![]() |
[Home] [Databases] [World Law] [Multidatabase Search] [Help] [Feedback] [DONATE] | |||||||||
England and Wales Court of Appeal (Civil Division) Decisions |
||||||||||
|
THE FUTURE OF BAILII DEPENDS ON USERS LIKE YOU
If you want to be able to use BAILII in the future, please consider making a donation to celebrate BAILII's 25 years of providing free access to law.
Your donation, no matter the size, will help BAILII maintain the legal databases that you and many other users rely on. If every visitor this month gives just £5, it will have a significant impact on BAILII's ability to continue providing this vital service.
| ||||||||||
|
You are here: BAILII >> Databases >> England and Wales Court of Appeal (Civil Division) Decisions >> RTM v Bonne Terre Ltd & Anor [2026] EWCA Civ 488 (21 April 2026) URL: https://www.bailii.org/ew/cases/EWCA/Civ/2026/488.html Cite as: [2026] EWCA Civ 488, [2026] WLR(D) 231 |
||||||||||
[New search]
[Context
]
[View without highlighting]
[Printable PDF version]
[View ICLR summary: [2026] WLR(D) 231]
[Help]
2026] EWCA Civ 488 | ||
CIVIL
DIVISION)
ON APPEAL FROM THE HIGH COURT OF JUSTICE
KING'S BENCH DIVISION
MEDIA AND COMMUNICATIONS LIST
Mrs Justice Collins Rice
Strand, London, WC2A 2LL |
||
2026 |
B e f o r e :
VICTORIA
SHARP, PRESIDENT OF THE KINGS BENCH DIVISION
LORD JUSTICE LEWISON
and
LORD JUSTICE WARBY
____________________
RTM |
Claimant/ Respondent |
|
| - and |
||
(1) BONNE TERRE LIMITED(2) HESTVIEW LIMITED |
Defendants/Appellants |
|
| - and |
||
| THE INFORMATION COMMISSIONER |
Intervener |
____________________
Christopher Knight, Jennifer MacLeod and Aarushi Sahore (instructed by AWO) for the Respondent
Heather Emmerson and Jack Steele (instructed by the ICO) for the Intervener
Hearing dates: 10 and 11 March
2026
____________________
VERSION
OF APPROVED JUDGMENT
Crown Copyright ©
2026
by circulation to the parties or their representatives by e-mail and by release to the National Archives.LORD JUSTICE WARBY:
Introduction and summary
"For the purposes of this Regulation
...
'consent' of the data subject means any freely given, specific, informed and unambiguous indication of the data subject's wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her".
Article 7 of the GDPR provides that it is for the data controller to prove that these criteria are met. The standard is the balance of probabilities. This all reflects the law as it had developed under the DP Directive and the DPA 1998.
RTM)
was a problem gambler, which is why he has been anonymised in these proceedings. By early 2019 he had overcome his problem. This case is concerned with events in a two year period before that (the relevant period). During the relevant period SBG placed cookies on
RTM's
devices or his browser, processed his personal data, and sent him targeted direct marketing; and
RTM
used SBG's services and lost sums of money.
RTM
later sued SBG for compensation and declarations, contending that he was a gambling addict; that SBG had acted unlawfully in its placement of cookies, its processing of his personal data, and its direct marketing communications; that this caused him to gamble more and to lose more than he would otherwise have done; and that he had thereby suffered financial loss and distress.
RTM
had given legally operative consent to the activities of which he complained. She held that he had not done so, and that all of SBG's activities over the relevant period were therefore unlawful. SBG now appeals. The Information Commissioner (ICO) has intervened to assist the court.
RTM
had taken deliberate actions that indicated consent, but held that none of the three criteria she had identified was met. Accepting
RTM's
evidence about the impact on him of his gambling problem, she found that he "lacked subjective consent"; that "the autonomous quality of his consenting behaviour was impaired to a real degree"; and that on the evidence "the quality of this Claimant's consenting was rather lower than the standard required", and "insufficiently freely given", the reasons being "his gambling condition and his associated
vulnerability
and compromised autonomy".
RTM's
favour was not one that he had put forward. It was not the subject of any real debate at the trial. SBG's first ground of appeal is that it was procedurally wrong and unfair to decide the case on this basis. SBG's second ground of appeal is that the judge's analysis is legally wrong. The ICO agrees with that. SBG and the ICO both submit that the test for consent is essentially objective. They do however accept that a gambling problem or similar
vulnerability
on the part of a data subject may be relevant if the data controller knows or ought to know of the
vulnerability.
This too is a new legal analysis, not advanced by any party at the trial.
RTM
did not adopt it. His case is that, on a proper analysis of the law and the judgment, the judge's overall conclusion in
RTM's
favour is sufficiently supported by proper findings of objective fact.
(1) The question in all cases is whether the data subject has "given" consent to the processing or other activity. To prove this, a data controller must show that the data subject made a statement or took some other clear affirmative action amounting to an "indication" of their wishes with respect to the processing or direct marketing in question that "signifies agreement" to the relevant activity of the data controller. These are purely objective questions about the quality and significance of some identifiable communication by the data subject to the data controller. Typically, this will be by ticking a box or some similar act.
(2) The data controller must also prove to the necessary standard that the data subject's "indication" met each of the four criteria prescribed by the legislation, namely that it was (i) freely given, (ii) specific, (iii) informed, and (iv) unambiguous. Each of these criteria is also objective in nature. A decision on whether the four criteria were probably satisfied will require an assessment of the data subject's "indication" in its context including, in particular, the communications between the data subject and the data controller, and the structural character of the relationship between them.
(3) To prove consent, the data controller does not have to prove what was actually in the mind of the individual data subject at the time of the "indication". It is neither necessary nor relevant for this purpose to explore whether the individual data subject was
vulnerable,
with an impaired ability to make fully autonomous decisions.
(4) It follows that I disagree with the judge's legal analysis. I do not accept
RTM's
submission that the judgment contains findings of objective fact that are sufficient to support the judge's overall conclusion. I therefore conclude that the judge's decision on liability is
vitiated
by error of law. The fact that SBG did not have a reasonable opportunity to address the judge's legal analysis before the judgment was circulated in draft is a further reason why the decision cannot stand. I would allow the appeal on these two grounds.
(5) I am not persuaded by the submissions of SBG and the ICO, that the actual or constructive knowledge of the data controller about the personal circumstances or state of mind of the data subject has a bearing on whether consent is established. In my
view,
RTM
was correct not to adopt that line of argument. I do not think it consistent with the language of the legislation or coherent to treat the data controller's state of mind, actual or constructive, as a criterion for whether the data subject has given consent. For these reasons I would reject the suggestion made in SBG's written submissions, that the issue of consent should be remitted to the High Court in order for findings of fact to be made on those further issues.
The law
Legislation
(32) Consent should be given by a clear affirmative act establishing a freely given, specific, informed and unambiguous indication of the data subject's agreement to the processing of personal data relating to him or her, such as by a written statement, including by electronic means, or an oral statement. This could include ticking a box whenvisiting
an internet website, choosing technical settings for information society services or another statement or conduct which clearly indicates in this context the data subject's acceptance of the proposed processing of his or her personal data. ...
...
(42) Where processing is based on the data subject's consent, the controller should be able to demonstrate that the data subject has given consent to the processing operation. ... Consent should not be regarded as freely given if the data subject has no genuine or free choice or is unable to refuse or withdraw consent without detriment.
(43) In order to ensure that consent is freely given, consent should not provide avalid
legal ground for the processing of personal data in a specific case where there is a clear imbalance between the data subject and the controller, in particular where the controller is a public authority and it is therefore unlikely that consent was freely given in all the circumstances of that specific situation. Consent is presumed not to be freely given if it does not allow separate consent to be given to different personal data processing operations despite it being appropriate in the individual case, or if the performance of a contract, including the provision of a service, is dependent on the consent despite such consent not being necessary for such performance.
vulnerable
persons from being harmed or exploited by gambling". Section 24(9)(b) of the 2005 Act requires a court to take a gambling code of practice into account in any case in which it appears to be relevant. I shall come back to the relevance of this regime.
Case law
Verbraucherzentralen
Bundesverband e.
V.
v
Planet 49 GmbH (Case C-673/17) [2020] 1 CMLR 25 (Planet 49), Orange Romania SA
v
ANSPDCP (Case C-61/19) (Orange Romania), and Meta Platforms Inc
v
Bundeskartellamt (Case C-252/21) [2023] 5 CMLR 22 (Meta Platforms). All of these were decided before IP Completion Day, and all were referred to by the judge. The domestic cases are the decision of the UT in Leave.EU
v
Information Commissioner [2021] UKUT 26 (AAC) (Leave.EU), to which the judge referred, and the Court of Appeal decision in Cooper
v
National Crime Agency [2019]
EWCA
Civ
16 (Cooper), to which the judge did not refer, it not having been cited to her.
various
kinds of processing of their personal data, including storage of identity documents. There was a box to be ticked, and the company's procedures required refusal of consent to be set out in a specific form, signed by the customer, but the company entered into contracts where the box was not ticked and no form was signed and in some instances the box was ticked by the company's own staff. The CJEU reiterated the principles identified in Planet 49 and held that a contract containing clauses of the kind in question was "not such as to demonstrate that that person has
validly
given his or her consent" where the box had been ticked before the contract was signed; or the terms of the contract were capable of misleading the data subject "as to the possibility of concluding the contract in question even if he or she refuses to consent to the processing of his or her data"; or where "the freedom to choose to object ... is unduly affected by that controller in requiring that the data subject, in order to refuse consent, must complete an additional form setting out that refusal": [52].
validly
giving their consent ... within the meaning of Article 4(11) of the GDPR" but "must be taken into consideration in assessing whether the user ... has
validly
and, in particular, freely given consent". That was because "that circumstance is liable to affect the freedom of choice of that user ..." and "the existence of such a dominant position may create a clear imbalance, within the meaning of recital 43 of the GDPR, between the data subject and the controller, that imbalance favouring, inter alia, the imposition of conditions that are not strictly necessary for the performance of the contract, which must be taken into account under Article 7(4)...".
valid
consent": [51]. The criteria for "specific, informed" consent established by those authorities were not met. "There was no indication that subscribers were doing anything other than signing up for a Brexit newsletter": [56]. The UT did not refer to Cooper, which does not appear to have been cited to it.
Vos,
C agreed) rejected a submission that the ICO's guidance meant that if there was any ambiguity about whether consent had been given it must be resolved by finding that it had not, saying this:
The data controller needs to know what its obligations are under the DPA, so the notion of consent in condition 1 is an objective one, which depends on the outward manifestation of consent by the data subject. ... In any event, in the present case, I do not consider that there is any ambiguity or genuine uncertainty about the meaning of clause 24.2, when the full context is taken into account.
RTM's
claims and the issues in the case
RTM's
case is that SBG gathered data relating to him, including by the use of cookies, and then processed it to analyse and profile him, and to generate personalised and targeted direct marketing which fed his compulsive gambling behaviour, causing the further gambling and the consequent harm that I have mentioned.
RTM
contends that these activities were undertaken in ways that were contrary to PECR, and also contravened the DPA and GDPR, because SBG did not obtain his consent as defined in the legislation and had no other lawful basis for processing his personal data.
RTM
also alleges that SBG's processing of his personal data infringed his data protection rights because it was neither transparent nor fair, and because it contravened the data protection principles known as "purpose limitation", "data minimisation" and "storage retention". In addition,
RTM
contends that the data collected revealed a gambling addiction or at least problem gambling with mental health implications, and to that extent were "special category" data, the processing of which is subject to additional conditions, which were not satisfied here.
RTM's
case, and SBG's defence, on the key issue of consent. It will also be helpful to outline the rival cases about fairness.
Consent
RTM
pleaded that he "did not consent to [SBG's] marketing and/or there was no
valid
consent given within the meaning of Article 4(11) and Article 7 GDPR/UK GDPR and Schedule 2, paragraph 1, DPA 1998". In support of this plea
RTM
relied on a detailed critique of the way in which SBG constructed a user profile of him (paragraph 26 of the RAPoC). This alleged that SBG had observed and recorded his actions on its sites, used cookies to track his browsing and email activity, shared such information with other websites and organisations, and thereby built up a detailed profile of him.
RTM
pleaded that he "did not give his consent to the placement and use of cookies" because the SBG websites displayed only an "accept and close" dialogue box in relation to the cookies, allowing no opportunity for rejection or active behaviour to give consent. He alleged that he had opted out from receipt of direct marketing communications from SBG when he opened his account and "never subsequently opted in to receive marketing communications", but that he had regularly been sent direct marketing, nevertheless.
RTM
was the data subject, and that the activities of which he complained involved or included the "processing" of those data. SBG's case was that it had "always adopted an approach whereby customers (including [
RTM])
have always been able to exercise a choice as to whether or not to participate in SBG's marketing". It was said that "the claimant's consent was obtained for the use of cookies, in accordance with the prevailing norms ... at the relevant time". The lawful basis for direct marketing and marketing profiling was said to be "consent". SBG also contended that its legitimate interests provided another lawful basis for profiling.
RTM
complained that SBG had failed to particularise how consent was in practice obtained from a user, what information was provided to a user when seeking consent, "the method or modality through which purported consent was obtained" from him, and how he consented to marketing profiling. His case was that he believed he had set his marketing preferences to "off", that he could not recall providing his consent, and that SBG's case was "too
vague
and unparticularised to enable the court to assess whether consent met the applicable legal standards."
Fairness
RTM
made two complaints of unfairness. Both relied on the content of SBG's privacy notices. First, it was said that as the privacy notices always stated that the lawful basis for SBG's marketing and profiling was consent, any processing in the absence of consent would be unfair. Secondly, processing was said to be unfair because the privacy notices did not make SBG's multiple purposes clear.
The judge's analysis
RTM's
"consenting behaviour" as she found them to be.
The evidential background
(1) Upon activating his SBG account in April 2017
RTM
had encountered a cookie banner stating that "by
visiting
or using" the website he consented to the use of cookies; and that he had clicked on an "accept and close" button to indicate his consent. The banner contained a hyperlink allowing customers to
view
SBG's cookies policy.
RTM
said he had not clicked on that hyperlink. There was no evidence that he had.
(2) There was a dispute about consent to direct marketing. SBG's privacy notice told customers that "unless you'
ve
asked us not to" it would send them direct marketing communications and use information it held about them to provide them with tailored advertising. A section headed "your preferences" enabled customers to choose not to receive direct marketing by adjusting their preferences
via
their SBG account or in other ways.
RTM
did not receive direct marketing from the time he activated his SBG account in April 2017. That was either because he opted out or because he did not opt in. But on 28 July 2017 SBG began to send
RTM
direct marketing, and it continued to do so thereafter without objection from
RTM.
(3) SBG's case was that this was because
RTM
had opted in on 26 July 2017 by changing his marketing preferences. SBG relied on a customer spreadsheet record that was said to record a marketing opt-in.
RTM
did not recall opting in and disputed the adequacy of SBG's evidence. The judge found that it was "plain that SBG recorded, and activated, a change in the Claimant's consent to direct marketing at this time"; that it was "improbable" that this resulted from a spontaneous and isolated systems malfunction; and that "it may well be more probable than not that the commencement of direct marketing was a response to something the Claimant did". But at [124] the judge said there was a "paucity of evidence" as to what that something was, which led her to "hesitate
to accept that I must proceed on an assumption that all possibilities other than proactive choice are eliminable." Exactly what
RTM
did was "largely a matter of speculation".
RTM's
response to it.
(1) Customers had to scroll through a new set of terms and conditions and tick two boxes to indicate that these had been read and understood, and that they had been accepted. SBG's records indicated that on 6 April 2018,
RTM
ticked both boxes. His evidence was that he had no recollection of doing so.
(2) Ticking these boxes at the end of the terms and conditions brought up a revised privacy and cookies notice which customers, again, had to scroll through before ticking two boxes to indicate that they had read, understood and accepted what was said. SBG's records indicated that
RTM
ticked both boxes. His evidence was that he did not read the policy and if he did anything he would have ticked the boxes to make the material go away.
(3) The final step was to present customers with a choice about direct marketing. This was presented differently according to whether the customer was already opted in or opted out. As SBG had recorded
RTM
as an already opted-in customer, he was given a choice to opt out or to "continue with my current preferences". SBG's records indicated that he had taken the latter option.
RTM's
evidence was that he had no memory of any of this.
The law on consent
147. The relevant legislation, and these authorities I was shown on the quality of consent required to render data processing lawful, need some unpacking. The language of and relating to the legislation, and the rhetoric of the judgments, is in terms which suggest a bar which is indeed 'relatively high' consent must be free, specific and informed, it must be separate from the activity to which it stands as a threshold requirement, it must be active and unambiguous. This qualifying language is referable to the origins of data protection law in Art.8 ECHR and its underlying understanding of privacy as implying individual autonomy, including the genuinely autonomous control of personal data. But there are three distinct strands perceptible in this rather complex idea.
148. First, there is the subjective element of the individual's state of mind what they actually thought about, understood and desired. This actual and high quality, individuated, consent has a palpable presence in the authorities as at least an aspirational standard. But on closer examination it may be that this element alone is not after all set at a particularly high minimum requirement in data protection law, and does not need to be, because it has to be understood alongside the second element what might be described as the autonomous choice of the individual about consent. The authorities do not speak in entirely subjective terms in setting their 'relatively high' standard. They do speak about consent being specific, which implies some basic threshold of subjective understanding that consent is being given, and to what it is being given. But they also speak about individuals being 'in a position' to be able to determine the consequences of giving or withholding consent, including by being well-informed that is, 'provided with' full and clear information. These expressions emphasise less an individual's subjective state of mind, and more the external circumstances of their choices.
149. The requirements for consent in data protection law have deep roots in the protection of the autonomy of the individual. That extends not only to the subject matter of the consent the freedom to choose or not to choose to have one's personal data processed in certain ways and with certain consequences, with specificity about what those are but also to the process of consenting itself. If an individual makes a fully autonomous choice to limit the quality of their own consent for example by choosing not to engage with information which is readily available and accessible and so executes a permission which is subjectively ill-informed and misunderstood, there is no inevitable compromise of their autonomy in attaching legal effect to that choice.
150. The balance between these first two elements which is struck in the authorities appears to set a relatively low threshold for the presence of good-quality subjective consent but a relatively high threshold for establishing that any deficiency of subjective consent is itself autonomously chosen. That is unsurprising; it is a position which is both principled and pragmatic. It is principled because it respects the personal autonomy which it is the purpose of these consent provisions to safeguard. Some processing of personal data is sufficiently invasive (cookies are a form of surveillance of personal activity) or intrusive (direct marketing imposes itself on personal attention) to be unlawful without an individual's autonomous submission to the compromises of personal autonomy which they intrinsically involve. But individuals' freedom to make that autonomous submission, and decide how to make it, must itself be respected.
151. And it is pragmatic because the balance it strikes between commercial freedom and individual privacy has to be a workable one. Commercial freedom is a collective good. Businesses cannot operate the data systems on which they rely, to provide the goods and services we want at a cost we can tolerate, at the level of inquiring into every individual customer's subjective state of mind. But they can ensure that their systems factor in decision points about consent which maximise the probability that everyone's decision at these points is fully autonomously undertaken. They can ensure that good quality, accessible, relevant and accurate information is provided about the consents engaged, they can take steps to guide the decision-making processes towards or through that information, and they can take steps to focus individuals' minds soberly and separately on the privacy consenting decision in its own right rather than distracting them with all the attractions conditional on that decision.
152. That takes us to the third strand the evidential element. If the authorities set only a modest standard for subjective consent, but a relatively high standard for the quality and autonomy of decisions about consent, they further provide some minimum evidential standards for establishing it. Not unticking a box will not do: it is too evidentially ambiguous, because it is entirely consistent with both a complete lack of subjective consent and a complete lack of any autonomous choice having been exercised the individual may simply not have noticed the box at all. But a positive and separate act of ticking a box which cannot be reached without scrolling through relevant text, and which is separate from a confirmation that the text has been read, is a piece of evidence which makes it 'far more probable' that an individual's decision about consent will be of the relevant quality. The authorities do not say it constitutes that consent. And of course it is evidence which is still consistent with a complete lack of subjective consent. It does nevertheless have a number of features capable of evidencing an autonomous exercise of choice about consent, including the autonomous choice, either way, about taking advantage of the information resources made available. It cannot, however, guarantee any quality of autonomy. The boxes might, for example, have been ticked by a third party, or by an individual under a temporary or permanent incapacity, or under a positive misapprehension, or indeed in any number of circumstances in which no fully autonomous decision by the data subject has been taken.
153. And the authorities do emphasise the fact-sensitivity of the requirement for consent in all its aspects. Where consent is disputed, the relevant factual matrix is likely to include all three elements: an individual's subjective consent, the quality of autonomy in any decisions they made about consent, and the evidential basis on which a data controller relied in proceeding on the basis of consent.
154. I cannot ignore either what is said in the authorities about the potential significance of marketing to online gambling customers, where that appears as part of the factual matrix of consent in any disputed case.
(The emphases in these passages and others I shall quote later are those of the judge).
The legal analysis applied to the facts
RTM's
evidence "of his subjective experience of gambling and of its effects on him and his wellbeing". When he gave signs of consenting to cookies he had "not in fact given his mind to the issue at all". As for direct marketing, it was more likely than not that he did something to trigger this, but his engagement with the issue may have been "to the minimum degree necessary to get on with gambling" and the judge could not make speculative assumptions.
RTM
was a
vulnerable
individual. She found that "the subjective quality of the Claimant's consents" was that (1) his consent to the use of cookies was "limited to clicking the buttons he was presented with
without giving his mind to the matter
"; (2) "not having read the material, he had limited, if any, insight into the system" by which his online behaviour was being fed into modelling so as to target marketing at him; and (3) his engagement with and responsiveness to direct marketing were "intimately bound up with his own problematic gambling behaviour and partook of its qualities."
RTM's
conduct in ticking all the boxes he was provided with whilst failing to read any of the privacy notices was fatal to his claim. She held that "the context in which the boxes were ticked both immediate and wider is part of the relevant factual matrix within which I have to judge the autonomous quality of the Claimant's decisions about signifying consent." The judge dealt with the relevant period in two parts.
178 . The engineering of the consent mechanisms in the GDPR refresh was sufficient to provide a reasonably robust evidential basis for SBG to rely on its being probable that, where the relevant boxes had been ticked, a specific autonomous choice had been taken about consenting either to give fully subjective consent or to choose to forego fully subjective consent in the knowledge of the nature and consequence of that choice and proceed on that basis. Customers had been provided with clear, accessible and relevant information, made available to them and drawn to their attention on a literally line by line basis as they scrolled through. They had been taken to separate decision points
181 all of that is consistent with an ineradicable minimum of cases where the best processes and the most robust evidential provisions do not, in fact, establish the necessary presence of autonomous decision-making, because there is specific evidence to the contrary. There is an irreducible minimum risk that, even where an individual data subject with legal capacity has clicked on the buttons, they have not done so as part of an autonomous decision-making process such as privacy law demands.
RTM's
submission that the court needed to look beyond "the risks in the system and the general probabilities" and "focus on him as an individual". She accepted his evidence that "his decision-making about matters to do with gambling was materially compromised throughout the relevant period". She identified the question on which the case might turn as whether the evidence made it more probable than not that the "absence of consent of the relevant quality" was "the product of sufficiently autonomous decision-making" by
RTM.
That had to be considered in the full relevant factual matrix, which involved "revisiting SBG's business model and what the authorities say about marketing to gamblers."
vulnerable
individuals within the industry", and the "fact that SBG was demonstrably carrying a substantial risk of marketing gambling to problem gamblers
". She held that this was "not just an ethical or regulatory but a legal risk". That was because of the legal onus on the data controller in every case to demonstrate "subjective consent of
quality" or "autonomous decision-making of the 'relatively high standard' envisaged by data protection law." This could not always be guaranteed by systems; there was "an ultimately ineradicable risk in relying on them."
201. My analysis is as follows. The relevant legislation and authorities, both European and domestic, indicate that in order to provide a lawful basis for direct marketing, and for the underlying use of cookies for that purpose, a data subject's consenting behaviour has to be of a 'relatively high' quality. That quality is expressed by reference to individual qualities such as 'free', 'active', 'informed', 'unambiguous', and 'specific' or 'distinct'. What that means in practice is highly context-specific.
202. There are measures indicated by and under the relevant statutory regimes to assist data controllers in the online gambling sector to obtain, and evidence, consenting behaviour of the necessary quality. The sector is such, however, as to carry a real rather than theoretical risk that, occasionally, those measures will not in fact succeed in producing consenting behaviour of the necessary quality, and that the evidence of it will not be reliable. That is because it carries a known and ultimately ineradicable risk that the autonomy of the consenting behaviour in question isvitiated
to some degree by problem gambling, so falls short of the relatively high quality required in law. It will be consenting behaviour which is too overborne, passive, unfocused and ambiguous, and too bound up with the craving or compulsion to access gambling, to which the consenting is experienced as a condition to be overcome, to meet the necessary legal standard.
203. In any individual case of challenge, a court needs to consider, on the evidence, and in its full context, whether or not the consenting behaviour relied on is of the necessary quality. That is clearly a highly evaluative matter. I have only the present case before me. I have accepted the Claimant's evidence of the nature and extent of his decision making, and looked at all the evidence of the nature and context of his consenting behaviour towards SBG. I have found he lacked subjective consent. I am also satisfied that the autonomous quality of his consenting behaviour was impaired to a real degree. I have no doubt at the same time it is possible to imagine even worse cases of problem gambling, and even worse cases of impaired consent. Nevertheless the standard looked for is relatively elevated. On balance and it may be a fine balance my conclusion is that, on the particular evidence and facts of this case, the quality of this Claimant's consenting was rather lower than the standard required where processing personal data for the purposes of direct personalised marketing is concerned, throughout the relevant period, because of his gambling problem and his associatedvulnerability
and compromised autonomy.
204. It was insufficiently freely given, in particular. The Claimant's consenting behaviours proceeded directly from a damaged and defective condition of personal autonomy with which the acts of consenting were inextricably and intimately bound up. The circumstances of his consenting behaviour are not recognisable as amounting to free, unambiguous, informed, specific, or distinct from the uncontrolled craving to gamble. Standards of consent set in data protection law are not insensitive to that sort of context. On the contrary, they can be recognised as requiring a 'relatively high' and context-specific standard of consent precisely because of the need for it to be especially incontrovertible before it can be relied on, when the processing of personal data not only invades privacy and compromises autonomy but proceeds from compromised autonomy of thevery
same nature.
205. It follows that I am required to hold that, in this particular case, (a) SBG's use of cookies for the purposes of personalised direct marketing to the Claimant and (b) SBG's direct marketing to the Claimant were not lawful processing. In those circumstances, I do not need to give distinct consideration to the question of the distinct lawful basis for profiling the Claimant for the purposes of direct marketing. The profiling was parasitic on the obtaining of the data and the ultimate delivery of the marketing, and had no other standalone purpose so far as he was concerned; it necessarily discloses no distinct basis for lawful processing.
The appeal: grounds 1 and 2
(1) The judge erred in deciding the issue of whether
RTM
had
validly
consented to receive direct marketing from SBG based on a case which
RTM
himself never put before the court.
RTM
had never claimed that his (alleged) status as a gambling addict meant that his consent to direct marketing was legally ineffective. It was impermissible to proceed on the basis that the gambling addiction was not only relevant to but determinative of the consent issue.
(2) The judge took the wrong approach in law to the core issue of what amounts to legally
valid
consent for the purposes of PECR and the data protection legislation. The judge's focus on the impact of
RTM's
problem gambling on his decision-making ability cannot be reconciled with legal principle and leads to extreme results which the legislators cannot have intended. The judge's approach suggests that it is impossible for online gambling service providers and others to design systems that are comprehensively compliant with the data protection legislation and PECR.
Ground 2: the correct approach to consent
v
Entry Clearance Officer, UK
Visa
Section (Case C-129/18), [2019] 3 CMLR 16 [50]; Planet 49 [47]. Secondly, the interpretation cannot be one that depends on the circumstances of a particular case or category of case. The application of the concept of consent may depend on the context. For instance, a statement that would be "unambiguous" when made to an adult audience might not have that quality when made to children. But the concept of consent must be uniform for all purposes, regardless of the particular factual matrix of the individual case, or the business or other context in which the question is raised.
The language of the legislation
The case law
validly
gave his or her consent to the storage of cookies": Planet 49, [58]-[59].
valid
consent was no more than a description of the principles I have summarised above. And in Cooper, to which the judge was not referred, this court expressly held that the notion of consent is "an objective one, which depends on the outward manifestation of consent by the data subject". It is fair to say, as Mr Knight has pointed out on behalf of
RTM,
that the ratio decidendi of this aspect of Cooper is that consent was given unambiguously by contract. It does not appear that the issue now before us was argued. The decision may not be binding authority on that issue. But in my judgment the court's analysis was correct. It is also consistent with authoritative guidance and with the stated purposes of the legislation.
The guidance
(1) "... consent can only be
valid
if the data subject is able to exercise a real choice, and there is no risk of deception, intimidation, coercion or significant negative consequences (eg substantial extra costs) if he/she does not consent." : WP29 Guidelines 10 April 2018, ¶3.1.1.
(2) "Generally, consent can only be an appropriate lawful basis if a data subject is offered control and is offered a genuine choice with regard to accepting or declining the terms offered ... The element 'free' implies real choice and control for data subjects.": EDPB Guidelines 05/2020 on consent under [the GDPR]
version
1.1, ¶¶3, 13.
(3) "Recital 43 clearly indicates that it is unlikely that public authorities can rely on consent for processing as whenever the controller is a public authority, there is often a clear imbalance of power in the relationship between the controller and the data subject.... Imbalances of power ... may also occur in other situations ... Consent will not be free in cases where there is any element of compulsion, pressure or inability to exercise free will": EDPB Guidelines (above) ¶¶16, 24.
(4) "When is consent inappropriate? ... if for any reason you cannot offer people a genuine choice over how you use their data, consent will not be the appropriate basis for processing. This may be the case if, for example ... you are in a position of power over the individual for example, if you are a public authority or an employer processing employee data": the ICO's guidance on Consent
v
1.0.36, 17 October 2022, p11.
(5) "What is 'freely given'? Consent means giving people genuine choice and control over how you use their data. If the individual has no real choice, consent is not freely given and it will be invalid ...": the ICO's Guidance (above) p 21.
(6) "What do you mean by power 'imbalance'? Power imbalance refers to the nature of the relationship between an organisation and the people whose personal information they are processing. ... Where there is a clear power imbalance, people may not have a realistic choice about consenting to personalised advertising to access a product or service ... A clear power imbalance can arise from a
variety
of different factors that affect the relationship between you and the people whose personal information you process ... Some groups of people may be in a more
vulnerable
position ... ": the ICO's guidance on Consent or Pay,
v
1.0.4, 21 January 2025, pp 19-20.
Purposes and Recitals
various
points in her judgment, the legal regime is one that seeks to strike a balance between commercial freedom and individual rights. But as she also noted at [151] the balance struck must be a "pragmatic" and "workable" one. The court should not interpret the legislation in a way that has consequences that are impractical and which the legislature is unlikely to have intended.
RTM,
suffers from a gambling addiction, of which the data controller does not and cannot know, which impairs the user's ability to give subjective consent or compromises his genuine autonomy or both. In any such case the data controller's conduct would be contrary to PECR. Absent another lawful basis, the data controller's processing would also be unlawful. Compensation would probably be recoverable.
vulnerabilities,
or other conditions or circumstances, unknowable by the data controller, that disable the individual data subject from making a free choice. Examples given during argument on this appeal included a third party blackmailing the data subject, putting a gun to their head, or subjecting them to other coercive and controlling behaviour.
Legal and practical certainty
view,
the unsatisfactory and ultimately opaque nature of the test for legally effective consent which the judge applied. For SBG, Ms Proops KC submitted that, upon close examination, the judge's three-stranded test collapses into a single subjective test. I think that is correct. The second strand, although labelled autonomy, is a subjective test of a different kind. The question raised by the third strand is, in substance, whether the evidence establishes the probable existence of subjective consent of the first or the second kind.
RTM
possessed legal capacity to consent. She found that he performed deliberate acts which indicated a wish to do so and as I read the judgment that he did in fact subjectively desire to consent, so that he could continue gambling. She accepted that
RTM
"wanted the direct marketing material even perhaps craved it". And yet she found there was no "freely given" consent and hence none that was legally effective. That conclusion did not flow from any finding of deception, oppression, or the like on the part of SBG. It was based on
RTM's
state of mind,
variously
described as involving compromised or impaired decision-making and autonomy.
vitiated
for lack of consent is legally novel. In general, unwise or even irrational decisions made by individuals with capacity are considered legally binding. The contours of this novel principle are not clear to me. The suggestion appears to be that, in the present context, consent may be lacking where the data subject "does not turn his mind to" the issue, or where there are deficiencies in the "rationality of ... decision-making". That would seem to cut across established rules, and to my mind lacks appropriate precision. Reference to the "quality" of
RTM's
consent, and findings that it was "
vitiated
to some degree" and "insufficiently freely given", imply the existence of some kind of scale. There is a finding that consent in this case fell short. But neither the units of measurement nor the threshold can be clearly identified.
RTM's
consent, the judge took account of her findings about the quality of SBG's consenting mechanisms; but this seems to have been a multi-factorial approach. The findings do not include any clear conclusion that the consent given fell short of any of the other specified criteria - save perhaps for what was said about consent to cookies in the first part of the relevant period. It appears to me that the judge's approach brought together the four criteria as strands of a single overarching evaluative test. I would readily accept that they are inter-related, but in my judgment the legislative language and the authorities show that they are distinct criteria to be assessed and evaluated individually.
The regulation of online gambling
RTM
gave consent that was legally effective. At a general level, I agree with that. The authorities indicate that the purposes for which consent is sought, how that is done, and the context in which it is done, must all feed into an assessment of whether, considered objectively, the resulting indication of the data subject's wishes probably was freely given, informed, specific and unambiguous. The regulatory environment in which the data controller is operating, the kinds of people with whom the data controller is dealing, and the risks of the particular kind of business, are aspects of the factual picture that may be relevant for these reasons. They could, for instance, dictate the use of especially simple and clear language. Beyond this, however, I do not agree with the judge's approach to this part of the case.
vulnerable
to gambling-related harm and could not give "consenting
of the standard required". That risk could be addressed through regulatory measures imposed by the Gambling Commission and by the ICO, and
via
SBG's own systems, policies, and processes; but none of these was effective to eliminate, or even capable of eliminating the risk and amounting to "a complete insurance policy". SBG was well-equipped to minimise the risk and had a "reasonable care" defence available to it under PECR 30(2). Having regard to the provisions of Recital 43, there was a "clear imbalance" between SBG and
RTM,
who was a problem gambler with a "need" for SBG's services, and marketing was not a "necessary" part of providing online gambling services. Taking all these matters into account, the conclusion was that consent of the necessary quality had not been obtained.
(1) The judge's starting point was a finding that there are inescapable shortcomings in the ability of regulatory or commercial measures to safeguard problem gamblers. That may be so. It does not follow, however, that data protection law must step in. I can certainly see the force of SBG's contention that the concept of consent should not be shaped and moulded with a
view
to filling this gap, thereby affording the customer the "complete insurance policy" to which the judge referred. That would involve trespass into a field that properly belongs to the legislature.
(2) I do not believe that Regulation 30(2) of PECR has any bearing on the question at issue. First, Regulation 30(2) provides a defence to compensation but no answer to liability. Secondly, Regulation 30(2), like s 13(3) of the DPA 1998, is a purely domestic provision. Neither has any equivalent in its parent Directive. There is no such defence in the GDPR; Article 82 is quite different and far more limited, on any
view.
The meaning given to consent in EU data protection law cannot be determined by individual domestic provisions; it must be autonomous. Indeed, the concept must have the same meaning in domestic data protection law which gives effect to EU legislation, or is intended to do so. So the fact that SBG might have a reasonable care defence to a compensation claim under the DPA 1998 or PECR could not affect the answer to the question we are considering.
(3) The judge's approach to Recital (43) of the GDPR was, in my opinion, flawed. She did not directly apply the language of the recital but used elements of it as factors in her reasoning. On the issue of "clear imbalance" she took an individualised, case-specific approach, reliant on the circumstances of
RTM.
As I have indicated, I do not agree with that interpretation of the legislation. The judge did not find, and I do not believe, that there was a "clear imbalance" in the structural relationship between SBG and its customers generally. As for the second part of Recital (43), I am not persuaded that this - or the related provisions of Article 7(4) - can be applied to the facts as found in this case. SBG accepts that its methods of obtaining consent to cookies in the first part of the relevant period were inadequate. But this was not a case in which the performance of a contract for gambling services was made "dependent on" consent to marketing.
RTM's
analysis of the judgment
RTM,
Mr Knight submitted that the judge was not wrong to identify subjective aspects within the test for consent. He characterised the approach of SBG and ICO as "reductive", "compartmentalised", and insufficiently nuanced. He pointed to some passages in the Guidelines to support a contention that subjective considerations can play a part. For the reasons already given, I have taken a different
view.
RTM's
indications of his wishes satisfied each of the individual legislative criteria, and she did not do so.
The relevance of the data controller's state of mind
vulnerable
due to gambling addiction or the like that could create the "clear imbalance of power" referred to in Recital 43, thus making it "unlikely" (absent further enquiries) that the data controller would be able to demonstrate that consent was freely given. This is an argument that was not addressed below. As I have noted, it has not been adopted by Mr Knight on behalf of
RTM.
I have not been able to accept it, for multiple reasons.
(1) This analysis adopts the individualised approach to the "clear imbalance of power" criterion with which I have already expressed my disagreement.
(2) Relatedly, this argument places a lot of weight on the notion that an imbalance of power is "clear" if it is manifest to the data controller in the context of the specific relationship with an individual data subject. I do not think that is what the objective approach requires.
(3) Any such qualification would significantly undermine the objective approach. It would also be impractical. This approach would involve the introduction of not just one but two subjective tests. The court or other decision-maker considering whether the necessary consent was present would need to determine (a) whether the data subject (i) had a gambling disorder or other condition that (ii) materially impaired their ability to give consent, and (b) whether the data controller knew this to be so. This is a complex set of questions.
(4) The burden of proof would mean that at least if the data subject raised the issue the data controller would bear the onus of establishing negatives: that the data subject's decision-making ability was not impaired or, if it was, that the data controller neither knew nor ought to have known this was the case.
(5) This approach would seem to carry with it most if not all of the problems of legal and practical uncertainty to which I have referred above.
(6) The legislative context tends to count against this analysis. Besides the points already made, there is Article 8 of the GDPR. This makes specific provision for the marketing of information society services to children. For those under 16, or such lower age as is specified in domestic legislation, a data controller can rely on consent as a lawful basis for such marketing "only if consent is given or authorised by the holder of parental responsibility" and the data controller must "make reasonable efforts to
verify"
that this has been done. The implication is that such efforts would not otherwise be required.
(7) Finally, I am not convinced that the suggested departure from the objective approach is necessary or warranted in order to address the concerns that evidently underlie this aspect of the submissions for SBG and the ICO.
vulnerable
gamblers, and those of data subjects generally, the greatest degree of protection consistent with the competing commercial imperatives recognised in the Recitals to the GDPR. Those are legitimate aims. But I do not consider them sufficient to justify an interpretative approach that is unsatisfactory for the reasons I have given. And I think it likely in any event that these concerns could be accommodated in other ways.
RTM
has not put his case this way but, for instance, if the data subject makes it known to the data controller that he suffers from some affliction that casts real doubt on his ability to make free choices, any indication of his wishes might not count as "unambiguous". Or it might be argued that the processing of personal data would not be "fair" if undertaken at a time when the data controller knew or should have known that the data subject was suffering from some disability or external factor that overbore their will or compromised their ability to choose. If such an issue arose, the court could consider whether there was a breach of a code of conduct promulgated by the Gambling Commission for the purpose of protecting "
vulnerable
persons" from harm or exploitation.
Conclusion on Ground 2
RTM
did not give consent to the provision of marketing and the processing of his data by SBG was wrong because of a legally mistaken approach to the issue of what needs to be proved to establish that the data subject "gave consent" with the specified characteristics.
Ground 1: Procedural fairness
viewing
the issues.
Ltd
v
Burton [2021]
EWCA
Civ
287 [36] and Al-Medenni
v
Mars UK
Ltd
[2005]
EWCA
Civ
1041 [21]. For present purposes it is not necessary to undertake any elaborate analysis of the jurisprudence. It is enough to say that an issue ought not to be decided against a party unless they have had a fair opportunity to address the court's reasons for reaching that decision. Whether that has been done will be an intensely fact-specific question.
RTM's
case, which I have outlined above. Nor, with respect to the argument advanced by Ms MacLeod (who addressed us for
RTM
on this part of the case), did SBG's case raise the issue of whether
RTM
gave subjective consent. The furthest SBG went in the direction of raising
RTM's
state of mind as an issue was by cross-examining him and advancing submissions in closing to the effect that he "wanted" the direct marketing that SBG provided. But this was aimed at rebutting
RTM's
factual case that, whatever SBG's records might suggest, he had done nothing to indicate his consent to such marketing. SBG did not advocate a subjective test of consent. The three-part subjective analysis was entirely of the judge's own devising.
Ground 3: consent to direct marketing
RTM
gave consent to receiving direct marketing communications. The first issue is whether the judge found that he did or that he did not give such consent. If the judge found that he did, this ground falls away. If the judge found that "factual consent" was lacking, the second issue arises: was that a conclusion that was open to the court on the evidence, applying the relevant standard of proof? SBG's case is that this conclusion was not open to the court, and it points to the word "eliminable" in the judge's paragraph [124] in support of a submission that she applied an elevated standard of proof.
RTM
did give "factual consent" in the way alleged by SBG. I have set out or summarised the judge's reasoning at [38] and [42] above. She found as a fact that
RTM
gave SBG an indication of his wishes that signified his agreement to direct marketing. She could not definitively state how he gave that indication. But certainty was not required. The answer was not speculative. On the evidence the obvious, or at least the most likely, way in which
RTM
indicated his wishes was by ticking a box to opt in. The evidence and argument disclosed no other way in which he might have done so. The judge should have found that this is what he did.
Grounds 4 and 5: cookies, profiling and causation
RTM
personalised direct marketing communications. The effect of the relevant evidence was that SBG did not use cookies or cookie-derived data to create or deliver the particular personalised direct marketing communications which it sent to
RTM
and about which he complains.
RTM
for direct marketing purposes was necessarily unlawful. It is said that those findings were parasitic on the court's erroneous conclusions on the issue of consent (Grounds 1 and 2), on the relevance of cookie placement to the personalisation of direct marketing (Ground 4), and on a misunderstanding of the concession made by SBG as to the circumstances in which it could rely on legitimate interests as a lawful basis for profiling its users for marketing purposes.
RTM
did not complain of marketing of this kind. His complaints about marketing related to "direct marketing communications by email and telephone" (RAPoC paragraph 27.1) and "targeted special offers through direct marketing and on the [SBG] websites" (paragraph 27.2). The submissions at trial were to similar effect. There was no evidence that information derived from cookies was used for these purposes. The evidence was that SBG's user profiles were constructed in other ways, mainly based on data derived from the user's transactions.
Conclusions
RTM.
On any
view,
the case must be remitted to the High Court. I do think, however, that the scope of the remission required will need to be the subject of further submissions.
very
full documentation and two full days of argument on this appeal. If the other members of the court agree, we have now identified the legal test for consent.
RTM's
gambling addiction, and what if anything SBG knew or should have known about it, are not relevant for that purpose. I think it arguable that we could, using the judge's findings and the undisputed facts, decide the issues with which SBG's grounds 2, 3, 4 and 5 are concerned.
RTM
still has claims that SBG's processing of his data was unfair, and infringed other data protection principles, that remain to be resolved. But it might be said that the overriding objective is in favour of us deciding such issues as we fairly can.
views
upon them. The two issues are (1) whether, if the judge's legal analysis is put to one side and the issue is approached objectively, it is more likely than not that the indication of wishes that
RTM
gave on 26 July 2017 was "informed, specific, unambiguous and freely given"; and (2) whether paragraph [178] of the judgment should be
viewed
as a finding that, objectively
viewed,
it was probable that SBG's practices following the GDPR refresh would mean that indications of consent given by data subjects were legally effective. In the light of the parties' submissions since circulation of the draft I shall reserve my judgment on these points, and which court should decide them, until after further argument.
LORD JUSTICE LEWISON:
DAME
VICTORIA SHARP, P: