RTM v Bonne Terre: Court of Appeal rules that consent under data protection law is an objective test

The Court of Appeal has handed down a significant judgement on the nature of consent in data protection law, overturning a High Court decision that had introduced a subjective and autonomy-based framework for assessing whether a data subject had validly consented to cookies, data processing, and direct marketing communications.

In RTM v Bonne Terre Limited & Anor [2026] EWCA Civ 488, the respondent — a problem gambler anonymised as RTM — had sued Sky Betting and Gaming (SBG) for compensation, alleging that its use of cookies, processing of his personal data, and targeted direct marketing were unlawful throughout a two-year period ending in early 2019. At first instance, Collins Rice J found that RTM had not given legally operative consent, applying a three-part test of her own construction that incorporated subjective consent, autonomous decision-making, and minimum evidential standards.

The Court of Appeal, comprising Dame Victoria Sharp P, Lord Justice Lewison, and Lord Justice Warby, allowed the appeal on all five grounds.

The legal test for consent

Lord Justice Warby, giving the leading judgement, held that consent under Article 4(11) of the UK GDPR — equally applicable under the DPA 1998 and PECR — is constituted by an outward act, not a subjective state of mind. To establish consent, a data controller must demonstrate that the data subject made a statement or took a clear affirmative action amounting to an "indication" of their wishes that "signifies agreement" to the relevant processing. These are entirely objective questions.

The four statutory criteria — freely given, specific, informed, and unambiguous — are likewise objective in character. Whether an indication meets those criteria turns on the nature and quality of the communications between the parties and the structural character of their relationship, not on what was actually passing through the data subject's mind at the time.

The court drew support from the CJEU's decisions in Planet 49, Orange Romania, and Meta Platforms, all of which focused on the external circumstances of consent rather than individual subjective states. The Court of Appeal's own decision in Cooper v National Crime Agency [2019], not cited below, was noted as express authority for consent being "an objective one, which depends on the outward manifestation of consent by the data subject."

Why the High Court's approach could not stand

The trial judge's framework would have meant that no data controller could ever guarantee compliance with the consent requirements, since an individual data subject might always harbour an undisclosed condition — a gambling addiction, or otherwise — capable of vitiating their apparent agreement. Lord Justice Warby rejected this as inconsistent with the legislative balance between data protection rights and commercial freedom, and incompatible with the requirement in Recital 7 to the GDPR that the framework deliver "legal and practical certainty" for economic operators.

Equally, the court declined to accept the alternative argument advanced by SBG and the ICO — that actual or constructive knowledge by a data controller of a data subject's vulnerability should bear on whether consent is established. Importing two further subjective enquiries into the analysis would carry most of the same difficulties and was not supported by the legislative language.

Remission and outstanding issues

The judgement on liability was set aside and the matter remitted to the High Court. RTM's remaining claims — including alleged breaches of the fairness principle and other data protection obligations — have yet to be resolved. The Court of Appeal reserved its position on whether it could itself determine, on the basis of the trial judge's findings, whether the indications of consent given by RTM were objectively valid, and on which court should address those questions following further argument.