Regulators are judging iGaming ads by placement not cookies — what that means

Regulators now assess gambling advertising by where an ad appears and who that placement reaches rather than by cookie-based audience signals. The Advertising Standards Authority’s report, published in December 2024, tracked more than 82,000 ads over three months and found 0.06% reached a child profile; nonetheless, multiple gambling ads were flagged because the channels or pages they ran on had audiences with a substantial under-18 share. In one UK case a casino’s YouTube ads were served only to age-verified users over 25 and its data showed no under-18 views, but the channel’s audience was more than 30% under 18 and the placement was still considered non-compliant.

Regulation assesses placement and audience, not just targeting method

The UK Advertising Standards Authority enforces the CAP Code. CAP Code rule 16.3.13 states gambling ads must not be directed at under-18s “through the selection of media or context in which they appear”, and ASA guidance sets a practical audience threshold: an ad must not appear in media where under-18s form more than 25% of the audience. That is the test the ASA applies when it examines placements, even where operator-level targeting or age verification appears to have worked.

The Netherlands applies a stricter rule. Since July 2023, Dutch license holders can advertise online only if they can show that at least 95% of the people reached are over 24. The Kansspelautoriteit published a checklist in March 2026 requiring verifiable data and auditable reporting for that threshold, and it instructs operators to withdraw campaigns where a platform cannot guarantee compliant outcomes.

The ASA’s December 2024 monitoring exercise — summarised by law firm Wiggin in January 2025 — underscores the distinction between user-level targeting and placement-level audience composition. Over the three-month study the ASA recorded more than 82,000 ads; the tiny share that reached test child profiles (0.06%) did not stop the ASA from flagging ads that landed on channels or pages whose audience profile failed the regulator’s placement test.

“The test is who the channel reaches, not who saw the ad,” the ASA’s approach is clear in the reported cases, where correct targeting still produced non-compliant placements.

Why contextual targeting alone is insufficient for gambling

Contextual targeting selects placements by page, app or video content rather than by a person’s browsing history. For iGaming three layers typically matter:

• Positive context: where the content makes an offer relevant, for example live football coverage, odds and form guides, racing results or poker strategy.

• Negative context: where gambling must never appear, for example youth gaming and trading sites, student education or addiction and recovery content, and debt advice.

• Audience composition: whether the site’s audience meets the legal threshold — under-18s below 25% in the UK or over-24s above 95% in the Netherlands.

Context answers whether an ad is allowed to appear on a given page. Audience data answers whether the people reached meet the market’s legal threshold. The ASA cases show an operator’s contextual classification can be correct while the placement still fails because the publisher’s audience skews young.

Where contextual systems fail in practice

The ASA examples identify classification and labelling errors as the main operational gaps. One gambling ad ran on a revision site for A-level students because a programmatic partner had categorised the site under “reference and directory” rather than “child education”. Another ran on an online calculator site whose under-18 audience exceeded 30%, despite demographic exclusions and the site’s own block on gambling ads. In both incidents every technical tool had been applied; the category label beneath the placement was wrong.

Wiggin’s practical advice is to prefer allowlists of vetted domains and apps and to keep checking placements after launch. An allowlist only works if the operator — or the team running campaigns — has timely access to placement-level reports and can remove domains on the same day a problem appears. Where campaigns run through major platforms such as YouTube, operators must rely on the platform’s categories and exclusion tools and on the platform’s reporting.

A self-serve demand-side platform keeps that control inside the operator’s team. The article’s example points to setups such as Epom DSP where the operator manages domain and app allowlists, reads placement-level reports and removes non-compliant domains without waiting for an intermediary.

What operators must now evidence for compliance

Operators need two forms of proof in many regulated markets:

1. Documented context selection showing which content categories were bid on or blocked.

2. Verifiable audience or reach data demonstrating the people actually reached meet the market threshold (publisher data, panel data or auditable platform reporting).

In the UK that means confirming the under-18 share of every site’s audience with publisher or panel data. In the Netherlands it requires evidence that over-24s make up at least 95% of the audience reached, and records in a form the Kansspelautoriteit can audit. Private marketplace (PMP) deals with sports and news publishers ease this process because the publisher commits to inventory and an audience profile in advance.

Cookies, Privacy Sandbox and why the debate matters less for regulated advertising

Google confirmed in April 2025 that Chrome would keep its current approach to third-party cookies, and in October 2025 Google retired most Privacy Sandbox technologies, including Topics and Protected Audience, citing low adoption. That left third-party cookies working in Chrome longer than many expected. Safari and other WebKit browsers, however, already block third-party cookies by default, and consent regimes under the GDPR and ePrivacy mean substantial sections of regulated audiences are effectively cookieless.

For gambling operators the practical takeaway is that the technical availability of cookies is less decisive than the ability to prove, on a placement-by-placement basis, that ads appeared only where allowed. Contextual targeting remains useful for relevance, but audience composition and auditable placement records determine regulatory compliance.

“For a gambling operator, the more useful question is whether it can prove, page by page, that its ads appeared only where they were allowed to,” Wiggin advised in its summary.

Operators therefore need a contextual strategy built from the regulatory threshold in each market, an allowlist of vetted inventory, negative categories as a second line of defence, and weekly placement reviews. Where possible, use PMP deals or a self-serve DSP so the placement record and removal capability sit inside the business.