Factual and Procedural Background
The Plaintiff, a person who had experienced problem gambling during the relevant period, brought proceedings against the Appellants (Company A and Company B, trading as Company C), which operated an online betting and gaming business. The Plaintiff alleged that, during a two year relevant period, Company C placed cookies on his devices or browser, processed his personal data and sent targeted direct marketing; that he was a gambling addict; that Company C's activities breached PECR and data protection law; and that those activities caused him to gamble more and suffer financial loss and distress. At first instance Judge Collins Rice separated liability and remedies and decided liability on the basis that the Plaintiff had not given legally operative consent to the activities, concluding that all of Company C's activities in the relevant period were unlawful. Company A and Company B appealed. The Information Commissioner intervened in the appeal. The Court of Appeal (Judge Warby, with Judges Lewison and Sharp agreeing) heard argument and handed down the attached judgment.
Legal Issues Presented
- What must be proved to establish that consent was "given" for: the placement of cookies; the processing of personal data; and the sending of unsolicited direct marketing communications?
- Whether the concept of consent for these purposes includes a subjective element (i.e. proof of the data subject's actual state of mind and autonomous decision-making) or is essentially objective.
- Whether the data controller's actual or constructive knowledge of a data subject's vulnerability (for example a gambling addiction) is relevant to whether consent has been given.
- Whether it was procedurally fair for the trial judge to decide liability on a basis (a subjective test of consent tied to the Plaintiff's vulnerability) that had not been advanced or fully argued by the parties.
- Related factual and legal issues raised by the appeal: whether (a) the Plaintiff gave factual consent to direct marketing on 26 July 2017; (b) cookies were used to enable personalised direct marketing to the Plaintiff; and (c) profiling for direct marketing was lawful.
Arguments of the Parties
Appellants' Arguments (Company A & Company B / Company C)
- The legal test for consent under PECR and data protection law is essentially objective: consent consists of an outward "indication" (statement or clear affirmative action) that must satisfy the four legislative criteria (freely given, specific, informed, unambiguous).
- The data controller must prove, on the balance of probabilities, that the data subject made the requisite outward indication and that it met the four criteria; it is not necessary to prove the data subject's actual state of mind.
- It was procedurally unfair for the trial judge to decide the case on a subjective test of consent grounded in the Plaintiff's vulnerability where that was not the case advanced at trial and Company C had insufficient opportunity to address that analysis.
- On the evidence the Plaintiff did give factual consent to direct marketing on 26 July 2017 (most likely by an opt‑in box), and there was no evidence that cookie-derived data were used to produce the direct marketing complained of; the profiling findings were therefore parasitic on legal errors about consent.
Respondent's Arguments (Plaintiff)
- The Plaintiff originally pleaded that he did not consent. He relied on evidence about Company C's practices and his own account that he did not read or turn his mind to privacy materials and had opted out or not opted in to marketing.
- The Plaintiff accepted the trial judge's overall conclusion but did not advance before the trial the specific legal analysis that the judge deployed (a subjective/autonomy-based test). He argued on appeal that the judge's factual findings, properly read, supported the outcome.
Intervener's Arguments (Company D)
- The Information Commissioner agreed with the Appellants' legal position that the test for consent is essentially objective and that the trial judge's subjective/autonomy-based approach was legally wrong.
Table of Precedents Cited
| Precedent |
Rule or Principle Cited For |
Application by the Court |
| Verbraucherzentralen Bundesverband e.V. v Planet 49 GmbH (Case C-673/17) [2020] 1 CMLR 25 (Planet 49) |
Consent requires active behaviour; pre‑ticked boxes/passive inaction do not amount to an "indication" or "clear affirmative action"; information must be clearly comprehensible and sufficiently detailed. |
Cited as authority for an objective focus on outward action and information provided by the controller; supports requiring a clear affirmative act and objective assessment of whether information enabled consent. |
| Orange Romania SA v ANSPDCP (Case C-61/19) (Orange Romania) |
Consent must be specific and presented in a manner distinguishable from other matters; contractual settings that mislead or impose burdens to refuse consent invalidate consent being "freely given". |
Applied to show that presentation and clarity of requests for consent are assessed objectively and that consent must be distinguishable and unambiguous. |
| Meta Platforms Inc v Bundeskartellamt (Case C-252/21) [2023] 5 CMLR 22 (Meta Platforms) |
A dominant market position does not automatically prevent valid consent but must be taken into account when assessing whether consent was freely given (possible imbalance affecting freedom of choice). |
Relied on to show that structural features (power imbalances) are relevant objectively to assessing freedom to consent, not to justify an individualized subjective test. |
| Leave.EU v Information Commissioner [2021] UKUT 26 (AAC) (Leave.EU) |
Applied the CJEU standards to unsolicited direct marketing; emphasised a relatively high evidential bar for valid consent in that context. |
Referred to by the trial judge and considered; the Court of Appeal treated it as consistent with an objective, fact‑sensitive approach rather than a subjective autonomy test. |
| Cooper v National Crime Agency [2019] EWCA Civ 16 (Cooper) |
Consent is an objective notion depending on the outward manifestation of consent by the data subject. |
Not cited to the trial judge but relied upon by the Court of Appeal as supportive of an objective approach to consent. |
| SM v Entry Clearance Officer, UK Visa Section (Case C-129/18) [2019] 3 C.M.L.R. 16 |
Principle that interpretation of EU provisions should be autonomous and applied uniformly across jurisdictions. |
Cited to support the approach that the concept of consent must be uniform and not tailored to particular factual categories. |
| Satyam Enterprises Ltd v Burton [2021] EWCA Civ 287 |
Procedural fairness: parties must have a fair opportunity to address reasons decisive to the court's decision. |
Relied upon in assessing whether it was fair for the trial judge to decide the case on a legal analysis not advanced by the parties. |
| Al‑Medenni v Mars UK Ltd [2005] EWCA Civ 1041 |
Procedural fairness principles regarding the need to give parties an opportunity to meet an argument on which the court intends to decide. |
Applied in the Court of Appeal's consideration of whether Company C had adequate opportunity to address the judge's subjective test. |
Court's Reasoning and Analysis
The court analysed the statutory definitions (notably Article 4(11) and Article 7 GDPR), PECR regulations and relevant recitals, and the CJEU and domestic authorities. The court emphasised that consent is framed in the legislation as an outward "indication" by statement or clear affirmative action and that the controller bears the burden of proving that such an indication met the four statutory criteria (freely given, specific, informed, unambiguous) on the balance of probabilities.
The court concluded that these criteria are to be assessed objectively, by reference to the outward communication and the context (communications between the parties and the structural character of their relationship), not by inquiry into the individual's subjective state of mind. The court considered the trial judge's three‑strand test (subjective consent, autonomous choice, and evidential standards) and found the reliance on an individuated subjective/autonomy inquiry to be legally erroneous and to have produced an uncertain and impractical test.
The court rejected the submission (advanced by Company C and the intervener at the appeal stage but not adopted by the Plaintiff) that the data controller's actual or constructive knowledge of an individual data subject's vulnerability should form part of the test for consent. The court gave several reasons: it would reintroduce an individualized subjective inquiry into the controller's state of mind; it would be impractical and increase uncertainty; and it is not supported by the legislative language or the guidance. The court noted alternative ways to protect vulnerable individuals (for example by assessing fairness or compliance with sectoral codes) without converting consent into a subjective test.
Procedurally, the court held that it was unfair for the trial judge to decide liability on the subjective/autonomy basis because that analysis had not been a live issue in the form the judge used and the Appellants had insufficient opportunity to address it.
On the factual issues, the court found that the trial judge's own factual findings supported a conclusion that the Plaintiff gave factual consent to direct marketing (most plausibly by opting in on 26 July 2017) and that findings about cookies and profiling in paragraph [205] were unsupported by the evidence adduced (cookies were not shown to have been used to create or deliver the particular direct marketing complained of; profiling findings were parasitic on the erroneous consent analysis).
Holding and Implications
HOLDING: The Court of Appeal allowed the appeal on all five grounds, set aside the trial judge's decision on liability and remitted the case to the High Court for further proceedings. The court held that the correct legal approach is an objective test for consent: a data controller must prove an outward indication amounting to consent and that that indication met the four statutory criteria; it is not necessary to prove the data subject's subjective state of mind. The court also held that the trial judge's reliance on a subjective/autonomy‑based test, and her decision on that basis without giving the Appellants a fair opportunity to address it, vitiated the liability decision.
Implications: The direct effect is that the judgment below on liability was set aside and the matter remitted to the High Court; the Court of Appeal identified and applied an objective legal test for consent under PECR and data protection law. The court declined to adopt a rule that a data controller's knowledge or constructive knowledge of individual vulnerability is an element of the consent enquiry, and it invited further submissions on the scope of the remission and consequential orders. No other novel legal propositions beyond the objective test for consent were imposed by the Court beyond the case's own disposition.