The objective test for data subject consent, and what the court left open
In short: the objective test for data subject consent means a data controller proves consent by what the data subject did, not by what was in their mind. In RTM v Bonne Terre [2026] EWCA Civ 488, handed down on 21 April 2026, the Court of Appeal reversed the subjective test the High Court had introduced fifteen months earlier.
The orthodox position is that a data controller proves consent by pointing to what the data subject did. In January 2025 the High Court departed from it, holding that a gambling customer who had taken deliberate actions indicating consent had not given it, because his gambling condition had impaired his ability to choose freely. That left fifteen months of uncertainty for any consumer business relying on consent for cookies and marketing. The Court of Appeal has now held the analysis wrong in law and confirmed the objective test for data subject consent. Vulnerability has not been completely excluded, though: the judge, Warby LJ, noted ways in which it might still matter, and decided none of them.
How the Court of Appeal framed the objective test for data subject consent
The claimant, anonymised as RTM, gambled with Sky Betting and Gaming over a two-year period ending in early 2019, by which time he had overcome a gambling problem. He sued Bonne Terre Limited and Hestview Limited, the two companies behind the brand, over their cookies, their processing of his personal data and their direct marketing. At first instance in RTM v Bonne Terre Ltd [2025] EWHC 111 (KB) Collins Rice J held that consent carried three strands: good quality subjective consent turning on the individual’s actual state of mind; failing that, a fully autonomous choice; and minimum evidential standards. She accepted that RTM had taken deliberate actions indicating consent, and still found he lacked it, because his gambling condition and associated vulnerability had impaired the autonomous quality of his consenting.
Warby LJ, with whom Lewison LJ and Dame Victoria Sharp P agreed, held that analysis wrong in law in RTM v Bonne Terre Limited & Anor [2026] EWCA Civ 488. Consent is something a data subject gives by an act. Whether the data subject took a clear affirmative action indicating their wishes is, the court held, a purely objective question about an identifiable communication to the data controller. Each of the four criteria, freely given, specific, informed and unambiguous, is objective too. The data controller does not have to prove what was in the data subject’s mind, and Warby LJ held it is “neither necessary nor relevant for this purpose to explore whether the individual data subject was vulnerable, with an impaired ability to make fully autonomous decisions”.
The conduct straddled 25 May 2018, so the instruments in issue were the Data Protection Act 1998, the Privacy and Electronic Communications (EC Directive) Regulations 2003 and the GDPR. It was common ground that consent bore the same meaning across those regimes, which is why the holding covers cookie consent and marketing consent alike. Article 4(11) of the UK GDPR is in materially identical terms, so the reasoning is directly relevant to current UK practice, although the processing in dispute pre-dated the present UK regime. Nor was the objective reading new: in Cooper v National Crime Agency [2019] EWCA Civ 16 the Court of Appeal had described consent as an objective notion depending on the outward manifestation of consent by the data subject, though Warby LJ accepted that the issue now before the court does not appear to have been argued there.
The knowledge qualification the appellants and the Information Commissioner offered
The appellants were the gambling companies, appealing the finding that everything they had done over the relevant period was unlawful. The Information Commissioner intervened to assist the court and agreed with them that the test is objective. Both then offered the same qualification of their own case: vulnerability could still bear on consent where the data controller knew or ought to have known of it, because that knowledge might create the clear imbalance of power described in Recital 43. Neither had argued it below, and RTM did not adopt it, his case being that the judge’s conclusion was supported by proper findings of objective fact in any event. Warby LJ refused the qualification, because treating the data controller’s state of mind as a criterion for whether the data subject gave consent is neither consistent with the language of the legislation nor coherent. Two of his reasons apply outside gambling. The qualification would introduce two subjective tests rather than remove one, and the burden in Article 7 would require the data controller to prove negatives. The appellants came away with a cleaner objective test than they had argued for.
Where vulnerability may still be relevant
The objective test does not remove vulnerability from every part of the data protection analysis. Warby LJ noted ways in which it might still matter and decided none of them, and the appellants had separately conceded a knowledge-based limit on legitimate interests. None of it is settled law, which is the reason to watch it.
Unambiguity is one of the four criteria the data controller must prove. Warby LJ noted that where a data subject makes an affliction casting real doubt on his ability to choose freely known to the data controller, any indication of his wishes might not count as unambiguous. RTM had not put his case that way and the court did not decide it.
Fairness under Article 5(1)(a) is a separate requirement from identifying a lawful basis. Warby LJ noted it might be argued that processing was not fair where the data controller knew or should have known of a disability or external factor that overbore the data subject’s will. That argument was not run and the court did not decide it.
The appellants accepted at trial that a gambling company could not rely on its own legitimate interests as a lawful basis for marketing to a problem gambler if it had grounds to know that to be the case. Warby LJ recorded the concession, prefacing it with “for what it is worth”, and observed that the judge had made no finding that the appellants had such grounds. The court did not decide the general scope of the concession. It stands, though, as a knowledge-based limit that a party in this market accepted on the record, in the same judgment that refused a knowledge-based limit on consent.
| Route | What is left open |
|---|---|
| Unambiguity, Article 4(11) | Noted, not decided: whether an indication still signifies agreement unambiguously once the data subject has disclosed an affliction casting doubt on free choice |
| Fairness, Article 5(1)(a) | Noted, not decided: whether processing is fair where the data controller knew or should have known the data subject’s will was overborne |
| Legitimate interests, Article 6(1)(f) | Conceded by the appellants, not decided: whether legitimate interests can be relied on for marketing to a person the data controller has grounds to know is vulnerable |
Implications for consent records and mechanism design
The objective test for data subject consent puts the analysis on the mechanism and on the relationship between the parties. The court assesses the four criteria in context, including the communications between the parties and the structural character of their relationship. A UK data controller running a consent-based cookie banner or a marketing programme under PECR must therefore prove what the notice said, what preceded the indication and what the data subject did. The court assesses that particular exchange in its context. It is structural imbalance that turns on the status of the parties or the characteristics of the group they belong to, rather than on an undisclosed individual state of mind.
Proving consent is a records question before it is a design question. Article 7(1) requires a data controller to be able to demonstrate that the data subject consented, and in practice that is likely to mean reliable records of the affirmative action, of the notice and choices displayed at the time, and of the consent settings as they then stood. The judgment prescribes no format, and the place to test what is held is the ICO’s guidance on valid consent. Structural imbalance remains part of the test, though Warby LJ declined to find one between the appellants and their customers generally. Regulation 30(2) of PECR does not assist a data controller, because the Court of Appeal held that it provides a defence to compensation and no answer to liability. The Court of Appeal has not yet decided whether the appellants’ own mechanisms produced valid consent: it reserved both the July 2017 indication and the position after their GDPR refresh for further argument. The scope of a lawful basis review is set out at AI and data governance advice.
Viewpoint
In my view what matters most to a consumer-facing business is not the holding on consent but what the court didn’t decide. Vulnerability was argued out of the consent definition by the appellants and the Information Commissioner together, and the appellants had already conceded the equivalent point on legitimate interests. None of that binds anyone, and that is the point. A UK data controller that moves marketing off consent and onto Article 6(1)(f) takes on the balancing test with the knowledge question unresolved, and with a concession on the record made by a party on its own side of the argument.
The practical effect of the judgment is to move the argument from the banner to the basis. A lawful basis recorded once and never revisited against the processing actually carried out is the exposure this case creates, because the objective test rewards a data controller that can evidence the choice it offered and the relationship in which it offered it. That evidence sits alongside the UK GDPR compliance records a data controller already keeps.
No reported decision or reported application for permission to appeal to the Supreme Court had been identified as at 17 August 2026. The scope of the remission to the High Court is still to be argued. The court recorded that RTM’s claims that the processing was unfair and infringed other data protection principles remain to be resolved.
Frequently asked questions
What is the objective test for data subject consent?
The objective test for data subject consent asks what the data subject communicated to the data controller, not what the data subject was thinking. In RTM v Bonne Terre the Court of Appeal held that the indication of wishes, and the four criteria of freely given, specific, informed and unambiguous, are objective questions assessed in the context of the dealings between the parties.
Does a data subject’s vulnerability affect whether they gave valid consent?
No. The court held that a data controller does not have to prove what was in the data subject’s mind, and that exploring whether the individual was vulnerable is neither necessary nor relevant. Warby LJ suggested that vulnerability might still matter to unambiguity and to fairness under Article 5(1)(a), without deciding either, and the appellants had conceded a knowledge-based limit on legitimate interests.
Did RTM lose the case?
Not outright. The Court of Appeal allowed the appeal on all five grounds and set aside the judgment on liability, but held that the case must be remitted to the High Court, with the scope of that remission to be settled after further argument. RTM’s claims that the processing was unfair survive.
For advice on lawful basis selection, consent mechanism design or a PECR marketing review, contact Rob Bratby at Bratby Law.
