RTM v Bonne Terre Ltd & Anor [2026] EWCA Civ 488 (21 April 2026)
- Citation
- [2026] EWCA Civ 488
- Status
- Judgment
- Jurisdiction
- England and Wales
- Posture
- Appeal (civil) / Court of Appeal Judgment on Appeal From High Court (king's Bench Division, Media and Communications List)
More details
- Posture
- Appeal (civil) / Court of Appeal Judgment on Appeal From High Court (king's Bench Division, Media and Communications List)
On this page
Professional case brief
Research organized from the available case record
01
Holding and result
Consent for the purposes of GDPR, PECR, and related legislation is an objective concept, requiring an outward, affirmative indication of agreement that is freely given, specific, informed, and unambiguous. The subjective state of mind or vulnerability of the data subject is not determinative unless known to the data controller. The High Court judge erred in law by treating RTM's gambling addiction and impaired autonomy as vitiating consent, and by deciding the case on a basis not argued by the parties. The appeal is allowed and the High Court's decision on liability is set aside.
Court disposition
Appeal allowed; High Court decision on liability set aside; remittal for further consideration of issues and consequential orders.
Orders
- High Court's decision on liability is set aside.
- Parties to make submissions on issues to be remitted and consequential orders.
02
Material facts
Parties
RTM
Claimant/respondent Counsel: Christopher Knight, Jennifer MacLeod and Aarushi SahoreBonne Terre Limited
Defendant/appellant Counsel: Anya Proops KC and Robin HopkinsHestview Limited
Defendant/appellant Counsel: Anya Proops KC and Robin HopkinsThe Information Commissioner
Intervener Counsel: Heather Emmerson and Jack SteeleAmounts and remedies
- Relevant Period (years): 2
03
Procedural history
Posture
Appeal (civil) / Court of Appeal Judgment on Appeal From High Court (king's Bench Division, Media and Communications List)
04
Questions and positions
Legal issues
- 01
What constitutes valid consent for cookies, personal data processing, and direct marketing under GDPR, PECR, and related legislation?
- 02
Is the test for consent objective or does it include a subjective element based on the individual's state of mind or vulnerability?
- 03
Did the High Court judge err in law by focusing on the claimant's gambling addiction and impaired autonomy as vitiating consent?
Party arguments
- Applicant
- SBG argued that the test for consent is objective, based on the outward manifestation of the data subject's wishes, and that the judge erred by focusing on RTM's subjective vulnerability. SBG also contended that their systems and processes provided sufficient opportunity for users to give or withhold consent, and that the judge's approach would make compliance unworkable.
- Respondent
- RTM argued that, even on an objective analysis, the judge's findings of fact supported the conclusion that valid consent was not given. RTM maintained that the evidence showed he did not provide informed, specific, or freely given consent, and that SBG failed to demonstrate lawful processing.
05
Court’s reasoning
Legal principles
- 01
GDPR Article 4(11), Article 7; PECR; CJEU case law (Planet 49, Orange Romania, Meta Platforms)
Consent under GDPR and PECR must be a freely given, specific, informed, and unambiguous indication of the data subject's wishes, signified by a statement or clear affirmative action.
- 02
GDPR, PECR, CJEU case law, Cooper v National Crime Agency [2019] EWCA Civ 16
The test for consent is objective, focusing on the quality and context of the indication given, not the subjective state of mind or vulnerability of the data subject.
- 03
GDPR Article 7(1); CJEU case law
The data controller bears the burden of proving that valid consent was given, to the balance of probabilities standard.
- 04
Court of Appeal reasoning; CJEU case law
Where consent is disputed, the court must assess the objective evidence of the indication and the context, not the individual's internal state or vulnerabilities unless the controller knew or ought to have known of such vulnerabilities.
06
Ratio, limits and disposition
Ratio decidendi
Consent for the purposes of GDPR, PECR, and related legislation is an objective concept, requiring an outward, affirmative indication of agreement that is freely given, specific, informed, and unambiguous. The subjective state of mind or vulnerability of the data subject is not determinative unless known to the data controller. The High Court judge erred in law by treating RTM's gambling addiction and impaired autonomy as vitiating consent, and by deciding the case on a basis not argued by the parties. The appeal is allowed and the High Court's decision on liability is set aside.
Obiter and limits
- The existence of vulnerabilities such as gambling addiction may be relevant if the data controller knows or ought to know of them, but this was not the case here.
- The legislative and regulatory context for online gambling recognises the risks to vulnerable individuals, but data protection consent remains an objective standard.
- The court invites submissions on remittal and consequential orders.
Court disposition
Appeal allowed; High Court decision on liability set aside; remittal for further consideration of issues and consequential orders.
- High Court's decision on liability is set aside.
- Parties to make submissions on issues to be remitted and consequential orders.
Source and reliance status
Official court record
This page organises the available record for research. Confirm quotations, current status, and subsequent treatment against the official source before relying on the case.
Judgment reading view
Judgment text
The complete available source text.
Full judgment text is not available for this record.
Case-aware research
Ask AI about this case
The judgment and available research above are public. New questions open in a separate private conversation grounded in this case.