RTM v Bonne Terre Limited & Anor

Consent under the General Data Protection Regulation and Privacy and Electronic Communications (EC Directive) Regulations 2003 is assessed objectively. The controller must prove a clear affirmative indication signifying agreement, which is freely given, specific, informed and unambiguous. The inquiry concerns the communication, the information supplied and the structural relationship between the parties. It does not require proof of the individual’s actual state of mind, vulnerability or impaired autonomy. The controller’s actual or constructive knowledge of an individual condition is not itself a consent criterion. Context may affect the objective assessment, but consent cannot be reshaped to fill regulatory gaps.

RTM sued Bonne Terre Limited and Hestview Limited, trading as Sky Betting and Gaming, alleging that cookies, personal-data processing, profiling and targeted direct marketing contributed to gambling losses and distress. The High Court held that RTM lacked legally effective consent because his gambling problem impaired subjective consent and autonomous choice, and entered judgment on liability in his favour: [2025] EWHC 111 (KB).

The defendants appealed on five grounds, including the correct meaning of consent, procedural fairness, the evidence of consent to direct marketing, the use of cookies and the legality of profiling. The central issue was whether consent had a subjective aspect.

The Court of Appeal, in the leading judgment of Warby LJ with which Lewison LJ and Sharp P agreed, allowed the appeal on all five grounds. It set aside the High Court’s liability judgment and held that the case had to be remitted, with the scope of the remission to be addressed after further submissions.

1. Consent. Under the General Data Protection Regulation, the Data Protection Act 1998 and Privacy and Electronic Communications (EC Directive) Regulations 2003, consent is an objectively ascertainable communication. The controller must prove a statement or clear affirmative action indicating the data subject’s wishes and signifying agreement. The four criteria—freely given, specific, informed and unambiguous—are distinct but are assessed in context, including the communications and the structural relationship between the parties.
2. The legislation does not require proof of the data subject’s actual state of mind, subjective consent, vulnerability or impaired autonomy. A controller’s actual or constructive knowledge of an individual condition is not a criterion for consent. The business and regulatory context may inform the objective assessment, but consent cannot be used to fill perceived regulatory gaps. Article 7(4) and recital 43 did not apply on the facts because gambling services were not conditional on consent to marketing.
3. The High Court also breached procedural fairness. The decisive three-part subjective test had not been advanced by RTM or SBG, and SBG had no adequate opportunity to address it.
4. The judge’s findings established, on the balance of probabilities, that RTM had indicated agreement to direct marketing on 26 July 2017; certainty was unnecessary. However, the findings did not establish the remaining statutory criteria under the correct objective test. There was also no evidence that cookie-derived information was used for the complained-of email or telephone marketing, and the profiling conclusion rested on erroneous assumptions and a misstated concession.

The court reserved whether some issues could be determined itself. Claims concerning fairness and other data-protection principles remained unresolved.

1. Court of Appeal (Civil Division): Appeal allowed on all five grounds. The High Court’s liability judgment was set aside and the case was remitted for further directions: [2026] EWCA Civ 488.
2. High Court of Justice, King’s Bench Division, Media and Communications List: Collins Rice J held that RTM lacked legally effective consent and entered judgment on liability in his favour: [2025] EWHC 111 (KB).