UK iGaming · PECR / storage & access technology QA

Test the consent journey, not just the banner text.

Lexsentra observes what a fresh browser does before a choice, after Reject and after Accept, then preserves reviewable evidence. It reports observable risk signals — not a blanket legal verdict based on a tracker domain.

ICO guidance finalised 29 April 2026Baseline → Reject → AcceptPurpose-aware tracker classification

What the browser QA checks

Fresh baseline state.
Capture visible consent controls, cookie/storage keys, redacted requests and the initial screenshot before Lexsentra interacts with the page.
Reject in a fresh context.
Activate a visible Reject-style control, confirm that the action changes page/client state, and observe what storage/access endpoints continue afterwards.
Accept in a separate fresh context.
Repeat independently with an Accept-style control so before/after differences are attributable to the selected consent state.
Preserve provenance.
Record which visible interactive control was detected, its container/role and the evidence relevant to the observation.
Compare later runs.
Scheduled monitoring can surface material changes in findings, trackers, cookies and consent surfaces.

How Lexsentra avoids overclaiming

Purpose-awareAnalytics is not automatically unlawful

ICO’s current guidance includes statistical and appearance exceptions. Whether they apply depends on purpose and specific conditions, including information and a simple, free means to object. Lexsentra therefore treats relevant analytics endpoints as requiring purpose/configuration review rather than deciding legality from the hostname alone.

Higher confidence signalAdvertising endpoints

Advertising/retargeting endpoints observed before valid consent or persisting after a confirmed Reject action are stronger review signals, but the report still separates the technical observation from the final legal determination.

Inconclusive remains validAmbiguous UI or server-side behaviour

If the consent control cannot be identified confidently, or purpose cannot be established from browser evidence, the correct outcome is deeper review — not a fabricated pass/fail.

ICO notes that server-side tagging can make third-party sharing less visible in the browser. Browser QA is strong evidence of observable behaviour, but it cannot prove every server-side processing purpose.

Why this matters in gambling

In September 2024 the ICO reprimanded Bonne Terre Limited, trading as Sky Betting and Gaming, after advertising cookies were used to process and share personal information before users had an opportunity to accept or reject them. The operator changed its site so people could reject advertising cookies before information was shared for those purposes.

This is useful enforcement context, not a rule that every tracker or analytics request on every gambling site is automatically unlawful.

Generate evidence before you add another spreadsheet.

Run a free preliminary scan, move into recurring workspace monitoring, or book a 30-minute Regulatory QA Pilot to review one real PECR/consent surface with evidence and explicit legal-review boundaries.

Run free scan Create workspace Book 30-minute pilot