Contextual Targeting for iGaming: Why Gambling Regulators Judge the Placement, Not the Cookie

Chrome kept cookies, but gambling regulators judge ads by where they appear. We explains why contextual targeting works for iGaming only when allowlists and audience data back it up. On paper, a UK casino did everything right. Its YouTube ads went only to age-verified users over 25, and its own data showed no one younger saw them. The regulator still flagged the ad, because the channel it ran on had an audience that was more than 30% under 18. In the UK, that is enough: the test is who the channel reaches, not who saw the ad. The case is one of several in the Advertising Standards Authority’s (ASA) report on how age-restricted ads reach children online, published in December 2024 and summarized by law firm Wiggin in January 2025. Over three months, the ASA tracked more than 82,000 ads served to test profiles. Only 0.06% reached a child profile, but in several gambling cases the operator’s own targeting was set up properly and the ad still landed in the wrong place. I think that matters more than the cookie debate. Chrome has kept third-party cookies, so the “cookieless” deadline never arrived. For iGaming operators, the bigger shift is that regulators judge where an ad appears and who that place reaches. Context answers the first question, and audience data answers the second. Did the cookieless world actually arrive? Not in the way the industry planned for. In April 2025 Google confirmed Chrome would keep its current approach to third-party cookies. In October 2025 it retired most Privacy Sandbox technologies, including Topics and Protected Audience, citing low adoption. For anyone hoping to keep audience targeting as it is, that is partly good news. Third-party cookies still work in Chrome, and behavioral segments are still for sale. The picture for a gambling operator is different. Safari and other WebKit browsers already block third-party cookies by default. Consent rules under the GDPR and ePrivacy mean many players are never tracked. For a large part of a regulated audience, the experience is already cookieless. Why does context carry so much weight in gambling regulation? Because that is how the rules are written. In the UK, CAP Code rule 16.3.13 says gambling ads must not be directed at under-18s “through the selection of media or context in which they appear”. ASA guidance adds that they must not appear in media where under-18s form more than 25% of the audience. The Netherlands sets a stricter bar. Since July 2023, Dutch license holders can advertise online only if they can show that at least 95% of the people reached are over 24. The regulator, the Kansspelautoriteit (KSA), published a checklist in March 2026. It requires verifiable data and auditable reporting for that threshold, and says campaigns must be withdrawn where a platform cannot guarantee compliant outcomes. In both countries, a perfectly targeted user profile does not protect the operator if the page around the ad has the wrong audience. The casino example above shows this: user-level targeting worked, and the placement still failed the test. The Dutch rule adds a second test, because it counts the people actually reached, so there the operator needs audience data as well as context. For an operator, that changes what targeting is for. Audience data decides who is likely to convert, and in markets like the Netherlands it also has to prove who was reached. Context decides whether the ad is allowed to be there at all. How does contextual targeting work for iGaming? Contextual targeting selects ad placements by the content of the page, app or video rather than by the history of the person viewing it. A system classifies the page by topic, keywords, sentiment and sometimes the site’s audience profile. The operator then bids only on categories it has chosen. For gambling, three layers usually matter: Layer What it decides iGaming example Positive context Where the offer is relevant Live football coverage, odds and form guides, racing results, poker strategy Negative context Where the brand must never appear Youth gaming and trading sites, education for students, addiction and recovery content, debt advice Audience composition Whether the site’s audience meets the legal threshold Publisher data showing under-18s well below 25% (UK) or over-24s above 95% (Netherlands) The positive layer is where performance comes from: a sports betting ad next to a live match report reaches people already thinking about the game. Relevance does not settle compliance, though. Football coverage can draw a large under-18 audience, so it still has to pass the audience check. The negative and audience layers are the hard part. Why do contextual systems still fail? The failures in the ASA report look small on paper and still put operators’ names in a regulator’s report. One gambling ad ran on a revision site for A-level students, because the programmatic partner had filed it under “reference and directory” rather than “child education”. Another ran on an online calculator site with an under-18 audience above 30%, even though demographic targeting, exclusion lists and the site’s own block on gambling ads were all in place. Every tool worked. The label underneath was wrong. Blocklists only catch what someone has already labeled, and the ASA pointed to exactly that gap. Wiggin’s advice to operators was to switch to allowlists of vetted domains and apps wherever possible, and to keep checking placements after launch. An allowlist is only as useful as the operator’s access to it. On YouTube and social platforms, where the casino case ran, the operator works through the platform’s own categories and exclusion tools and sees what the platform chooses to report. In programmatic, the question is practical: can the team see which domains its bids went to yesterday, and can it remove one today? Whoever runs the campaigns, that access is what makes an allowlist a working control. A self-serve demand-side platform (DSP) puts it with the operator’s team, which maintains the list, reads placement-level reports and removes a domain the same day a problem appears. How should operators build a contextual strategy? Start from the regulatory threshold in each market, not from the media plan. In the UK, that means confirming the under-18 share of every site’s audience with publisher or panel data. In the Netherlands, it means evidence that over-24s make up at least 95% of the audience reached, recorded in a form the KSA can audit. Then build the allowlist around content with a clear adult skew: sports news and data, racing, financial and business media, adult-focused entertainment. Add negative categories as a second line of defense, and review placement reports weekly. Private marketplace (PMP) deals with sports and news publishers make this easier, because the publisher commits to the inventory and the audience profile in advance. In a self-serve setup such as Epom DSP, the operator’s team manages domain and app allowlists and reviews placements directly. That keeps the placement record, one part of the evidence regulators now ask for, inside the business. The cookie debate will keep running. For a gambling operator, though, the more useful question is whether it can prove, page by page, that its ads appeared only where they were allowed to.