Since 1 May 2025, UK remote gambling operators can no longer rely on a single marketing consent at registration. Social responsibility code provision 5.1.12 of the Gambling Commission's Licence Conditions and Codes of Practice (LCCP), on direct marketing preferences, requires customers to choose marketing by product and by channel.
UKGC SR Code 5.1.12: Gambling Direct Marketing Opt-ins by Product and Channel
This guide covers the requirements and what they mean for your sign-up flow, your CRM and your evidence.
Licensees must give customers options to opt in to direct marketing for each product and each channel, where applicable:
The options must start unticked. Lottery products, push notifications, post and land-based operators are outside the scope of the final rule.
The Commission's position is that the soft opt-in, the PECR route that lets businesses market similar products to existing customers without fresh consent, is no longer viable for remote gambling operators.
Existing customers who had not opted out had to be asked to confirm their marketing preferences at their first log-in after the provision came into force.
A related change applies from 19 December 2025: licensees may not combine more than one gambling product type in a single incentive. Operators can still send separate offers for different products through the same channel, as long as the customer opted in to each.
For an operator offering all three products, the result is a grid of up to nine independent choices:
| SMS | Phone | ||
|---|---|---|---|
| Betting | ☐ | ☐ | ☐ |
| Casino | ☐ | ☐ | ☐ |
| Bingo | ☐ | ☐ | ☐ |
Only show the cells that apply to your products and channels.
For product managers, the grid needs a home in two places: the registration flow, and a preference centre in account settings where customers can change it at any time. Keep it readable on mobile; a grid with clear row and column labels usually works better than nine separate questions.
For CRM and marketing teams, audiences are no longer "marketable / not marketable". Every campaign has to be filtered by product and channel, so a casino email only reaches customers with a yes for casino by email. Combined with the single-product incentive rule, campaign planning has to start from the product. Lists get smaller, but they're made of customers who asked for that content.
When a customer says they never agreed to calls about bingo, you need to show what they chose, when, and where. The UK GDPR (Article 7(1)) puts the burden of proof on you. That calls for a dated, append-only record of every opt-in and opt-out, separate from the current setting in your CRM.
UniConsent's UK gambling direct marketing template creates the nine opt-ins as custom purposes in one step, each with clear wording. You remove the ones you don't need.
Your registration form and preference centre record each choice in UniConsent, on the website and in your iOS, Android, Flutter or React Native app. Every change is stored in the UniConsent Consent DB with your customer ID, so support and compliance teams can search a customer's full history in the dashboard.
For developers: record choices with setCustomConsent, through __unicapi on the web or the same method in the mobile SDKs (version 26.10.1 and later), and link them to the customer by pushing a customer_id user ID. Read the current state with getCustomConsents to sync it to your CRM. See the custom purposes documentation.
Your website still needs cookie consent for analytics and advertising cookies. That's a separate obligation, as the ICO's reprimand of Sky Betting and Gaming showed. For the Netherlands, Sweden and Italy, see our consent management guide for gambling operators.
This article is general information, not legal advice. Check the requirements for your licences with your legal advisers.
UniConsent is a consent management platform (CMP) for websites and apps, supporting GDPR, the UK GDPR, IAB TCF, US state privacy laws and more. Get started for free.
Compliant with GDPR, CCPA, COPPA, LGPD, PECR, PDPA, PIPEDA, and more.
Beginnen Sie damit, Ihre Website und Anwendung gemäß EU-DSGVO, US-CPRA, CA-PIPEDA usw. konform zu machen
Registrieren
11 Mio. € DPC-Bußgeld gegen Tinder: Ein Self-Service-Datendownload muss sagen, was er auslässt

Safari Global Privacy Control in iOS 27.3: So bereiten Sie Ihr Consent-Banner auf GPC vor
FedEx: 2,975 Mio. $ CCPA-Bußgeld für Cookie-Einstellungen, die weder Werbe-Tracker stoppten noch GPC beachteten
Coca-Cola Cookie-Klage: Was "Ablehnen" leisten muss, damit die Tracker wirklich stoppen

Session Replay und DSGVO: Hotjar, Clarity und FullStory richtig konfigurieren

Server-Side Tagging und Tracking: Warum die DSGVO-Einwilligung weiter gilt
Beginnen Sie damit, Ihre Website und Anwendung gemäß EU-DSGVO, US-CPRA, CA-PIPEDA usw. konform zu machen
RegistrierenDatenschutzgesetze, Einwilligung und Compliance, ein paar E-Mails im Monat.