Consent Under GDPR/PECR Is an Objective “Outward Indication”: No Subjective Autonomy Inquiry

Case: RTM v Bonne Terre Ltd & Anor (Sky Betting and Gaming)
Citation: [2026] EWCA Civ 488; [2026] WLR(D) 231
Court: England and Wales Court of Appeal (Civil Division)
Date: 21 April 2026

1. Introduction

This appeal concerned the meaning of “consent” in (i) data protection law governing processing of personal data and (ii) PECR rules governing cookies and unsolicited direct marketing emails. The respondent (“RTM”), anonymised as a former problem gambler, sued the appellants (operators of “Sky Betting and Gaming”, “SBG”) alleging that during the relevant period SBG placed cookies, processed his personal data (including profiling), and sent targeted direct marketing unlawfully because he did not give valid consent. He claimed financial loss and distress, contending that marketing and profiling exacerbated his gambling and losses.

At trial, Collins Rice J held that RTM’s gambling condition impaired the autonomy and “subjective quality” of his consent, so that even though he took deliberate actions consistent with consenting, the required “relatively high” consent standard was not met; therefore SBG’s conduct was unlawful. SBG appealed. The Information Commissioner intervened.

The key legal issue was whether “consent” for GDPR/DPA 1998/PECR purposes has a subjective component requiring examination of the data subject’s actual state of mind and autonomy (including vulnerability such as addiction), or whether it is assessed objectively by the outward manifestation of agreement in its context.

2. Summary of the Judgment

The Court of Appeal (Warby LJ giving the lead judgment, Lewison LJ and Sharp P agreeing) allowed the appeal on all five grounds and set aside the High Court’s liability determination.

  • Core holding: Consent under the relevant regimes is assessed by purely objective questions about whether the data subject made a statement or clear affirmative action that, in context, is a freely given, specific, informed, and unambiguous indication signifying agreement. The controller must prove these on the balance of probabilities (GDPR Art 7(1)).
  • No subjective inquiry: It is not necessary or relevant (for establishing consent) to prove what was actually in the data subject’s mind or whether an individual’s decision-making was impaired by vulnerability (e.g., gambling addiction).
  • Controller knowledge rejected: The Court rejected the suggestion (advanced on appeal by SBG and the ICO) that consent should be undermined where the controller knew/ought to have known of the data subject’s vulnerability; the controller’s state of mind is not a criterion of whether the data subject “has given” consent.
  • Procedural fairness: The trial judge’s determinative “three-strand” subjective/autonomy test was not the case pleaded or argued; SBG lacked a fair opportunity to address it.
  • Further grounds: The Court also found errors regarding whether RTM consented to direct marketing on 26 July 2017, the asserted role of cookies in the complained-of direct marketing, and the “parasitic” conclusion that profiling was necessarily unlawful.
  • Remittal: The matter must be remitted to the High Court; the Court invited submissions on scope and consequential orders.

3. Analysis

3.1 Precedents Cited

EU/CJEU authorities

  • Verbraucherzentralen Bundesverband e.V. v Planet 49 GmbH (Case C-673/17) [2020] 1 CMLR 25 (Planet 49)
    Influence: Central to the Court’s objective approach. The CJEU’s insistence on active consent (no pre-ticked box) supports understanding consent as an externally verifiable act. Warby LJ relied especially on Planet 49’s observation that it may be “impossible in practice to ascertain objectively” whether consent was given by inaction (not unticking), reinforcing the need for a clear affirmative action and an objective framework.
  • Orange Romania SA v ANSPDCP (Case C-61/19) (Orange Romania)
    Influence: Reinforced that the request for consent must be clearly distinguishable and not structured to mislead or unduly burden refusal (e.g., requiring an additional form to refuse). Warby LJ treated this as supporting an objective inquiry into the controller’s communications and procedures rather than the data subject’s subjective comprehension.
  • Meta Platforms Inc v Bundeskartellamt (Case C-252/21) [2023] 5 CMLR 22 (Meta Platforms)
    Influence: Used to show that market dominance does not automatically negate consent but must be considered in assessing whether consent is freely given (Recital 43; Art 7(4)). Warby LJ treated this as consistent with an objective assessment of structural features (imbalance/power), not an individualized inquiry into a particular user’s internal autonomy.
  • SM v Entry Clearance Officer, UK Visa Section (Case C-129/18), [2019] 3 C.M.L.R. 16
    Influence: Cited for the principle that EU law concepts require an autonomous and uniform interpretation, supporting the Court’s rejection of a consent test that varies by case category (e.g., gambling) or individual vulnerability.

Domestic authorities

  • Leave.EU v Information Commissioner [2021] UKUT 26 (AAC) (Leave.EU)
    Influence: Treated as applying CJEU standards and describing a “relatively high bar” without importing subjectivity. The Court used it to show domestic alignment with EU consent principles but not to support any autonomy-based subjective test.
  • Cooper v National Crime Agency [2019] EWCA Civ 16 (Cooper)
    Influence: A key domestic statement: consent under DPA 1998 condition 1 is “an objective one, which depends on the outward manifestation of consent by the data subject.” Although the Court accepted the point may not have been fully contested in Cooper, it endorsed the analysis as correct and consistent with the legislative scheme.
  • Satyam Enterprises Ltd v Burton [2021] EWCA Civ 287 and Al-Medenni v Mars UK Ltd [2005] EWCA Civ 1041
    Influence: Cited on procedural fairness: a party should not lose on a basis it had no fair opportunity to address. They underpinned the Court’s acceptance of Ground 1.

How the precedents shaped the outcome

Collectively, the Court read Planet 49 / Orange Romania / Meta Platforms as focusing on what the data controller did to secure an affirmative, informed, specific and unambiguous signal, and on relationship/structural factors affecting “freely given” consent (misleading terms, conditionality, imbalance). This supported rejecting the High Court’s “three-strand” approach (subjective state of mind; autonomous choice; evidential minimum) as an illegitimate importation of individualized autonomy assessment.

3.2 Legal Reasoning

(a) Statutory interpretation: consent as an act/communication

Warby LJ anchored the analysis in the language of GDPR Art 4(11) and the recurring formulation that the data subject has “given” consent. Consent is defined as an “indication” of wishes that “signifies agreement” by “a statement or a clear affirmative action.” The Court treated this as defining consent in terms of outward signal, not internal mental state. Without such an “indication,” there is no consent regardless of the data subject’s undisclosed wishes; conversely, proving the relevant “indication” does not require proving subjective comprehension or autonomy.

(b) The four criteria are individually assessed and objective

The Court held the controller must prove (on the balance of probabilities) that the indication was: (i) freely given, (ii) specific, (iii) informed, (iv) unambiguous. Each criterion was treated as objective, assessed in context—especially the controller’s information provision and the structure of the relationship—rather than a psychological inquiry into the data subject.

A notable doctrinal correction was the Court’s criticism that the judge effectively blended the criteria into an overarching “quality” assessment, whereas the legislation frames them as distinct requirements.

(c) Rejection of a subjective/autonomy “vitiation” doctrine

The Court considered the High Court’s approach to be legally novel and insufficiently precise: it implied that even a capacitous person’s deliberate actions could be invalidated because they did not “turn their mind” to consent or because decision-making was impaired, absent deception or coercion by the controller. Warby LJ emphasised that such an approach would create an “irreducible minimum risk” of non-compliance even with best-in-class consent mechanisms—an outcome inconsistent with proportionality and the GDPR’s aim of “legal and practical certainty.”

(d) “Freely given” consent: power imbalance as structural, not individualized

While accepting that power imbalance (Recital 43; Art 7(4)) is relevant, the Court rejected the High Court’s individualized application (problem gambler vs operator) as a “clear imbalance” based on RTM’s personal condition. The Court preferred a focus on objectively ascertainable relationship features (e.g., public authority contexts; contractual conditionality; misleading terms; impediments to refusal) as seen in Orange Romania and Meta Platforms.

(e) The controller’s actual/constructive knowledge is not part of “consent”

The Court rejected the appeal-level proposal that a controller’s knowledge of vulnerability should affect whether consent exists. It reasoned this would introduce multiple subjective inquiries (data subject impairment; controller knowledge; constructive knowledge), undermine the objective approach, and be impractical given the controller’s burden of proof. The Court also pointed to GDPR Art 8 (children’s consent verification) as indicating that special verification duties are expressly legislated where intended.

(f) Procedural fairness: deciding on an unargued basis

Because RTM had not pleaded or argued that his addiction rendered consent legally ineffective, and because the judge’s decisive three-part analysis was her own construct raised only fleetingly at the end of submissions, SBG did not have a fair opportunity to address it. This independently required the consent ruling to be set aside.

(g) Application to the appeal grounds beyond the core legal test

  • Ground 3 (direct marketing consent on 26 July 2017): On the judge’s factual findings, it followed that RTM did give an indication signifying agreement; the judge erred by treating the absence of proof of the precise mechanism as fatal.
  • Ground 4 (cookies enabling personalised direct marketing): The Court accepted SBG’s evidence that cookies were used for third-party digital advertising, not the complained-of email/telephone/on-site direct marketing; the High Court’s finding was not supported.
  • Ground 5 (profiling necessarily unlawful): The “parasitic” unlawfulness finding depended on the erroneous consent analysis and misunderstanding of concessions about legitimate interests; the judge made no finding SBG had grounds to know RTM was a problem gambler.

3.3 Impact

(a) A clear appellate statement: consent disputes are not vulnerability trials

The leading significance is the Court’s insistence that establishing consent does not require litigating an individual’s internal autonomy, addiction, or subjective engagement at the moment of clicking/ticking. This constrains attempts to invalidate consent by showing a claimant’s impaired decision-making, absent objective defects in the consent request/process itself.

(b) Compliance engineering and litigation risk

The judgment strengthens the practical proposition that controllers can “engineer” consent mechanisms to meet the standard and then prove them objectively. It reduces the “irreducible minimum risk” identified below and likely curtails claimant strategies based on individualized incapacity short of legal incapacity.

(c) “Freely given” consent will focus on process design and structural conditions

Future cases are likely to focus more sharply on: separation of consent from other matters; absence of misleading conditionality; ease of refusal/withdrawal; clarity and comprehensibility of information; and whether the relationship involves structural power imbalance (public authority/employment-type dynamics or “consent or pay” architectures), rather than claimant-specific vulnerabilities.

(d) Alternative routes remain: fairness, transparency, special category data, legitimate interests

The Court expressly left open that vulnerability-related concerns may be more coherently addressed under other headings (e.g., whether processing was “fair,” whether a code of conduct was breached, whether legitimate interests could be relied upon, or whether data constituted special category data). Practically, this may redirect claims away from “no consent because I was vulnerable” toward “processing was unfair/non-transparent/disproportionate given what you knew or should have known.”

(e) Sectoral regulation (gambling) cannot rewrite GDPR/PECR consent

The decision resists using data protection consent as a backdoor to fill perceived gaps in gambling regulation. It emphasises legislative uniformity: consent must mean the same across PECR and data protection contexts and cannot be moulded to provide “complete insurance” for a particular sectoral harm.

4. Complex Concepts Simplified

  • “Consent” (GDPR Art 4(11)): Not a private thought. It is the external signal (e.g., ticking a box) that objectively indicates agreement.
  • “Freely given”: Focuses on whether the person had a real choice in the way consent was requested—no deception, coercion, undue pressure, or unfair conditionality (e.g., “you can’t use the service unless you agree to unnecessary processing”).
  • “Informed”: The controller must provide clear, comprehensive information so the user is enabled to understand what will happen to their data.
  • “Specific”: Consent must relate to identified processing purposes; you can’t infer it from consent given for something else.
  • “Unambiguous”: The user’s act must clearly mean “yes”; silence or inactivity (like leaving a pre-ticked box) is not enough.
  • “Objective vs subjective”: Objective asks what a reasonable assessment of the user’s actions and the surrounding communications shows. Subjective would ask what the particular user truly understood or felt—an inquiry the Court rejected for establishing consent.
  • “Lawful basis”: A legal permission for processing (e.g., consent; legitimate interests). If one fails, another may still apply depending on the facts.

5. Conclusion

RTM v Bonne Terre Ltd & Anor establishes, with unusual clarity, that for GDPR/DPA/PECR purposes consent is proved by the data subject’s objective outward indication of agreement, evaluated against the four statutory criteria in context, and does not depend on proving the individual’s subjective state of mind or autonomy at the time. The Court’s approach promotes legal and practical certainty, confines the role of vulnerability in “consent” disputes, and signals that concerns about marketing to vulnerable individuals are more likely to be addressed through other GDPR principles (fairness, transparency, lawful basis choices, special category data) or sector-specific regulatory duties—rather than by transforming “consent” into an individualized capacity/autonomy inquiry.