EWCA - CA-2025-000651
UK Court of Appeal rules GDPR consent assessed objectively, not subjectively, in cookies and marketing case.
Summary
The UK Court of Appeal addressed a case under Article 82 GDPR involving unlawful cookies, profiling, and direct marketing. The court allowed the appeal, ruling that consent under GDPR should be assessed objectively, rather than based on the user's subjective state of mind.
Full text
Help EWCA - CA-2025-000651: Difference between revisions From GDPRhub Jump to:navigation, search ← Older editNewer edit →VisualWikitext Revision as of 15:39, 20 May 2026 view sourceAnisuzmeyan (talk | contribs)10 edits Tag: Visual edit← Older edit Revision as of 13:15, 21 May 2026 view source Bms (talk | contribs)Bureaucrats, Interface administrators, noContributionReport, Administrators49 editsTag: Visual editNewer edit → Line 12: Line 12: |ECLI=|ECLI= |Original_Source_Name_1=British and Irish Legal Information Institute (BAILII)|Original_Source_Name_1=Bailii |Original_Source_Link_1=https://www.bailii.org/cgi-bin/format.cgi?doc=/ew/cases/EWCA/Civ/2026/488.html&query=(GDPR)|Original_Source_Link_1=https://www.bailii.org/cgi-bin/format.cgi?doc=/ew/cases/EWCA/Civ/2026/488.html&query=(GDPR) |Original_Source_Language_1=English|Original_Source_Language_1=English Line 40: Line 40: |GDPR_Article_Link_7=|GDPR_Article_Link_7= |EU_Law_Name_1=Article 2(f) Directive 2002/58/EC|EU_Law_Name_1= |EU_Law_Link_1=https://eur-lex.europa.eu/eli/dir/2002/58/oj/eng|EU_Law_Link_1= |EU_Law_Name_2=Article 2(h) Directive 95/46/EC|EU_Law_Name_2= |EU_Law_Link_2=https://eur-lex.europa.eu/legal-content/EN/ALL/?uri=CELEX:31995L0046|EU_Law_Link_2= |EU_Law_Name_3=|EU_Law_Name_3= |EU_Law_Link_3=|EU_Law_Link_3= Line 49: Line 49: |EU_Law_Link_4=|EU_Law_Link_4= |National_Law_Name_1=Data Protection Act, Schedule 2 para 1|National_Law_Name_1=Schedule 2 para 1 DPA 1998 |National_Law_Link_1=https://www.legislation.gov.uk/ukpga/1998/29/schedule/2/1998-07-16|National_Law_Link_1=https://www.legislation.gov.uk/ukpga/1998/29/schedule/2/1998-07-16 |National_Law_Name_2=Privacy and Electronic Communications (EC Directive) Regulations 2003, Regulation 22|National_Law_Name_2=Schedule 2 para 6(1) DPA 1998 |National_Law_Link_2=https://www.legislation.gov.uk/uksi/2003/2426/regulation/22|National_Law_Link_2=https://www.legislation.gov.uk/ukpga/1998/29/schedule/2/1998-07-16 |National_Law_Name_3=Privacy and Electronic Communications (EC Directive) Regulations 2003, Regulation 6|National_Law_Name_3=Article 6 PECR |National_Law_Link_3=https://www.legislation.gov.uk/uksi/2003/2426/regulation/6|National_Law_Link_3=https://www.legislation.gov.uk/uksi/2003/2426/regulation/6 |National_Law_Name_4=|National_Law_Name_4=Article 22 PECR |National_Law_Link_4=|National_Law_Link_4=https://www.legislation.gov.uk/uksi/2003/2426/regulation/22 |National_Law_Name_5=|National_Law_Name_5=Article 30 PECR |National_Law_Link_5=|National_Law_Link_5=https://www.legislation.gov.uk/uksi/2003/2426/regulation/30 |Party_Name_1=RTM (Claimant/Respondent)|Party_Name_1=RTM |Party_Link_1=|Party_Link_1= |Party_Name_2=Bonne Terre Limited (Defendant/Appellant)|Party_Name_2=Bonne Terre Limited |Party_Link_2=|Party_Link_2= |Party_Name_3=Hestview Limited (Defendant/Appellant)|Party_Name_3=Hestview Limited |Party_Link_3=|Party_Link_3= |Party_Name_4=|Party_Name_4= Line 84: Line 84: }}}} A data subject sued a controller under [[Article 82 GDPR]], alleging unlawful cookies, profiling and direct marketing. The Court of Appeal allowed the appeal and held that consent is assessed objectively, not by the user’s subjective state of mind.A data subject sued the controller under [[Article 82 GDPR]], alleging unlawful cookies, profiling and direct marketing. The Court of Appeal allowed the appeal and held that consent is assessed objectively, not by the user’s subjective state of mind. == English Summary ==== English Summary == Revision as of 13:15, 21 May 2026 EWCA - CA-2025-000651 Court: EWCA (United Kingdom) Jurisdiction: United Kingdom Relevant Law: Article 4(11) GDPR Article 6(1)(a) GDPR Article 7(1) GDPR Article 7(4) GDPR Article 82 GDPR Schedule 2 para 1 DPA 1998Schedule 2 para 6(1) DPA 1998Article 6 PECRArticle 22 PECRArticle 30 PECR Decided: 21.04.2026 Published: 21.04.2026 Parties: RTM Bonne Terre Limited Hestview Limited National Case Number/Name: CA-2025-000651 European Case Law Identifier: Appeal from: EWHC (KB) (United Kingdom)RTM v Bonne Terre Limited and another [2025 EWHC 111 (KB)] Appeal to: Unknown Original Language(s): English Original Source: Bailii (in English) Initial Contributor: Anias A data subject sued the controller under Article 82 GDPR, alleging unlawful cookies, profiling and direct marketing. The Court of Appeal allowed the appeal and held that consent is assessed objectively, not by the user’s subjective state of mind. Contents 1 English Summary 1.1 Facts 1.2 Holding 2 Comment 3 Further Resources 4 English Machine Translation of the Decision English Summary Facts The controller (SBG) operated an online betting and gaming platform. In April 2017, the data subject (RTM) activated their SBG account, which they used between April 2017 and early 2019 (relevant period). The controller presented the data subject with a cookie banner stating that by visiting or using this website they would consent to the use of cookies. The banner included a hyperlink with the controller’s cookie policy. The controller’s privacy notice stated that unless the data subject had asked them not to, the controller would send them direct marketing communications and use information it held about them to provide tailored advertising. Customers could opt out from receiving direct marketing. Controller’s records indicated that the data subject had changed his marketing preferences on 26 July 2017 and the controller started sending them direct marketing communications. The data subject expressed no recollection of this. In March 2018 the controller asked the data subject to reconfirm their agreement to its terms, cookies and privacy policy as part of a “GDPR refresh”. The data subject clicked on the boxes indicating his agreement to the terms and for the use of cookies. The data subject also chose to continue with their existing preferences for direct marketing, namely to remain opted in. The data subject brought a claim before the High Court on the basis of Article 82 GDPR and Regulation 30 PECR, arguing that the controller could not rely on consent under Article 6(1)(a) GDPR, Schedule 2 Paragraph 1 DPA 1998 and Regulation 6 and 22 PECR because consent could not constitute a legal basis for this processing. Consent was interpreted within the meaning of Article 4(11) GDPR and Articles 2(h), 7(a) DPD. They argued that the cookie banner did not provide any active way of refusing consent, and only included the option “accept and close”. They argued that the consent was not valid and that the controller unlawfully gathered data relating to them through the use of cookies, which it then used to send personalised and targeted direct marketing communications. The data subject alleged that this reinforced their gambling addiction, causing them financial loss and distress. The data subject also alleged that the controller’s processing was unfair and insufficiently transparent, breached the principles of purpose limitation, data minimisation and storage limitation, and involved a special category data because it revealed their problem gambling. The key question before the Court was: “What must be proved to establish that consent was given for the placement of cookies, the processing of personal data, and the sending of unsolicited direct marketing communications? Mainly, does the concept of consent for these purposes have a subjective aspect?“ The High Court upheld the data subject’s claim and found that the data subject did not give valid consent. The High Court treated consent as involving three strands: 1) the data subject’s subjective state of mind; 2) whether any lack of subjective consent resulted from an autonomous choice not to engage with the information provided by the controller; and 3) whether the controller had sufficient evidence to prove legally operative consent. Applying that approach, she concluded that the controller’s conduct was unlawful in both periods. In the first period, she found that the data subject lacked subjective consent because of his gamb