In RTM -v- Bonne Terre Limited and another [2026] EWCA Civ 488, the Court of Appeal has clarified that the test for whether consent has been lawfully given under data protection law is objective, not subjective, overturning a High Court decision concerning targeted gambling advertising. In other words, the focus is on what the data subject did or communicated, viewed objectively, rather than on their internal state of mind or personal vulnerability.
Background to the claim
The appellants operate under the Sky Betting and Gaming (SBG) brand of online gambling platforms, providing paid-for betting and gaming products and free-to-play games. RTM used to gamble online and said it was compulsive, out of control and destructive. He said that although he did not gamble exclusively with SBG, it was his preferred and predominant online platform at the time, and he used several of its products.
He brought a privacy claim in data protection and the misuse of private information. He says SBG gathered and used extensive information, generated by his use of its platforms, unlawfully, including by analysing and combining it through sophisticated profiling algorithms, and especially by way of personalised and targeted marketing which he could not handle, and which fed his compulsive behaviour. He sought compensation for harm, distress and loss. The High Court was unpersuaded about the claim for misuse of private information but said that the consent was insufficiently freely given because the circumstances of his consenting behaviour are not recognisable as amounting to free, unambiguous, informed, specific, or distinct from the uncontrolled craving to gamble. The court also said that there was no lawful basis for profiling problem gamblers.
Although not directly determinative of the appeal, the earlier ICO reprimand provided important regulatory background. In 2024, it had issued a reprimand to SBG for unlawfully processing people’s data through advertising cookies without their consent. It had found certain third-party marketing cookies were being deployed before visitors had provided their consent, resulting in the processing of individuals’ personal data without consent or any other valid lawful basis. SBG subsequently made changes so that website users were able to reject cookies before their personal information was used for targeted advertising.
Court of Appeal decision
SBG appealed the High Court decision and the Court of Appeal has now unanimously allowed the appeal.
The Court of Appeal said that the first instance judge had been legally mistaken about what needs to be proved to establish that a data subject has “given consent”. The court concluded that the test of consent is objective, not subjective. It said that if an individual has capacity and consents to data processing, you don’t then have to work out what they might really be thinking.
To prove consent, a data controller must show, first, that the data subject made a statement or took some other clear affirmative action amounting to an “indication” of their wishes with respect to the processing or direct marketing in question that “signifies agreement” to the relevant activity of the data controller. These are purely objective questions about the quality and significance of some identifiable communication by the data subject to the data controller.
Secondly the data controller must prove to the necessary standard that the data subject’s “indication” met each of four criteria prescribed by the legislation, namely that it was freely given, specific, informed, and unambiguous. Each of these criteria is also objective in nature.
The data controller does not have to prove what was actually in the mind of the individual data subject at the time of the “indication”. It is neither necessary nor relevant for this purpose to explore whether the individual data subject was vulnerable, with an impaired ability to make fully autonomous decisions. The court drew a clear distinction between capacity (which is relevant) and vulnerability (which is not), emphasising legal certainty for data controllers.
The Court considered the legislation, the case law, EU guidance, the purposes of the EU provisions and the recitals to the legislation, and the issue of legal and practical certainty. It concluded that all these point to an objective approach to consent. The regulatory regime governing online gambling has no bearing on that issue.
The Court of Appeal also said that the data controller’s actual or imputed knowledge that its customer is a problem gambler is not a relevant factor when considering whether consent was given.
The judgment also confirmed that:
- the first instance judge’s approach to the issue of consent was procedurally unfair,
- the judge should have found that RTM gave factual consent to receiving direct marketing communications;
- the judge was not entitled to find that SBG had used cookies to send RTM personalised direct marketing; and
- the judge was wrong to conclude that SBG’s profiling of RTM for direct marketing purposes was necessarily unlawful.
Conclusion
The decision provides welcome clarification that, for the purposes of data protection law, consent is assessed by reference to an objective standard based on what the data subject did or communicated, rather than their subjective state of mind or personal vulnerability. In doing so, the Court of Appeal has drawn a clear distinction between capacity (which remains relevant) and vulnerability (which does not), and has emphasised the importance of legal certainty for data controllers when relying on consent.
At the same time, the judgment should not be read as diminishing the broader regulatory and ethical obligations that may apply in particular sectors, including online gambling. While a data controller’s knowledge that a customer may be vulnerable does not, of itself, invalidate consent for data protection purposes, issues of harm prevention, consumer protection and responsible marketing remain governed by separate regulatory regimes. For organisations engaged in targeted advertising and profiling, the decision shows the importance of ensuring that consent mechanisms are properly structured, clearly presented and well evidenced, and of considering data protection compliance alongside wider regulatory duties.
