Evaluation method
Evaluation Criteria for Consent and Preference Platforms
A consent and preference platform for gambling must capture choices that start unselected, store them by product and channel, keep the exact wording shown, let customers withdraw easily and prove every change. These tests check each one before you buy.
In short
- Tier 1: nothing preselected, product and channel matrix, easy withdrawal, no forced consent at sign-up.
- Tier 2: wording versions, append-only history, per-customer proof export, event output.
- Tier 3: theming, languages, analytics.
- Ask the vendor to reproduce the decisions in our consent-state explorer.
Scope and limits. Tests for buyers; not a review of any product. For the screen patterns these tests assume, see consent capture and preference center design.
Tier 1: capture and withdrawal
| Requirement | Test | Passing looks like |
|---|---|---|
| No preselection (UK GDPR) | Load the registration widget with default settings | Every marketing option starts off |
| Product and channel matrix (SR code 5.1.12) | Configure betting, casino and bingo against phone, email and text | Each cell stored and changeable on its own |
| Confirmation step limits (SR code 5.1.12) | Turn on a confirmation step | It only accepts or declines the selection, with one click |
| Withdrawal at any time (AGCO Standard 2.07) | Withdraw one product and channel from the preference center | Applied at once, no login loop or reason required |
| No forced consent (Australia, National Consumer Protection Framework) | Complete registration with every option off | Account creation succeeds |
The first test reflects the statement by the Information Commissioner's Office (ICO) that "Silence, pre-ticked boxes or inactivity should not therefore constitute consent."
Tier 2: proof and output
| Requirement | Test | Passing looks like |
|---|---|---|
| Evidence of consent (SR code 5.1.11) | Export one customer's record | Each change with time, source, actor and wording version |
| Wording versions | Change the opt-in text, then view an older consent | The older consent shows the older text |
| Event output | Change a preference | An event is published to your stream within seconds |
| Re-consent | Withdraw, then opt in again | A new consent record; the old one is not restored |
The record design behind these tests is in audit trail patterns.
Tier 3: presentation
- Matches your site's design and accessibility standards.
- Supports the languages of the markets you serve.
- Reports consent rates without nudging design.
Reproduce the explorer
Ask each vendor to configure the published test cases behind the consent-state explorer and show the result for each. Any case that produces a send where the explorer suppresses or holds needs an explanation.
Market settings to configure in the trial
A consent platform serving several markets should hold different rules per market without separate copies of the customer record. During the trial, set up one account per market and check that each behaves as configured:
- Great Britain: the product and channel matrix for remote casino, bingo and betting licenses, with a confirmation step limited to accept or decline.
- Ontario: a record that inducement messages need active consent before they are sent by direct marketing.
- Australia: registration that completes with every marketing option off.
- United States: separate handling for email and text message permissions, because the federal rules for each differ, as set out on marketing consent law by country.
Red flags in a demo
- The vendor shows a single "marketing" toggle and says the matrix can be "added later".
- Default templates arrive with options already switched on.
- Withdrawal needs a login, a reason or a second click.
- The history view shows only the current value, or lets an administrator edit past entries.
- Events are exported in a nightly file rather than published when a change happens.
Any one of these is worth a written answer from the vendor before you continue.
Questions
Do we need a separate consent platform if the CRM stores permissions?
Not necessarily. The tests apply to whichever system captures and stores consent. A separate platform makes sense if the CRM cannot pass tier 1.
Should the platform handle self-exclusion?
Usually not. Exclusions come from responsible gambling systems and national registers, and should sit in a safeguarding store that the consent platform cannot overwrite.
Sources
- Information Commissioner's Office, What is valid consent?, page dated August 4, 2026 (under review after the Data (Use and Access) Act).
- Gambling Commission, LCCP Condition 5.1.12 - Direct marketing preferences, no date shown.
- Gambling Commission, LCCP Condition 5.1.11 - Direct electronic marketing consent, no date shown.
- Alcohol and Gaming Commission of Ontario, Registrar's Standards for Internet Gaming, marketing and self-exclusion sections updated May 14, 2026.
- Victorian Gambling and Casino Control Commission, National Consumer Protection Framework, updated June 12, 2026.
Every source was read on October 28, 2026. How we choose sources: data sources.
Safer gambling support is listed on the safer gambling page.