Why regulators judge placement, not the cookie, in contextual targeting for iGaming

Contextual advertising for iGaming only works when placement and audience data support it. In one UK case, a casino served YouTube ads only to verified users aged over 25; its logs showed no one under 18 viewed them, yet the regulator still flagged the ad because the channel had an audience with more than 30% under 18. The UK legal criterion weights who the channel reaches, not who actually saw that creative.

Regulators and empirical evidence

The UK regulator’s decision is part of the Advertising Standards Authority (ASA) report on how age-restricted ads reach minors online, published in December 2024 and summarised by law firm Wiggin in January 2025. For three months the ASA tracked more than 82,000 ads served to test profiles; only 0.06% reached a child profile. Even so, in several online gambling cases the operator’s targeting was configured correctly and the ad ended up on a placement with a child audience.

In the UK, the Committee of Advertising Practice’s CAP Code rule 16.3.13 prohibits directing gambling ads to under-18s “through the selection of media or the context in which they appear”. ASA guidance adds that media where under-18s constitute more than 25% of the audience are prohibited.

The Netherlands applies a more demanding threshold. Since July 2023 Dutch licence-holders may only advertise online if they can demonstrate that at least 95% of the people reached are older than 24 years. The Kansspelautoriteit (KSA) published a checklist in March 2026 requiring verifiable data and auditable reporting for that threshold, and it mandates campaign withdrawal when a platform cannot guarantee compliant outcomes.

Why placement matters more than the cookie

Google changed the cookie conversation several times. In April 2025 Google confirmed Chrome would keep its existing approach to third-party cookies. In October 2025 it withdrew most Privacy Sandbox technologies, including Topics and Protected Audience, due to low adoption. Nevertheless, third-party cookies remain operational in Chrome and behavioural segments are still sold.

The real impact varies by browser and market. Safari and other WebKit browsers already block third-party cookies by default. In addition, consent rules under the General Data Protection Regulation (GDPR) and ePrivacy mean many users are not tracked. For a substantial portion of regulated audiences, the experience is already effectively cookie-free.

Regulators such as the ASA and the KSA do not ask whether the individual was profiled; they ask whether the site, channel or app where the ad appears reaches an audience that breaches the legal threshold. Thus, contextuality decides whether the ad can be present; the audience data decide whether the placement complies with the law.

How contextual targeting fails in practice

The ASA report records discrete but reputationally costly failures. One gambling ad appeared on an A-level revision site because the programmatic partner classified it as “reference and directory” rather than “child education”. Another ad showed on a calculator website with more than 30% of its audience under 18, despite demographic targeting, exclusion lists and the site’s own blocking being active.

The technical problem was not the targeting logic but mislabelling of inventory. Blocklists only block what has already been misclassified. Wiggin advised operators to switch to domain and app allowlists of verified inventory whenever possible and to review placements after launch.

On platforms like YouTube and social networks the operator works with the exclusion categories and tools those providers offer; the report shows that transparency in what the platform reports is decisive. In programmatic environments the practical question is whether the team can see the domains it bid on yesterday and remove one today. A self-serve DSP platform, for example Epom DSP, places that control inside the operator’s team.

Operational elements of a compliant contextual strategy

A compliant strategy starts from the market’s regulatory thresholds, not the media plan. In the UK it requires confirming the proportion of under-18s in each site’s audience using publisher data or panels. In the Netherlands it requires evidence that 95% of those reached are older than 24, recorded in a format the KSA can audit.

Operational recommendations highlighted in the material reviewed:

• Build allowlists focused on adult-skewing content: sports news, betting data, race results and adult entertainment media.

• Add negative categories: youth education sites, minors’ forums, addiction support and debt-advice content.

• Review placement reports weekly and remove problematic domains.

• Prioritise Private Marketplace (PMP) deals with sports and news publishers to secure prior agreement on inventory and audience profile.

The core is traceability: keeping an in-house record of the domains and apps where ads ran is part of the evidentiary package regulators are requiring.

Practical conclusion

The debate about the ‘death of the cookie’ continues. For a regulated gambling operator the practical question is not only whether cookies exist, but whether it can demonstrate, page by page, that its ads appeared only in permitted places. The ASA cases and the KSA checklist indicate that verifiable audience proof and active allowlist management are now essential regulatory controls.

"The proof is not who saw the ad, but who makes up the placement’s audience," explains the case summary published by Wiggin, applied to the ASA decision.