Specifically, the ICO guidance notes that data protection law does not require a controller to determine the state of mind of an individual giving consent and that consent may still be valid, even if the controller knew of a particular vulnerability of the individual. The key is whether the individual is legally capable of giving an objective indication of consent.
However, the ICO does point out that, even if there is an objective indication of consent, there may be circumstances when a controller cannot rely on that consent to process personal data if the controller knows (or ought reasonably to know) that the individual is in a vulnerable situation. In that case, the processing of personal data may not be considered fair, and a key data protection principle would not be met.
Does this shift the dial?
Stepping back, although a known vulnerability may not affect the technical validity of consent, it may have a bearing on whether processing is more generally fair and so impact the ability of a controller to process the data.
This has always been the case and so it seems unlikely that the guidance update and Court of Appeal decision will substantially change the practical reality of controller considerations when engaging with vulnerable individuals. Compliant processing of personal data always requires that controllers meet the key data protection principles, including fairness.
But watch this space
Whilst the ICO guidance currently reflects the legal position regarding objective indications of consent, it is worth noting that on July 15, 2026, RTM lodged an application for permission to appeal the Court of Appeal decision to the Supreme Court. We wait to see if that permission will be granted and whether there is more to come on this topic.
More on the RTM v. Bonne Terre and Anor case
The Court of Appeal clarifies the test for consent
On April 21, 2026, the Court of Appeal overturned a High Court ruling on the assessment of valid consent for the processing of personal data (RTM v. Bonne Terre and Anor [2026] EWCA Civ 488).
It concluded that, when assessing the validity of consent, an objective approach should be taken, and the inner workings of the individual’s mind are not relevant. The High Court set out a complex approach to consent
The High Court set out a complex approach to consent
We reported, early in 2025, on the High Court decision.
By way of reminder, the case concerned an individual with a gambling addiction, RTM, who brought a claim against Bonne Terre Limited and Hestview Limited (operating as Sky Betting and Gaming (SBG)). The claim was for financial loss and distress following SBG’s placement of cookies on RTM’s devices, the processing of his personal data and targeted direct marketing. RTM contended, amongst other things, that any consent obtained from him was not valid and so the processing was carried out without a lawful basis.
The High Court considered that, when determining whether valid consent was given (under the GDPR and Privacy and Electronic Communications Regulations), the consent should be assessed by reference to:
- the consenting individual’s state of mind (subjective element)
- absent that, whether the individual was in a position to autonomously consent (the autonomous element) and
- evidence for proof of consent (the evidential element).
In the context of RTM’s gambling addiction, the High Court did not consider that any of the three criteria had been met, and so valid consent had not been given. SBG appealed the decision.
Court of Appeal—the High Court got it wrong
The Court of Appeal considered the question of what, in fact, must be proved to establish that consent was given. In particular, the Court of Appeal was asked whether the concept of consent in such cases should have a subjective element.
The Court of Appeal held that the High Court was wrong: the judge used the wrong test to determine whether valid consent had been given. The Court of Appeal noted that, if the High Court’s approach were to be followed, this would lead to extreme results and mean, for example, that online gambling service providers could never design a compliant consent system.
What is the test—what must be proved to establish that consent was given?
The Court of Appeal confirmed that, in construing legislation, the interpretation must:
- reflect the legislative language, read as a whole and in context
- take account of its identifiable purposes and
- not have consequences that are unworkable or otherwise unlikely to have been intended.
A legislative concept should be the same irrespective of the specific factual context.
Applying that approach, the Court of Appeal was clear that the test for determining whether consent has been given is objective. It highlighted that language relating to consent, as used in the relevant legislation and case law, pointed to consent being an action (giving consent, by an affirmative act, by any indication) rather than a subjective state of mind.
To be valid, the consent must meet the four GDPR conditions. The individual’s indication must be freely given, specific, informed and unambiguous. The Court of Appeal considered that these conditions depend on the objective nature of the communications between the individual and data controller (e.g. the ticking of a box and the nature of communications that had been provided by the data controller to the individual prior to ticking the box) and, in the case of “freely given”, the structural character of the relationship between them (e.g. service provider and customer, employer and employee).
The Court of Appeal referred to case law and guidance to highlight the objective approach to freely given consent. For example, the CJEU referred to a power imbalance between the parties as being “liable to affect” the individual’s freedom of choice. According to the Court of Appeal, the individual’s state of mind is of no concern for these purposes.
The Court of Appeal also noted that the High Court was too willing to accept that, if a subjective test for consent was applied, the law would place an “irreducible minimum risk” on data controllers (a controller could never be sure of every individual’s state of mind). The Court of Appeal disagreed with this approach, stating that data protection is not an absolute right and must balance fundamental rights. That balance, according to the Court of Appeal, must also be pragmatic and workable.
Likewise, as the decision confirms, the law should offer legal and practical certainty (Recital 7 GDPR) which would not be the case for data controllers if the High Court approach were to be followed.
The judgment also addressed the wider legal principle of capacity. The Court of Appeal noted that, in general, if an individual has legal capacity, decisions made by the individual are considered legally binding even when that decision is “unwise or even irrational”.
But what if you know of a vulnerability?
The Court of Appeal also rejected assertions made by SBG and the ICO (intervening) that the objective test for consent “need not be absolutist”. SBG and the ICO submitted that, when a data controller had actual or constructive knowledge of an individual’s vulnerability (such as a gambling addiction), that could create a “clear imbalance of power” and, in that situation, the data controller was unlikely to be able to demonstrate that the consent was freely given.
Somewhat surprisingly, the Court of Appeal did not accept this argument, considering there to be issues with: taking an individualised approach (already rejected); burden of proof; legal and practical uncertainty; practicality and inconsistency with circumstances that do require verification efforts (e.g. authority to consent for children). More broadly, it concluded, the approach proposed undermines the objective assessment of consent.
Despite the Court of Appeal’s rejection of the SBG/ICO vulnerability submissions above, Lord Justice Warby went on to consider, obiter, the position of vulnerable individuals. He did “think it likely” that concerns regarding vulnerable individuals could be accommodated or accounted for in other ways.
He gave an example: if an individual made it known to the controller that they suffered from some affliction that “cast real doubt on their ability to make free choices”, the consent may not be unambiguous (and would therefore be invalid). He did not expand further or explain the distinction he was drawing between this example and the “knowledge of vulnerability” scenario submitted by SBG/ICO.
He also briefly addressed vulnerability in the context of fairness. He stated that, if the controller knew or should have known that the individual was “suffering from some form of disability or external factor” that compromised the individual’s ability to choose, that may have a bearing on whether the processing of personal data would be considered fair. In the context of gambling, it may also have a bearing on whether gambling law requirements had been met (e.g. the overarching duty to ensure that gambling is conducted in a fair and open way and that children and other vulnerable persons are protected from being harmed or exploited by gambling).
Further grounds of appeal
The Court of Appeal also found in SBG’s favour in relation to four other grounds of appeal based on whether consent was given for direct marketing, whether cookies were used for personalisation and direct marketing, and procedural irregularities.
Some comfort but care is still required
Perhaps to the relief of the gambling sector, this Court of Appeal judgment clarifies that, when it comes to consent, data controllers do not have to anticipate the inside of an individual’s head as they tick a consent box. Rather, data controllers can rely on an objective assessment of whether consent has actually been given based on the actions of the individual and the communications between the parties.
However, controllers are reminded that consent requirements, and GDPR obligations more generally, do not apply on a “class” basis. In fact, requirements relate to an individual’s data protection rights. If a controller is aware that an individual’s consent does not meet the four conditions (freely given, specific, informed and unambiguous), it will not constitute validly given consent and should not be relied upon.
More generally, as touched on briefly by Lord Justice Warby and reflected in the ICO guidance, if a controller is aware that the particular processing of personal data would be unfair, that processing would be in breach of one of the key principles of the GDPR. The controller could not lawfully process the personal data of the individual in those circumstances.
And for RTM, perhaps more to come?
The Court of Appeal identified the test for consent, but we now wait to see if RTM is granted permission to appeal to the Supreme Court. Otherwise, the Court of Appeal acknowledged that RTM still had claims against SBG that had yet to be resolved by the High Court, notably regarding fairness and infringement of other data protection principles.
