Court of Appeal overturns landmark data protection ruling against Sky Betting and Gaming and rules the test for consent is objective

Overview

On 21 April 2026, the Court of Appeal handed down its judgment in RTM v Bonne Terre Limited and Hestview Limited [2026] EWCA Civ 488, overturning a controversial High Court ruling that a problem gambler’s consent to the placement of cookies, processing of personal data, and receipt of marketing was ineffective due to his gambling addiction. The Court of Appeal held that consent under data protection and ePrivacy legislation is assessed objectively, by reference to the data subject's actions and communications with the data controller, and does not require an assessment of the data subject's subjective state of mind or autonomy. 

Background

RTM is a self-described problem gambler who used online betting and gambling services operated by Sky Betting and Gaming (“SBG”), which trades under that name and is operated by the appellants, Bonne Terre Limited and Hestview Limited. He used SBG’s online platforms between early 2017 and the end of 2018, a period during which he described his gambling as compulsive and out of control. SBG placed cookies on his devices, and processed his personal data through profiling and segmentation techniques. SBG also sent RTM personalised direct marketing by email. It was in issue whether cookies or cookie-derived data were used in connection with the direct marketing.

RTM claimed compensation for financial loss and distress, contending that he was a gambling addict, that SBG had acted unlawfully in its data processing and marketing activities, and that this caused him to gamble and lose more than he otherwise would have done (alleging breaches of the Data Protection Act 1998 (“DPA”), the General Data Protection Regulation (“UK GDPR”) and the Privacy and Electronic Communications Regulations 2003 (“PECR”)). SBG's position was that RTM had consented to the data processing complained of.

The High Court decision

At first instance, Collins Rice J determined that the central question was whether RTM had given legally operative consent to the activities. The judge devised a test for consent, comprising three “distinct strands”:

1. Good quality subjective consent, depending on the individual's actual state of mind; or
2. Autonomous choice: absent good quality subjective consent, a fully autonomous choice by the individual about the grant of consent, such that any deficiency in subjective consent was itself the product of autonomous decision-making;
   
   together with, in either case:
    
3. Minimum evidential standards for proof of consent.

The judge accepted RTM's evidence about the impact of his gambling problem. She found him to be "a highly vulnerable individual in relation to his gambling behaviour" and held that SBG’s consent mechanisms, including a cookie banner that lacked clear separation between consent and engagement with services, were insufficient in RTM’s particular case.

Applying her three-part test, the judge found that, whilst RTM had taken deliberate actions indicating consent, such as ticking boxes and clicking buttons, he "lacked subjective consent", that "the autonomous quality of his consenting behaviour was impaired to a real degree", and that his consent was "insufficiently freely given". Judgment was given in favour of the player, RTM.

The Court of Appeal decision

SBG appealed on five grounds. The ICO intervened, agreeing with SBG that the test for consent is an objective one. The Court of Appeal (Warby LJ, with whom Lewison LJ and Dame Victoria Sharp P agreed) allowed the appeal on all five grounds.

Ground 2 (the correct approach to consent): Warby LJ addressed this ground first, as it raised the central question of law. The Court of Appeal held that the judge’s legal analysis of consent was wrong and the test for consent is purely objective. 

Consent under the UK GDPR, the DPA and PECR is defined as "any freely given, specific, informed and unambiguous indication of the data subject's wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data". 

The Court of Appeal held that this definition identifies consent as something constituted by an action, not a subjective state of mind. To prove consent, a data controller must show that the data subject made a statement or took a clear affirmative action amounting to an "indication" of their wishes that "signifies agreement" to the relevant activity; these are purely objective questions about the quality and significance of some identifiable communication. The data controller “does not have to prove what was actually in the mind of the individual data subject”. It is “neither necessary nor relevant” to explore whether the data subject was vulnerable or had impaired decision-making ability.

The Court of Appeal also found that the judge's analysis would create legal uncertainty extending well beyond gambling, as similar reasoning could apply to any sector in which compulsions or addictions are a known feature.

That said, Warby LJ acknowledged that vulnerability may be relevant in other contexts: if a data subject makes known to the data controller that they suffer from an affliction casting real doubt on their ability to make free choices, any indication of their wishes "might not count as 'unambiguous’”; or it might be argued that processing would not be "fair" if undertaken when the data controller knew or should have known of a factor overbearing the data subject's will.

On the remaining grounds:

• Ground 1 (procedural fairness): The Court held that the three-part subjective test of consent was "entirely of the judge's own devising" and was "no part of RTM's case". SBG was not given sufficient opportunity to address the judge's decisive reasoning and the judge’s decision was therefore procedurally unfair. 
• Ground 3 (consent to direct marketing): The Court concluded from the judge's own factual findings that RTM did give "factual consent" to direct marketing on 26 July 2017, most likely by ticking a box to opt in.
• Ground 4 (cookies): The Court accepted that SBG did not use cookies or cookie-derived data to create or deliver the personalised direct marketing of which RTM complained. Rather, SBG used cookie-derived information for social media and digital display marketing on third-party platforms, which were not the subject of RTM's complaints.
• Ground 5 (profiling): The Court held that the judge's finding that profiling was unlawful was "parasitic" on the erroneous conclusions on consent and cookie placement.

However, the Court was "not persuaded" by SBG and the ICO’s alternative argument that the data controller’s actual or constructive knowledge of a data subject's gambling disorder should be relevant to whether consent is established. Warby LJ considered it was "not consistent with the language of the legislation or coherent" to treat the data controller's state of mind as a criterion for consent, and it would significantly undermine the objective approach. The Court observed, however, that concerns about protecting vulnerable data subjects could potentially be accommodated in other ways, for example through the "unambiguous" criterion of consent or the separate requirement that processing be "fair".

The Court of Appeal allowed the appeal on all five grounds, setting aside the High Court’s judgment on liability in RTM’s favour. The case must be remitted to the High Court, although the precise scope of that remission remains to be determined. 

In its judgment, the Court identified two issues arising from its conclusions on the appeal that it considered it might be able to resolve itself, rather than remitting them, on the basis of the judge’s existing findings and the undisputed facts. The first was whether, applying the objective test for consent, RTM's opt-in to direct marketing on 26 July 2017 was "informed, specific, unambiguous and freely given". The second was whether the High Court judge’s detailed findings on SBG’s revamped consent mechanisms following the GDPR refresh in March 2018 can be used to conclude that the mechanisms were objectively sufficient to obtain valid consent from data subjects who completed them. However, following submissions from the parties on the draft judgment, the Court reserved its position on both the substance of these issues and the question of which court should decide them, pending further argument.

Separately, RTM's claims that SBG's processing was unfair and infringed other data protection principles also remain to be resolved by the High Court or Court of Appeal.

Comment

The decision is significant for any business that relies on consent as a lawful basis for data processing or direct marketing. The key practical points are:

1. Consent is objective: This decision provides greater legal certainty around what constitutes valid consent under the UK data protection and ePrivacy laws. 
2. Robust consent mechanisms remain essential: Consent must be active, separate from the activity to which it is a threshold, and supported by clear and comprehensive information.
3. Vulnerability may still be relevant: A data subject's vulnerability may still be relevant to other aspects of data protection compliance, including whether consent is unambiguous and processing is fair. 

The remission to the High Court means this litigation is far from over. RTM's remaining claims on fairness and other data protection principles will be determined at retrial. In the meantime, the Gambling Commission's Licence Conditions and Codes of Practice continue to require gambling operators to identify and protect vulnerable customers.