RTM v Bonne Terre Ltd and another: The Court of Appeal sets the standard for consent to direct marketing

The Court of Appeal’s decision in RTM v Bonne Terre Limited [2026] EWCA Civ 488[1], handed down on 21 April 2026, is the first appellate authority on the meaning of ‘consent’ in UK data protection law. The Court of Appeal decision sets the standard for consent to direct marketing. The appeal by Sky Betting and Gaming related to a claim by a self-described gambling addict who alleged that he was sent direct marketing emails without his consent and that they had fueled his addiction and thereby caused him financial loss and distress. The judgment resolves a question of far-reaching significance: whether consent, as defined in the UK GDPR and related legislation, encompasses any subjective element (such as the data subject’s actual state of mind and associated vulnerabilities), or whether it is determined objectively by reference to the data subject’s outward actions and the context in which they were taken. For online gambling operators, it clarified whether or not they could ever have any commercial or regulatory certainty in the consent mechanisms they rely upon when seeking consent for direct marketing. In overturning the High Court’s novel three-part subjective test, the Court of Appeal’s decision is welcomed by gambling operators, and data controllers across all sectors, while providing helpful warnings related to the fairness of processing the personal data of vulnerable individuals, including potentially problem gamblers.

Background to the dispute

RTM is a self-described ‘recovering online gambling addict’ who used the services of Sky Betting and Gaming (‘SBG’), operated by Bonne Terre Limited and Hestview Limited. During a two-year period running from early 2017 to the end of 2018, SBG placed cookies on RTM’s devices, processed his personal data, and sent him targeted direct marketing communications. RTM later sued SBG, contending that he had been a gambling addict during that period; that SBG’s activities in placing cookies, processing his data and sending direct marketing were all unlawful because he had not given his consent; and that these activities caused him to gamble more and lose more than he otherwise would have, resulting in financial loss and distress.

At a five-day liability trial in November 2024, Mrs Justice Collins Rice in the King’s Bench Division determined that the central question was whether RTM’s consent was valid (meaning whether it was legally operative consent) to the activities about which he complained. She held that it was not, and that all of SBG’s activities were therefore unlawful. Judgment was entered for RTM on 23 January 2025, with the question of remedies adjourned.

The trial judge’s approach to consent

The trial judge approached the legal standard for consent by devising what she described as a three-part test drawn from the legislation and European authorities. She identified three ‘distinct strands’: first, ‘good quality subjective consent’, depending on the individual’s actual state of mind; second, absent that, a fully autonomous choice by the individual about the grant of consent; and third, some minimum evidential standards for proof of consent.

Applying this framework to the facts, the judge accepted that RTM had taken deliberate actions indicating consent, but held that none of the three criteria was met, meaning that consent could not be legally operative. She accepted RTM’s evidence about the impact of his gambling problem and found that he ‘lacked subjective consent’, that ‘the autonomous quality of his consenting behavior was impaired to a real degree’, and that ‘the quality of this Claimant’s consenting was rather lower than the standard required’ because of ‘his gambling problem and his associated vulnerability and compromised autonomy’.

Significantly, the judge acknowledged that RTM possessed legal capacity to consent and even accepted that, at some level, he ‘wanted the direct marketing material — even perhaps craved it’. Nevertheless, she concluded that his consent was ‘insufficiently freely given’ because his ‘consenting behaviours proceeded directly from a damaged and defective condition of personal autonomy’.

The grounds of appeal

SBG appealed the High Court’s decision on five grounds. The first two, which were the most substantial, were that the judge erred in deciding the case on the basis of arguments that RTM himself had never advanced (procedural unfairness) and that her legal analysis of what constitutes consent was wrong in law. The remaining grounds challenged the judge’s findings on ‘factual consent’ on 26 July 2017, her characterization of SBG’s use of cookies and the conclusion that SBG’s profiling was necessarily unlawful. The Information Commissioner intervened to assist the court and, notably, agreed with SBG that the test for consent is essentially objective.

The Court of Appeal’s reasoning

Consent is an objective concept

In a judgment given by Lord Justice Warby, with whom Lord Justice Lewison and Dame Victoria Sharp agreed, the Court of Appeal allowed the appeal on all five grounds.

The court’s central holding is clear and authoritative. Consent, as defined in Article 4(11) of the UK GDPR[2] — a ‘freely given, specific, informed and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement’ — is an entirely objective concept. In relying unambiguously on the language of the GDPR and the clearly stated language of the CJEU and the Court of Appeal itself, Lord Justice Warby has brought the test by which legally valid consent is measured back to the evaluation relied upon by law makers and regulators to date.

The court identified two key observations about the legislative language. First, consent is constituted by an action — an ‘indication’ of the data subject’s wishes — not by a subjective state of mind. Second, all four qualifying criteria (freely given, specific, informed and unambiguous) are also objective in nature and are to be assessed by reference to the data subject’s outward ‘indication’ and its context, including the communications between the parties and the structural character of their relationship. To ensure consent is specific, for example, consent must be ‘clearly distinguishable from other matters’, so customers must be aware that they are consenting to marketing specifically, not just agreeing to general terms and conditions. To ensure consent is informed, the customer must be provided with clear, comprehensive and easily accessible information about what data will be processed, how it will be used for profiling and what marketing the customer will receive – noting that ‘especially simple and clear language’ may be required in the gambling context. Importantly, operators must be able to evidence the consent mechanism relied upon and the information provided, so reliable record keeping would be required to uphold such a defense.

The court drew support from the CJEU’s decisions in Planet 49, Orange Romania and Meta Platforms, all of which it read as indicating an objective test. Domestically, the court noted the Court of Appeal’s earlier observation in Cooper v National Crime Agency [2019] EWCA Civ 16[3] that the notion of consent is ‘an objective one, which depends on the outward manifestation of consent by the data subject’. Authoritative guidance from the Article 29 Working Party[4], the EDPB and the ICO was held to be ‘firmly in favour of an objective approach’.

The subjective approach is unworkable

The court articulated a series of powerful practical objections to the trial judge’s subjective analysis. A data controller such as SBG could never guarantee conformity with consent requirements if the test depended on the data subject’s internal mental state, because there would always be the possibility of an unknown vulnerability impairing the user’s ability to give ‘subjective consent’ or compromising their ‘genuine autonomy’. This ‘irreducible risk’, which the trial judge held ‘the law places…on the data controller’, was deemed to be the Court of Appeal to be impractical and not what privacy law demands. While the trial judge found such risk a cost of doing business and a matter for operators to measure how much effort and cost they chose to put in to drive that risk down, the Court of Appeal felt the balance struck by the High Court between ‘the right to do business’ and ‘the right to protection of personal data’ was ‘impractical’ and not what Parliament intended. Furthermore, the Court of Appeal determined that such consequences would not be confined to the gambling industry but would extend to other sectors in which compulsions and addictions are a known feature, such as the sale of alcohol, and indeed to any situation where vulnerability or external circumstances (such as duress) might disable an individual from making a free choice.

The court also found the trial judge’s test to be ‘novel’ and its ‘precise nature elusive’, observing that the principle that decisions deliberately made by a capacitous individual may nonetheless be vitiated for lack of consent was without precedent. As Lord Justice Warby noted, the judge had accepted that RTM possessed legal capacity and desired the marketing, yet still found his consent to be legally ineffective — a conclusion that ‘cut across established rules’ and lacked ‘appropriate precision’.

The data controller’s knowledge is irrelevant to consent

An important subsidiary issue was whether the data controller’s actual or constructive knowledge of the data subject’s vulnerability could bear on whether consent was established. Lord Justice Warby held that it was not ‘consistent with the language of the legislation or coherent to treat the data controller’s state of mind, actual or constructive, as a criterion for whether the data subject has given consent’. Such a qualification would significantly undermine the objective approach, introduce multiple subjective tests and carry most of the same problems of legal and practical uncertainty.

Procedural unfairness

On the first ground of appeal, the court held that the judge’s decision was also procedurally unfair. RTM had argued that he did not give his consent; not, as the trial judge had found, that the consent given was impaired and therefore invalid. This meant that SBG had not had an adequate opportunity to address this argument, nor the three-part subjective analysis before it was deployed to decide the case against them.

‘Factual consent’ and the remaining grounds

On grounds 3 to 5, the court held that the trial judge had erred in her assessment of ‘factual consent’ being given on 26 July 2017, finding that on a proper application of the law it followed from the judge’s own factual findings that RTM did give an indication of his wishes signifying agreement to direct marketing, most likely by ticking a box to opt in. The Court of Appeal also agreed that the finding on cookies mis-stated a concession given by SBG in oral submissions and that the conclusion on profiling was parasitic on other erroneous conclusions.

Disposal

The Court of Appeal allowed the appeal on all five grounds and set aside the trial judge’s order. The court itself determined that RTM had given legally valid consent to direct marketing, applying the correct objective test to the trial judge’s own findings of fact. All remaining matters in the claim — including RTM’s arguments that SBG’s processing infringed other data protection principles — were remitted to the High Court for trial before a different judge. Costs of the appeal were awarded to SBG.

Significance for the gambling sector

The decision has been received with considerable relief by gambling operators. In the context of Gibson v TSE Malta LP (t/a Betfair) [2025] EWCA Civ 1589[5] and Calvert v William Hill Credit Ltd [2008] EWCA Civ 1427[6], in which the court has repeatedly refused to impose a general duty of care on gambling operators, this decision closes off a ‘data protection side-wind’ to achieve what tort law otherwise will not.

The trial judgment furthermore had generated alarm across the industry, not least because it was characterized at the time as ‘groundbreaking’ and was reported as front-page news. On the trial judge’s analysis, any gambling service provider faced an ‘ineradicable risk’ that its marketing consents could be retrospectively invalidated by a customer who turned out to be a problem gambler, irrespective of whether the operator knew or could have known of the vulnerability. That risk has now been eliminated — at least so far as the consent question is concerned.

Operators can now comfort themselves that, with an objective test for consent upheld, they can rely on their use of clearly designed consent mechanisms as evidence of consent: tick-boxes; scrolling through terms; and opt-in processes. They do not need to query a customer’s state of mind to accept such indications at face value.

This is not a blank cheque, however. The Court of Appeal emphasized that consent mechanisms must still satisfy the objective requirements, in that the consent must be freely given, specific, informed and unambiguous. This essentially gives operators a roadmap for what legally operative consent would look like and means that pre-ticked boxes and passive opt-out mechanisms would not satisfy the test. The Court of Appeal also cautioned that context matters, and in the regulatory environment in which SBG operates, the kind of customers it deals with, and the associated inherent risks, ‘the use of especially simple and clear language’ in obtaining consent could be called for.

Practitioners advising gambling operators should not view this as a green light to ignore customers’ vulnerabilities altogether. The Court of Appeal was careful to observe that if the data subject makes it known to the data controller that they suffer from some affliction casting ‘real doubt on his ability to make free choices’, it ‘might be argued that the processing of personal data would not be “fair” if undertaken at a time when the data controller knew or should have known that the data subject was suffering from some disability or external factor that overbore their will or compromised their ability to choose’. In this respect, operators are advised to invest in robust safer gambling systems, not just for compliance purposes, but because the absence of such systems could have a negative bearing when considering the fairness of the processing of customers’ data. Compliance with the more recently introduced LCCP SR 5.1.12[7], which requires consent to be provided on a per channel and per product basis, will also support a defense against any data protection claims based on fairness.

The Gibson and Calvert line of authority and this case together confirm there is no general duty of care. However, between the regulatory regime (SR 5.1.12 and the wider LCCP) and the data protection fairness principle, operators who ignore vulnerability signals do so at significant legal and reputational risk.

Broader implications for commercial data controllers

The implications of the ruling extend well beyond gambling. Lord Justice Warby acknowledged that the consequences of a subjective approach ‘would not be confined to the gambling industry’ but would reach other commercial entities, including those in sectors where compulsions and addictions are a known feature. Any business that relies on consent as its lawful basis for processing — whether for direct marketing, cookies or other purposes — now has clarity that the test is an objective one focused on the quality of the consenting mechanisms it designs and operates.

From a data protection compliance perspective, the decision reinforces that the proper focus for controllers is on the design of robust, well-informed consent processes. A data controller that can show that it presented clear information, offered genuine choice and obtained an affirmative indication of consent should be able to demonstrate compliance. The judgment also endorses, albeit in passing, the analysis in Cooper that consent depends on ‘the outward manifestation of consent by the data subject’, providing further domestic authority on a point that had not previously been settled by the Court of Appeal in terms.

For practitioners advising on data protection litigation more broadly, the decision offers a salutary reminder that innovative legal theories deployed by first-instance judges must still be grounded in the legislative language and established jurisprudence. The Court of Appeal’s willingness to characterize the trial judge’s approach as ‘novel’ and ‘elusive’, and to reject it on both substantive and procedural grounds, underscores the importance of appellate vigilance.

What remains to be decided?

The case is far from over. RTM retains claims that SBG’s processing of his data was unfair and infringed other data protection principles – which is denied by SBG – and these remain to be resolved at the remitted trial. As Lord Justice Warby noted, even if SBG prevails on all the consent issues, RTM ‘still has claims that SBG’s processing of his data was unfair, and infringed other data protection principles, that remain to be resolved’.

The remitted trial will therefore provide an important opportunity to test the limits of the fairness principle in the context of marketing to vulnerable consumers. Practitioners in both the gambling sector and the wider data protection field should watch this space closely.

[1] https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/lawful-basis/consent/what-is-valid-consent/

[2] https://gdpr-info.eu/art-4-gdpr/

[3] https://www.bailii.org/ew/cases/EWCA/Civ/2019/16.html

[4] https://www.edpb.europa.eu/about-edpb/who-we-are/legacy-art-29-working-party_en

[5] https://www.bailii.org/ew/cases/EWCA/Civ/2025/1589.pdf

[6] https://www.bailii.org/ew/cases/EWCA/Civ/2008/1427.html

[7] https://www.gamblingcommission.gov.uk/licensees-and-businesses/lccp/condition/5-1-12-direct-marketing-preferences

[1] https://www.judiciary.uk/wp-content/uploads/2026/04/RTM-v-Bonne-Terre-2026-EWCA-Civ-488.pdf

Adelaide Lopez is a partner at Wiggin LLP in London

More on the impact of GDPR on the marketing of gambling products https://www.imgl.org/publications/imgl-magazine-volume-3-no-1/egba-data-regulation-will-continue-to-keep-gaming-lawyers-busy/