[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fj_6kTDtujut1a_1Ge6Sc34GDWOC-39_Lmpcc1DxJTJs":3},{"article":4,"iocs":39},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"full_text":11,"url":12,"image_url":13,"published_at":14,"ingested_at":15,"relevance_score":16,"entities":17,"category_id":21,"category":22,"article_tags":26},"2ae054b1-9188-4891-bfe2-7e5486cba292","EWCA - CA-2025-000651","ewca-ca-2025-000651-3d25b0","English Summary ← Older revision Revision as of 15:40, 21 May 2026 (One intermediate revision by the same user not shown) Line 84: Line 84: }} }} A data subject sued the controller under [[Article 82 GDPR]], alleging unlawful cookies, profiling and direct marketing. The high court held that consent must be assessed objectively, not by the user’s subjective state of mind. A data subject sued the controller under [[Article 82 GDPR]], alleging unlawful cookies, profiling and direct marketing. The court held that consent must be assessed objectively, not by the user’s subjective state of mind. == English Summary == == English Summary ==","A data subject sued a controller under Article 82 GDPR, alleging unlawful cookies, profiling, and direct marketing. The UK court held that consent must be assessed objectively, not by the user’s subjective state of mind. The case involves a gambling platform and the validity of consent obtained through cookie banners and marketing preferences.","UK court case EWCA - CA-2025-000651 addresses GDPR consent for cookies, profiling, and direct marketing.","Help EWCA - CA-2025-000651: Difference between revisions From GDPRhub Jump to:navigation, search ← Older editNewer edit →VisualWikitext Revision as of 14:09, 21 May 2026 view sourceBms (talk | contribs)Bureaucrats, Interface administrators, noContributionReport, Administrators49 editsTag: Visual edit← Older edit Revision as of 15:40, 21 May 2026 view source Anisuzmeyan (talk | contribs)10 edits Tag: Visual editNewer edit → (One intermediate revision by the same user not shown)Line 84: Line 84: }}}} A data subject sued the controller under [[Article 82 GDPR]], alleging unlawful cookies, profiling and direct marketing. The high court held that consent must be assessed objectively, not by the user’s subjective state of mind.A data subject sued the controller under [[Article 82 GDPR]], alleging unlawful cookies, profiling and direct marketing. The court held that consent must be assessed objectively, not by the user’s subjective state of mind. == English Summary ==== English Summary == Revision as of 15:40, 21 May 2026 EWCA - CA-2025-000651 Court: EWCA (United Kingdom) Jurisdiction: United Kingdom Relevant Law: Article 4(11) GDPR Article 6(1)(a) GDPR Article 7(1) GDPR Article 7(4) GDPR Article 82 GDPR Schedule 2 para 1 DPA 1998Schedule 2 para 6(1) DPA 1998Article 6 PECRArticle 22 PECRArticle 30 PECR Decided: 21.04.2026 Published: 21.04.2026 Parties: RTM Bonne Terre Limited Hestview Limited National Case Number\u002FName: CA-2025-000651 European Case Law Identifier: Appeal from: EWHC (KB) (United Kingdom)RTM v Bonne Terre Limited and another [2025 EWHC 111 (KB)] Appeal to: Unknown Original Language(s): English Original Source: Bailii (in English) Initial Contributor: Anias A data subject sued the controller under Article 82 GDPR, alleging unlawful cookies, profiling and direct marketing. The court held that consent must be assessed objectively, not by the user’s subjective state of mind. Contents 1 English Summary 1.1 Facts 1.2 Holding 2 Comment 3 Further Resources 4 English Machine Translation of the Decision English Summary Facts The controller, Sky Betting and Gaming (\"SBG\"), operated an online betting and gaming platform. The data subject, RTM, opened an account with the controller, which they used between April 2017 and early 2019. The controller presented the data subject with a cookie banner stating that by visiting or using this website they would consent to the use of cookies. The banner included a hyperlink with the controller’s cookie policy. The controller’s privacy notice also stated that, unless customers had asked otherwise, they would send them direct marketing communications and use information about them to provide tailored advertising. The controller’s records showed that, on 26 July 2017, the data subject changed his marketing preferences. From 28 July 2017, the controller began sending him direct marketing communications. The data subject did not remember opting in. In March 2018, the controller carried out a “GDPR refresh”. Customers were required to confirm that they had read, understood and accepted updated terms and privacy\u002Fcookie information. The controller’s records indicated that the data subject ticked the relevant boxes and chose to continue with his existing direct marketing preferences. The data subject brought proceedings before the High Court under Article 82 GDPR and Regulation 30 PECR. He argued that the controller had unlawfully placed cookies, processed his personal data, profiled him and sent him direct marketing communications. In particular, he argued that the controller had no valid consent under Article 4(11) GDPR, Article 7 GDPR, the DPA 1998 and Regulations 6 and 22 PECR. The data subject submitted that the cookie banner did not offer an active way to refuse consent and that the controller’s processing and direct marketing contributed to his gambling addiction, causing financial loss and distress. He also alleged that the controller’s processing was unfair, insufficiently transparent, breached the principles of purpose limitation, data minimisation and storage limitation, and involved special category data because it revealed problem gambling. The key question before the Court was: “What must be proved to establish that consent was given for the placement of cookies, the processing of personal data, and the sending of unsolicited direct marketing communications? Mainly, does the concept of consent for these purposes have a subjective aspect?“ The High Court upheld the data subject’s claim and found that the data subject did not give valid consent. The High Court treated consent as involving three strands: 1) the data subject’s subjective state of mind; 2) whether any lack of subjective consent resulted from an autonomous choice not to engage with the information provided by the controller; and 3) whether the controller had sufficient evidence to prove legally operative consent. Applying that approach, she concluded that the controller’s conduct was unlawful in both periods. In the first period, she found that the data subject lacked subjective consent because of his gambling addiction and that the controller’s “accept and close” mechanism did not provide sufficient evidence of an autonomous choice to give, or to forego, consent. In the second period, the High Court accepted that the GDPR refresh had significantly improved the controller’s consent mechanism. However, it found that this was still insufficient on the facts of the case. In its view, the controller could not rely solely on the general probability that a user who ticked the relevant boxes had validly consented. Instead, where consent was challenged, the controller had to demonstrate that this particular data subject’s consent met the required legal standard. The High Court found that his consent was not sufficiently freely given, because the data subject’s gambling addiction impaired the autonomous quality of his decision-making. It also considered that the resulting uncertainty for businesses was an inevitable consequence of the high standard of consent required by data protection law. The controller appealed the decision on the following grounds: Firstly, that the High Court had applied the wrong legal test for valid consent by treating consent as involving a subjective inquiry into the data subject’s state of mind and autonomy. Secondly, that the High Court’s conclusion that the data subject’s gambling addiction impaired the validity of his consent was not an argument put forward by the data subject. Thirdly, that the High Court erred in failing to find that the data subject had factually consented to direct marketing on 26 July 2017. Fourthly, that there was no evidence that cookies were used to send the direct marketing communications complained of by the data subject. Fifthly, that the High Court’s conclusion on profiling was parasitic on its erroneous findings on consent, cookies and direct marketing, and that it misunderstood the controller’s concession on legitimate interests. Holding The Court of Appeal allowed the appeal on all five grounds. First, the Court held that consent under the GDPR, the DPA 1998 and PECR is assessed objectively. To prove consent, a controller must show that the data subject made a statement or took a clear affirmative action amounting to an indication of their wishes, signifying agreement to the relevant processing or direct marketing according. The controller must also prove, on the balance of probabilities, that this indication was freely given, specific, informed and unambiguous. The Court rejected the High Court’s subjective approach. The controller does not have to prove what was actually in the data subject’s mind at the time of the indication. Nor is it necessary or relevant, for the purpose of establishing consent, to examine whether the data subject was vulnerable or had an impaired ability to make autonomous decisions. The Court considered that this objective approach was supported by the wording of Article","https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=EWCA_-_CA-2025-000651&diff=51711&oldid=51709","https:\u002F\u002Fgdprhub.eu\u002Fimages\u002F4\u002F4c\u002FCourts_logo1.png","2026-05-21T15:40:03+00:00","2026-05-21T16:00:10.54823+00:00",7,[18],{"name":19,"type":20},"Sky Betting and Gaming","vendor","3f0f8451-91df-4b6c-9a73-ef3b2509b7f1",{"id":21,"icon":23,"name":24,"slug":25},null,"GDPR","gdpr",[27,29,34],{"category":28},{"id":21,"icon":23,"name":24,"slug":25},{"category":30},{"id":31,"icon":23,"name":32,"slug":33},"53f9c4b6-8bc6-4964-9169-d09e5cd41d72","Compliance","compliance",{"category":35},{"id":36,"icon":23,"name":37,"slug":38},"614132b8-5837-4952-b8b5-c6c9a32a1d85","Privacy","privacy",[]]