RTM v Bonne Terre Ltd and Hestview Ltd

CASE CITATION AND BASIC INFORMATION

Case: RTM v Bonne Terre Ltd and Hestview Ltd

Citation: [2026] EWCA Civ 488; on appeal from RTM v Bonne Terre Ltd and Hestview Ltd [2025] EWHC 111 (KB)

Court: Court of Appeal (Civil Division)

Case No: CA-2025-000651

Date of decision: 21 April 2026

Bench: Dame Victoria Sharp, President of the King’s Bench Division; Lord Justice Lewison; Lord Justice Warby

Intervener: The Information Commissioner

Lead judgment: Lord Justice Warby

INTRODUCTION

This case is based on the meaning of the consent under data protection and electronic marketing legislation, related to online gambling. RTM is the claimant and he was one of the habitual gambler who claimed that the defendants, who owned online gambling and betting services named Sky Betting and Gaming (SBG), who processed his personal information utilised cookies illegally, tracked him and sent him targeted marketing information. The high court gave decision in favour of RTM, stating that his vulnerability and impaired autonomy meant that his consent was not legally taken. Afterwards the court of appeal rejected this decision and held that the legal test for consent is objective rather than subjective. This ruling is important because it makes clear that a controller does not typically have to look into a persons’s real mental state in order to estabilish consent. Additionally it also states the significance of procedural justice and the need to distinguish the legal test for consent from more general issues related to fairness, vulnerability and lawful processing.

FACTS OF THE CASE

RTM was a customer of SBG, a provider of online gaming and betting. During the period, he had some problem with gambling but in early 2029 he overcame that issue and over 2 years before ethe proceedings took place. During this period SBG processed RTM’s personal data, installed cookies on his device/ browser and sent him target marketing messages. Furthermore, RTM continued using the services and incurred substantial amount of loss. After that, he brought proceedings against SBG’s activities, alleging that because of the marketing messages he gambled more and lost more money than he otherwise would have not lost, resulting in financial loss and distress.

Furthermore he claimed that SBG made a systematic profile of all the personal data, tracked his activities on website using cookies and shared information with other providers. He claimed that these activities violated the GDPR, Data Protection Act of 1998 and the Privacy and Electronic Communications (EC Directive) Regulations 2003 (PECR). Along with this he raised complaints about fairness, transparency., purpose, limitation, data minimisation and storage, and alleged that information about his gambling would qualify as special category data.

The main subject was the case was consent. When RTM activated his account in the month of April 2017, a screen was displayed stating that the website uses cookies and constitutes consent to cookies, and he clicked on accept and close. This screen contained a link to SBG’s cookie policy, but there was no evidence that he read that policy. It also stated that it will send direct marketing messages to the customer unless they opt out the communications. In the start RTM did not receive any marketing messages but later in April 2017, SBG started sending the messages. Moreover SBG relied on an internal document that showed RTM had opted out and modified the marketing preferences. Based on this RTM rejected the evidence which supported the alleged consent and did not recall doing so.

In 2018, the customers were asked to reevaluate their consent policy and SBG conducted GDPR Refresh. The records showed that he ticked all the relevant boxes confirming acceptance of revised terms, privacy and cookie notices and continued with the marketing preference. RTM claimed he did not read the pertinent policies and could not recall finisbing these processes.

The High Court viewed the consent as crucial on determining the liability.Collins Rice J concluded that SBG’s actions during the relevant period were illegal since RTM had not provided legally opertaive consent. Based on this deciison the SBG appealed and the Information Commissioner intervened.

LEGAL ISSUES

The court of appeals main issues were:

What constitutes valid consent under UK data protection law, particularly in the context of targeted marketing to vulnerable individuals?

Whether the High Court committed procedural injustice by establishing liability based on a legal analysis of subjective consent that the parties had not adequately presented or addressed during the trial.

ARGUMENTS PRESENTED

5.1 Appellant’s Arguments

SBG contended that by considering permission based on RTM’s subjective mental state and independent decision making, the High Court had taken a legally incorrect stance. According to the applicable statutory provisions, it was necessary to objectively determine if the data subject had provided an indication of preferences showing agreement and whether that indication was unambiguous, specific, informed, and voluntarily given. This essentially objective approach was supported by the Information Commissioner.

Additionally, SBG contended that the High Court acted unfairly by failing to state the argument that RTM’s gambling addiction made his consent legally void. The judges’s three part test was based on own criteria and had not been properly addressed by the parties.

Regarding the factual issue of direct marketing, SBG argued that RTM’s opt-in was backed by the evidence. It further challenged the High Court’s findings about the utilisation of cookies and the connection between cookie derived data, profiling, and the specific messages of direct marketing that RTM received.

In the end, SBG questioned the finding that its profiling was simply illegal. It contended that the concession on a gaming operator’ s ability to rely on legitimate interests when it knew or had reasonable suspicions that a customer was a problematic gambler had been misinterpreted by the High Court.

5.2 Respondents Argument

RTM tried to uphold the ruling of the High Court. He claimed that the judge’s reasoning should be viewed in every aspect and that her factual conclusions were adequate to prove that his apparent consented action did not meet the legal standards. He relied on the circumstances accompanying his apparent permission, the quality of the information provided to him, and the background of his gambling issue.

Additionally, RTM argued that SBG had not sufficiently shown how consent had been obtained and what details had been provided to him during the consent process. As a result, his case focused on the quality and supporting evidence of SBG’s alleged consent.

The alternative argument put forth by SBG and the ICO, according to which a controller’s constructive or actual awareness of a person’s vulnerability should by itself qualify the objective test for consent was finally rejected by RTM. As a result, the Court of Appeal independently examined and dismissed that claim.

COURT’S REASONING AND ANALYSIS

In RTM v. Bonne Terre Ltd and Hestview Ltd [2026] EWCA Civ 488, the question was whether a problematic gambler had given their legal consent under data protection law to an online gambling operator’s use of cookies, profiling, and personalised direct marketing. RTM claimed that SBG’s processing of his personal data and targeted marketing led him to gamble and lose more money since he was a problem gambler during the relevant period. The High Court ruled that SBG’s actions were illegal because he had not provided legally operative consent. The Information Commissioner intervened after SBG filed an appeal.

The key issue was whether consent should be evaluated impartially or in consideration of the autonomy and mental health of the data subject. Because of his gambling condition, the High Court determined that RTM’s consent was not sufficiently free, informed, precise, and unambiguous. The Court of Appeal rejected this approach, ruling that consent is evaluated objectively in accordance with GDPR Article 4(11). The court rejected amending the standard based on a controller’s awareness of gambling addiction, and controllers have no obligation to establish a person’s true state of mind or risk.

The High Court’s decision on liability based on a legal analysis that had not been well challenged made the process unfair, which is another reason the appeal was granted. The Court of Appeal further ruled that the High Court misinterpreted about the function of cookies and profiling, and that the evidence supported a finding that RTM had factually consented to direct marketing. The evidence did not prove that the specific marketing that was objected about used data collected from cookies.

The Court of Appeal dismissed this, granted the appeal on all five grounds, and sent the matter back to the High Court. The court stated that risk might still be relevant to fairness and other regulatory responsibilities, therefore it was not irrelevant to data protection in general.

JUDGEMENT AND RATIO DECIDENDI

The Court of Appeal granted the appeal on all five grounds, overturned the High Court’s ruling in favour of RTM, and held that the case should be remanded to the High Court. The court emphasised that the remaining claims pertaining to fairness and other data protection principles had not necessarily been resolved.

The ratio decidendi is that consent is assessed impartially in accordance with applicable data protection and electronic communications laws. A controller must demonstrate that the data subject freely provided a clear, specific, informed, and unambiguous statement or affirmative action expressing consent to the relevant processing or marketing. The controller is not required to evaluate whether personal vulnerability hampered autonomous decision making or to demonstrate the data subject’s true subjective state of mind.

8. CRITICAL ANALYSIS

8.1 Significance

By rejecting a broad, subjective definition of consent, the ruling makes a significant contribution. The High Court’s approach might have turned consent into a psychological examination of the person. Instead, in accordance with Cooper and the language of the statute, the Court of Appeal re established a more manageable objective framework. Because consent is usually assessed by looking at the communication and circumstances accompanying it rather than constructing an individual’s internal state years later, this gives controllers more confidence.

The judgment’s clarification of vulnerability limits as a component of consent makes it noteworthy as well. The need for legal protection for vulnerable people was acknowledged by the Court of Appeal. Instead, it maintained that the legal concept of whether consent was given should not always include vulnerability.

8.2 Implications and impact

The judgement is especially significant for online companies that use direct marketing, cookies, and profiling. Controllers cannot rely solely on passive behaviour and must continue to provide valid consent. The four requirements of the statute which are, free, specific, informed, and unambiguous remain crucial.

However, the ruling makes a significant distinction for the gambling industry. The court made it clear that the objective question of whether permission had been provided did not depend on gambling addiction or what the operator knew or should have known about it. However, these circumstances might still be applicable to other claims, such as those regarding fairness, transparency, and adherence to gambling regulations. Therefore, the ruling does not invalidate a vulnerability’s legal significance, rather, it places it outside of the fundamental objective consent requirement.

8.3 Critical Evaluation

The judgment’s main positive aspect is its focus on legal certainty. A subjective approach would result in significant evidentiary and practical challenges for digital businesses seeking consent electronically. Excluding individual autonomy, however, contradicts the need that permission be freely given, particularly in situations when freedom of choice is impacted by vulnerability. In order to maintain protection without implementing a subjective consent test, the Court of Appeal suggested that vulnerability might instead be relevant to fairness or other regulatory responsibilities. The case also emphasises procedural justice, courts should not determine liability based on legal arguments that parties were not given enough time to present.

CONCLUSION

According to RTM v. Bonne Terre Ltd. and Hestview Ltd., consent is evaluated objectively under data protection and electronic communications law based on a clear indication of agreement that satisfies legal standards. Although it may nevertheless be important for fairness and regulatory obligations, vulnerability is not a factor of the consent test in and of itself. The ruling has several questions unanswered while maintaining a balance between individual protection and legal certainty.

10 REFERENCE(S):

Cases

Cooper v National Crime Agency [2019] EWCA Civ 16.

Leave.EU v Information Commissioner [2021] UKUT 26 (AAC).

Meta Platforms Inc v Bundeskartellamt (Case C-252/21) [2023] 5 CMLR 22.

Orange Romania SA v ANSPDCP (Case C-61/19).

RTM v Bonne Terre Ltd and Hestview Ltd [2025] EWHC 111 (KB).

RTM v Bonne Terre Ltd and Hestview Ltd [2026] EWCA Civ 488.

Verbraucherzentrale Bundesverband eV v Planet49 GmbH (Case C-673/17) [2020] 1 CMLR 25.

Legislation and Other Materials

Data Protection Act 1998.

General Data Protection Regulation (EU) 2016/679, arts 4(11), 5, 6, 7, 8 and 82.

Privacy and Electronic Communications (EC Directive) Regulations 2003, regs 6, 22 and 30.

Gambling Act 2005.