which passes £150, so the check is triggered. The casino looks at public records only; it does not see your bank balance or salary.

Fuller credit-reference “financial risk assessments” were trialled in a pilot but are not a live requirement, and the Commission has said that calling them “affordability checks” is inaccurate. Separately, a casino’s own anti-money laundering or harm processes may lead it to ask for payslips or bank statements at higher spending levels; our answer to why a casino wants payslips explains when that happens. The affordability checks page sets out what is and is not current.

Who online casinos share your data with

Sharing is often unavoidable and sometimes protective. Typical recipients include identity verification and credit reference agencies, payment providers, the game suppliers who run the games, fraud prevention services, GAMSTOP (to check whether you have self-excluded), the Gambling Commission and other authorities when legally required, and, for brands within a group, other companies in the same group. Coral and Ladbrokes, for example, are both run by LC International Limited.

Self-exclusion is a good illustration of sharing working in your favour. When you register with GAMSTOP (opens in a new tab), your details are matched against every licensed online casino’s sign-ups, which is how one registration can block you everywhere. Our explainer on whether online casinos share your data goes through each recipient type.

Selling or sharing your details with unrelated marketers for their own use would be a different matter, and the casino’s privacy notice must say if it happens. Read the section usually titled “who we share your information with” before you register.

Marketing consent: the 2025 rule that changed casino emails

Since 1 May 2025, remote casino, betting and bingo operators have had to let you choose marketing separately for each product (casino, betting, bingo) and for each channel (email, SMS, phone) when you register, with nothing switched on by default. Existing customers were asked to confirm their preferences at their first login after the change. Post was dropped from the list of channels.

In practice, a multi-product brand can no longer assume that agreeing to football emails means agreeing to casino texts. If you start receiving messages you did not opt in to, change your preferences in the account and, if it continues, complain. The Commission’s page on stopping gambling marketing texts and emails (opens in a new tab) sets out the options, and our guides to opting out of casino marketing and the marketing consent rules go further.

Casino app privacy labels compared

Apple requires every App Store listing to summarise the data an app collects and whether it is used to track you across other companies’ apps and websites. These labels are written by the developer, not audited by Apple in detail, but they are a quick way to compare apps before installing. Here is what the British listings showed on 20 October 2026.

On iPhone you can refuse cross-app tracking when an app asks, or turn it off for all apps in Settings under Privacy & Security. Refusing tracking does not affect your ability to play. If you would rather avoid app permissions altogether, a mobile browser gives you direct control of cookies; our comparison of casino apps vs mobile sites covers that trade-off.

Your data rights at a UK online casino

UK data protection law, the UK GDPR and the Data Protection Act 2018, gives you rights over the personal data a casino holds. The casino’s privacy notice must explain how to use them and name a contact, often a data protection officer.

The erasure limit surprises many people who close an account. Under the Money Laundering Regulations 2017, businesses must generally keep customer due diligence and transaction records for five years after the business relationship ends. Closing your account, which our guide on how to close a casino account covers, stops new processing for marketing but does not wipe those records.

How to request a copy of your casino data

A subject access request (SAR) is the most useful privacy tool for casino players. It can show your full transaction and gambling history, notes from safer gambling interactions, and the marketing preferences recorded against you, which can help with a complaint or simply with understanding your spending.

1. Find the casino’s privacy notice, usually linked in the website footer, and note the data protection contact or email address.
2. Write a short request saying you are making a subject access request and asking for all personal data held about you, including gambling history, transactions and customer interaction notes.
3. Include your full name, account username and the email address on the account, so the casino can find your records.
4. Expect the casino to confirm your identity before releasing data; that protects you from someone else requesting it.
5. Note the date sent: a response is normally due within one month, which can be extended by up to two further months for complex or numerous requests.
6. If there is no reply or the reply is incomplete, follow up in writing, then complain to the Information Commissioner’s Office if needed.

Privacy red flags at an online casino

• No clear privacy notice, or one that never names the company responsible for your data.
• Requests for ID documents through email replies, chat attachments or social media rather than a secure upload area.
• Marketing switched on by default or bundled across products, which has not been allowed since 1 May 2025.
• No Gambling Commission licence number in the footer, which means none of the British protections apply.
• Pressure to send bank logins, passwords or one-time codes; no legitimate casino needs them.

The last two usually point to a fake site or scam rather than a privacy failing at a real casino. Our guides to spotting a fake casino and online casino scams cover those cases.

Where to complain about casino data use

Start with the casino’s data protection contact. If that does not resolve a privacy complaint, the Information Commissioner’s Office (ICO) is the regulator for data protection, not the Gambling Commission. Complaints about gambling issues in the same dispute, such as a withheld withdrawal or a failure to act on harm, go through the casino’s complaints process and then its ADR provider; our complaints guide explains that route.

Comparing privacy at licensed casinos

If privacy matters to you, compare the app labels above and read each privacy notice before signing up. The three casinos below are licensed by the Gambling Commission; offers were last checked on 5 October 2026, and you must be 18+ with terms applying.

• Coral Casino (LC International Limited, which also runs Ladbrokes): new players who deposit and bet £10 or more on slots receive 100 free spins on selected games at 10p each, accepted within 48 hours and used within 7 days, with no wagering on winnings. Deposits by Neteller, PayPal, Paysafe, Skrill, prepaid cards and certain debit cards don’t qualify. See Coral’s casino page.
• PlayOJO (Skill On Net Limited), whose iOS label lists only identifiers as used for tracking: a first deposit of £10+ from new UK customers outside Northern Ireland brings 80 free spins on Big Bass Bonanza at 10p each, with no wagering and winnings paid in cash. See our PlayOJO page.
• Casumo (Recro Limited): new customers who opt in and deposit at least £20 get a 50% bonus up to £100, wagered 10x within 7 days, with a £5 maximum stake while the bonus is active; game, play and payment restrictions apply. See our Casumo page.

18+. Gambling should be entertainment that costs money, not a way to make it. Set a deposit limit before you play: how to set deposit limits. Free, confidential help: National Gambling Helpline 0808 8020 133.