RTM v Bonne Terre: Court of Appeal clarifies meaning of consent for cookies and direct marketing

The Court of Appeal has overturned a High Court decision on what amounts to valid consent for cookies and direct marketing under the GDPR and PECR. 

In RTM v Bonne Terre Limited & Anor [2026] EWCA Civ 488 (21 April 2026), the Court of Appeal has clarified that consent is to be assessed objectively, rather than by reference to an individual’s state of mind. This means that data controllers are not required to prove what was actually in the mind of the individual data subject at the time that consent was given.

Background

The claim was brought by RTM, a recovering problem gambler, against Bonne Terre Limited and Hestview Limited, the companies behind the online betting and gaming business known as Sky Betting and Gaming (Sky Betting).

RTM alleged that, during the period when he was experiencing a gambling problem, Sky Betting placed cookies on his devices, used those cookies to process his personal data and sent him targeted direct marketing without consent. RTM claimed compensation for financial loss and distress, arguing that, if the marketing had not been sent, he would have gambled less and lost less money.

At first instance, the High Court interpreted consent to have a subjective element, turning on an individual’s internal state of mind at the time of giving consent. The judge held that RTM’s gambling problem meant they could not validly provide consent in a way that met the GDPR standard. Sky Betting appealed on various grounds, including on the key question of what amounts to valid consent for these purposes. 

What counts as valid consent?

Article 4(11) GDPR defines consent as “any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her."

Where consent is relied on as the lawful basis for processing personal data, the data controller must be able to demonstrate that each element of consent is satisfied, for each processing activity. Under Article 7, the burden of proof rests with the data controller.

The key question on appeal was whether those consent requirements involve a subjective assessment of the individual, or whether they are judged by reference to objective factors.

The Court of Appeal’s decision

The Court of Appeal unanimously rejected the High Court’s approach. It held that the consent criteria set out in the GDPR and PECR are “objective in nature”. Crucially, each of those elements (affirmative action, freely given, specific, informed and unambiguous) is assessed by reference to objectively ascertainable features of the interaction between the parties - such as what information was provided, how choices were presented, and what the user actually did.

As such, the data controller does not need to prove what was in the individual’s mind at the time the consent was given.

The Court of Appeal considered that a subjective test for consent would be unworkable in practice and have unintended consequences beyond the gambling sector. If valid consent depended on a data subject’s internal state of mind - or on personal vulnerabilities that a controller could not reasonably have known about - no consent mechanism could ever provide absolute legal certainty. Such a requirement would make it impossible for organisations to guarantee compliance.

Interestingly, the ICO intervened in the appeal on the issue of consent, and agreed that the test for consent is essentially objective, while noting that vulnerability may still be relevant where a data controller knows or ought to know about it. The Court of Appeal observed that a data subject’s vulnerability may invalidate their consent, for example, if a data controller is aware of a condition that undermines an individual's capacity to make free choices, any resulting "indication of wishes" may fail to meet the "unambiguous" standard required by law. Notably, Warby LJ further commented that processing personal data may be deemed "unfair" if the controller knew, or ought to have known, that the subject was suffering from a disability or external factor that compromised their autonomy. This potentially paves the way for an argument that the processing of personal data was not fair (contrary to the fairness principle under Article 5(1)(a) of the GDPR), even if consent was obtained. 

The Court of Appeal set aside the High Court’s findings on liability and remitted the case for further consideration, following this clarification of the law.

Commentary

The Court of Appeal’s ruling offers important legal certainty for organisations that rely on consent, confirming that the validity of consent is assessed by reference to objective criteria. Organisations are not expected to prove that an individual subjectively consented in their own mind. 

That said, the judgment also highlights that an individual’s vulnerability may still be relevant when assessing compliance with broader data protection principles such as fairness and transparency - particularly where an organisation knew, or should have known, about a data subject’s vulnerability.

In light of this, organisations should ensure their consent mechanisms are robust and well documented - while recognising that obtaining valid consent alone may not be sufficient to satisfy broader fairness obligations.

For queries or advice on the content of this article, please contact Hamish Corner, Lucy Pegler, Amanda Leiu or a member of Burges Salmon's Commercial & Technology team. 

This article was written by Jess Mant and Amanda Leiu.