The UK Court of Appeal this month handed down a judgment in RTM v Bonne Terre Ltd that overturns a High Court decision on the standard of consent required for direct marketing and profiling under the UK GDPR, clarifying how data controllers in the gambling sector - and beyond - must assess whether a data subject has validly agreed to receive marketing communications.

The case centers on an individual identified as RTM who brought a data protection claim against Sky Betting and Gaming (SBG), a brand operated by Bonne Terre Ltd. RTM argued that SBG processed his personal data for marketing purposes without valid consent, in circumstances that also involved his gambling addiction. The High Court had initially found in RTM's favour, applying what the Court of Appeal characterised as a "three-part subjective test" of consent. The appellate judges allowed SBG's appeal on all five grounds and remitted the case to the High Court for further proceedings.

At the heart of the appeal was a fundamental question: what does "consent" mean under the UK GDPR, and how should a court assess whether it was given?

The original High Court judgment devised its own analytical framework, one that the Court of Appeal found had no basis in the parties' arguments. According to the judgment approved by the court for handing down, "the decisive analysis involved the application of the three-part subjective test. That was no part of RTM's case." The judge had assessed whether RTM had given subjective consent of what she described as "relatively high quality," placing the burden on SBG to demonstrate its presence. The Court of Appeal rejected this approach.

Instead, the appellate court established that consent under the UK GDPR must be assessed objectively. The standard is whether the data subject's conduct, viewed through an objective lens, signified agreement that was "informed, specific, unambiguous and freely given." RTM's own mental state, including any impairment linked to gambling disorder, does not form part of the legal test. The judgment is direct on this point: "RTM's gambling addiction, and what if anything SBG knew or should have known about it, are not relevant for that purpose."

What happened on 26 July 2017

A critical factual dispute in the case concerned events on 26 July 2017, when RTM registered with or updated his account on SBG's platform. SBG contended that on that date, RTM gave consent to receive direct marketing communications, most likely by ticking an opt-in box. The High Court judge could not definitively identify how he gave that indication, but the Court of Appeal held that uncertainty alone did not defeat SBG's position.

According to the judgment, the judge "found as a fact that RTM gave SBG an indication of his wishes that signified his agreement to direct marketing." She could not state precisely how he gave it, but "certainty was not required." The court concluded that "on the evidence the obvious, or at least the most likely, way in which RTM indicated his wishes was by ticking a box to opt in." No other mechanism was identified in the evidence or arguments. The High Court should, the Court of Appeal held, have found that this is what RTM did.

The imbalance of power argument rejected

SBG and the Information Commissioner's Office (ICO) had each argued that the objective test for consent could be qualified by reference to the data controller's knowledge of a data subject's vulnerability - for instance, awareness of a gambling disorder. The idea was that such knowledge could create the "clear imbalance of power" referred to in Recital 43 of the GDPR, making it "unlikely" that consent could be freely given without further enquiries.

The Court of Appeal declined to adopt this approach. The judgment sets out seven reasons for its rejection, all of which carry practical weight for the marketing industry.

First, the analysis incorrectly applies an individualised reading of the "clear imbalance of power" concept. Second, it places excessive weight on whether an imbalance is visible to the data controller in the context of a specific relationship. Third, and perhaps most practically significant, it would require introducing "not just one but two subjective tests." A court would need to determine whether the data subject had a condition impairing consent, and whether the data controller knew that to be so. According to the court, "this is a complex set of questions."

Fourth, the burden of proof consequences would force data controllers to establish negatives. Fifth, such an approach carries "most if not all of the problems of legal and practical uncertainty" already noted by the court. Sixth, the legislative context - including the specific GDPR provisions on children's consent under Article 8 - implies that special verification requirements apply only where explicitly mandated. Seventh, the court was "not convinced that the suggested departure from the objective approach is necessary or warranted."

That said, the judgment does not leave vulnerable data subjects without recourse. The court acknowledged that where a data subject makes their affliction known to a controller, any indication of wishes might not count as "unambiguous." It also raised the possibility that processing could be found "unfair" if undertaken when the controller knew the data subject's will was compromised, and noted the potential relevance of Gambling Commission codes of conduct for protecting vulnerable persons.

Cookies, profiling and causation

Beyond the consent question, SBG successfully challenged the High Court's findings on cookies and profiling. The High Court had found that SBG used cookies to enable personalised direct marketing communications sent to RTM. The evidence at trial, however, was different. According to the appellate judgment, SBG "used information from cookies to provide users with personalised forms of social media and digital display marketing on third-party websites and social media platforms, but that these were not methods of 'direct marketing'."

RTM's actual complaints concerned "direct marketing communications by email and telephone" and "targeted special offers through direct marketing and on the [SBG] websites." No evidence was presented that cookie-derived data was used for those specific purposes. SBG's user profiles were built primarily from transactional data, not cookie data.

The High Court's finding that SBG's profiling for direct marketing was unlawful was, in the Court of Appeal's words, "parasitic on other conclusions" that were themselves found to be erroneous. The appellate court also agreed that the High Court had misstated a concession made by SBG at trial. What SBG's counsel had accepted was a narrow proposition: that a gambling company cannot rely on "legitimate interests" as a lawful basis for marketing to a known problem gambler. The High Court had not made any finding that SBG had grounds to know RTM was a problem gambler. That finding, therefore, could not underpin the unlawfulness conclusion.

Procedural fairness: the judge who went her own way

Ground 1 of SBG's appeal raised a distinct and procedurally significant issue. The three-part subjective consent test, which became the decisive basis for the original judgment, was entirely the High Court judge's own creation. According to the appellate judgment, "this approach to the issues was only alluded to in part, and then only briefly and belatedly, in the course of the trial."

The Court of Appeal found that SBG had not been given adequate opportunity to address that reasoning. The judge had asked during closing submissions whether the consent of a compulsive gambler to gambling marketing could be freely given, but the answer given by counsel - that in the absence of a positive reason to think otherwise, the data subject's ability to give consent was not in doubt - did not produce any further exchange on what became the court's decisive analytical framework.

The principle engaged is fundamental to adversarial litigation: "an issue ought not to be decided against a party unless they have had a fair opportunity to address the court's reasons for reaching that decision." While the Court of Appeal made clear this ground was in some ways academic once the consent analysis was resolved, it remains significant as a statement about procedural fairness in complex data protection proceedings.

Remittal and what comes next

The Court of Appeal allowed the appeal on all five grounds, set aside the High Court's judgment on liability, and ordered the case remitted to the High Court. The scope of that remittal - and which precise issues must be re-litigated - remained subject to further argument at the time the judgment was handed down.

The appellate court noted that, having heard "two full days of argument" and reviewed "very full documentation," it had, in principle, identified the legal test for consent. It indicated it may be possible to decide certain subsidiary issues using the High Court judge's factual findings and undisputed facts, specifically: whether, on an objective assessment, the indication of wishes RTM gave on 26 July 2017 was "informed, specific, unambiguous and freely given"; and whether SBG's post-GDPR refresh practices would in general produce legally effective consent indications.

However, even if SBG ultimately prevails on those issues, RTM still has outstanding claims that SBG's processing was "unfair" and infringed other data protection principles. The litigation is not concluded.

Why this matters for the marketing community

For the programmatic advertising and direct marketing sectors, this ruling lands as a significant clarification in a territory that has generated sustained regulatory and legal uncertainty. The UK GDPR's consent requirements sit at the foundation of most email marketing, personalisation, and audience segmentation operations. A subjective consent standard - one tethered to the data subject's mental state - would have made compliance practically unworkable at scale.

The ruling restores what many data controllers had assumed to be the operative standard: that consent is assessed by reference to observable conduct and objectively verifiable indications of agreement, not by inquiry into what was passing through a data subject's mind at the time.

That clarity matters particularly in the context of real-time bidding and profiling technologies, which process consent signals at industrial speed across millions of bid requests. The ICO has long maintained concerns about how consent operates in the RTB ecosystem, noting in its adtech investigations that existing frameworks are "insufficient to ensure transparency and fair processing" and fail to provide "free and informed consent." An appellate standard that required controllers to look behind the consent signal - to assess the subjective state of each data subject - would have compounded those difficulties enormously.

The rejection of the vulnerability-based qualification to the objective test is also consequential. Had the court accepted the ICO's argument, data controllers in the gambling sector would have faced a duty to assess whether individual consumers had conditions impairing their ability to consent - and to prove the absence of such conditions. The judgment notes, drily, that this "would seem to carry with it most if not all of the problems of legal and practical uncertainty" that make subjective consent unworkable in the first place.

More broadly, the ruling illustrates how courts are being asked to mediate between the GDPR's aspirational consent framework and the commercial realities of large-scale digital marketing. The EDPB's position that most "consent or pay" models fail GDPR standards and the ICO's own guidance on consent or pay for UK publishers both reflect regulators' efforts to sharpen the definition of "freely given" consent - efforts that the Court of Appeal's objective test now constrains, at least in the UK context.

The case also connects to a larger pattern of courts across Europe examining consent validity in specific sectoral contexts. German courts have been active in this space, including a Federal Court of Justice ruling in January 2025 clarifying when GDPR compensation claims arise from unsolicited marketing emails. Austrian courts delivered a ruling in September 2024 that Google reCAPTCHA requires explicit consent before activation. The Hannover administrative court in Germany found in March 2025 that Google Tag Manager itself requires user consent before loading.

What distinguishes the RTM ruling is its direct address of the standard of proof and the state of mind question - not just whether consent was obtained technically, but how courts should evaluate whether it was genuine. That analytical framework, now settled at Court of Appeal level in England and Wales, will inform how the industry interprets consent going forward.

Timeline

Summary

Who: The UK Court of Appeal, hearing an appeal by Sky Betting and Gaming (Bonne Terre Ltd) against a High Court judgment in favour of a claimant identified as RTM. The Information Commissioner's Office participated as an interested party.

What: The Court of Appeal allowed the appeal on all five grounds, overturning findings on consent, procedural fairness, factual consent on 26 July 2017, cookie use in personalised marketing, and profiling for direct marketing purposes. The court established that consent under the UK GDPR must be assessed objectively, not by reference to the data subject's subjective mental state or the data controller's knowledge of individual vulnerability.

When: The judgment was handed down on 24 April 2026. The underlying events that triggered the claim took place from 26 July 2017 onwards.

Where: The proceedings were heard in England and Wales. The case was remitted to the High Court for further proceedings following the appellate ruling.

Why: The High Court had applied a legally incorrect subjective three-part consent test of its own devising, denied SBG a fair opportunity to address that framework, and reached factual conclusions on cookies and profiling that the Court of Appeal found unsupported by the evidence. The appellate judgment resets the legal standard, affirming that observable conduct - not internal mental state - is the measure of valid GDPR consent for direct marketing purposes.

Share this article
The link has been copied!