RTM – Court Ruling (United Kingdom, 2026)

The controller, Sky Betting and Gaming ("SBG"), operated an online betting and gaming platform. The data subject, RTM, opened an account with the controller, which they used between April 2017 and early 2019. The controller presented the data subject with a cookie banner stating that by visiting or using this website they would consent to the use of cookies. The banner included a hyperlink with the controller’s cookie policy. The controller’s privacy notice also stated that, unless customers had asked otherwise, they would send them direct marketing communications and use information about them to provide tailored advertising. The controller’s records showed that, on 26 July 2017, the data subject changed his marketing preferences. From 28 July 2017, the controller began sending him direct marketing communications. The data subject did not remember opting in. In March 2018, the controller carried out a “GDPR refresh”. Customers were required to confirm that they had read, understood and accepted updated terms and privacy/cookie information. The controller’s records indicated that the data subject ticked the relevant boxes and chose to continue with his existing direct marketing preferences. The data subject brought proceedings before the High Court under Article 82 GDPR/UK GDPR and Regulation 30 PECR. He argued that the controller had unlawfully placed cookies, processed his personal data, profiled him and sent him direct marketing communications. In particular, he argued that the controller had no valid consent within the meaning of Article 4(11) and Article 7 GDPR/UK GDPR, the DPA 1998 and Regulations 6 and 22 PECR. Although the pleadings referred to GDPR/UK GDPR, the relevant processing period was governed by the DPA 1998 for the earlier period and by the GDPR from 25 May 2018; the Court considered that the meaning of consent was materially the same across the relevant data protection and PECR regimes.. The data subject submitted that the cookie banner did not offer an active way to refuse consent and that the controller’s processing and direct marketing contributed to his gambling addiction, causing financial loss and distress. He also alleged that the controller’s processing was unfair, insufficiently transparent, breached the principles of purpose limitation, data minimisation and storage limitation, and involved special category data because it revealed problem gambling. The key question before the Court was: “What must be proved to establish that consent was given for the placement of cookies, the processing of personal data, and the sending of unsolicited direct marketing communications? Mainly, does the concept of consent for these purposes have a subjective aspect?“ The High Court upheld the data subject’s claim and found that the data subject did not give valid consent. The High Court treated consent as involving three strands: 1) the data subject’s subjective state of mind; 2) whether any lack of subjective consent resulted from an autonomous choice not to engage with the information provided by the controller; and 3) whether the controller had sufficient evidence to prove legally operative consent. Applying that approach, the High Court concluded that the controller’s conduct was unlawful in both periods. In the first period, she found that the data subject lacked subjective consent because of his gambling addiction and that the controller’s “accept and close” mechanism did not provide sufficient evidence of an autonomous choice to give, or to forego, consent. In the second period, the High Court accepted that the GDPR refresh had significantly improved the controller’s consent mechanism. However, it found that this was still insufficient on the facts of the case. In its view, the controller could not rely solely on the general probability that a user who ticked the relevant boxes had validly consented. Instead, where consent was challenged, the controller had to demonstrate that this particular data subject’s consent met the required legal standard. The High Court found that his consent was not sufficiently freely given, because the data subject’s gambling addiction impaired the autonomous quality of his decision-making. It also considered that the resulting uncertainty for businesses was an inevitable consequence of the high standard of consent required by data protection law. The controller appealed the decision on the following grounds: Firstly, that the High Court had applied the wrong legal test for valid consent by treating consent as involving a subjective inquiry into the data subject’s state of mind and autonomy. Secondly, that the High Court’s conclusion that the data subject’s gambling addiction impaired the validity of his consent was not an argument put forward by the data subject. Thirdly, that the High Court erred in failing to find that the data subject had factually consented to direct marketing on 26 July 2017. Fourthly, that there was no evidence that cookies were used to send the direct marketing communications complained of by the data subject. Fifthly, that the High Court’s conclusion on profiling was parasitic on its erroneous findings on consent, cookies and direct marketing, and that it misunderstood the controller’s concession on legitimate interests. The Court of Appeal allowed the appeal on all five grounds. First, the Court held that consent under the relevant data protection and PECR regimes, including the GDPR/UK GDPR where applicable, is assessed objectively. To prove consent, a controller must show that the data subject made a statement or took a clear affirmative action amounting to an indication of their wishes, signifying agreement to the relevant processing or direct marketing. The controller must also prove, on the balance of probabilities, that this indication was freely given, specific, informed and unambiguous. The Court rejected the High Court’s subjective approach. The controller does not have to prove what was actually in the data subject’s mind at the time of the indication. Nor is it necessary or relevant, for the purpose of establishing consent, to examine whether the data subject was vulnerable or had an impaired ability to make autonomous decisions. The Court considered that this objective approach was supported by the wording of Article 4(11) and Article 7 GDPR/UK GDPR, as applicable, and the relevant provisions of PECR. The statutory criteria of consent focus on the outward indication given by the data subject, the information provided by the controller, and the structural relationship between the parties. Second, the Court held that the High Court’s approach was procedurally unfair. The data subject had not argued that his gambling addiction made his consent legally ineffective because of a subjective impairment of autonomy. The High Court therefore decided the case on a basis that had not been properly pleaded or argued, meaning that the controller had not had a fair opportunity to address that specific theory of liability. Third, the Court held that the High Court should have found that the data subject gave factual consent to direct marketing on 26 July 2017. The applicable standard was the balance of probabilities, not certainty. On the evidence, the most likely explanation was that the data subject had ticked a box or otherwise changed his preferences to opt in. Fourth, the Court held that there was no evidence that cookie-derived data was used to create or send the specific direct marketing communications complained of by the data subject. the controller used cookies for personalised advertising on third-party websites and social media, but those activities were not the direct marketing communications at issue in the claim. Fifth, the Court held that the High Court’s finding on profiling was parasitic on its erroneous findings on consent, cookies and direct marketing. The High Court had also misunderstood the controller’s concession on legitimate interests. the controller had only accepted that a gambling operator could not rely on legitimate interests to market to a problem gambler if it had grounds to know that the person was a problem gambler. The High Court had made no such finding. As a result, the Court of Appeal set aside the High Court’s liability judgment. However, the case still had to be remitted to the High Court because other issues, including fairness and other data protection principles, remained unresolved.