Court of Appeal affirms objective consent under GDPR

On 2 June 2026, the UK Court of Appeal delivered a significant judgment in the case of RTM v Bonne Terre Ltd, clarifying the nature of consent under the General Data Protection Regulation (GDPR) and the Privacy and Electronic Communications Regulations (PECR). The court emphasized that consent must be assessed objectively, focusing on clear affirmative actions by the data subject.

Case Background

The claimant, RTM, alleged that Sky Betting & Gaming (SBG) unlawfully processed personal data and sent personalized marketing communications without valid consent, violating GDPR and PECR provisions. The High Court initially ruled in favor of RTM, introducing a subjective test for consent that considered the individual's mental state and autonomy.

Court of Appeal Decision

The Court of Appeal overturned the High Court's decision, stating that:

• Consent is determined by an objective standard, based on the data subject's clear affirmative actions, such as ticking a box or similar explicit indications.
• The four criteria for valid consent under GDPR—freely given, specific, informed, and unambiguous—are to be assessed objectively, without delving into the individual's subjective mental state.

Implications for Data Controllers

This ruling provides clarity for organizations processing personal data, reinforcing that:

• Consent mechanisms should be designed to elicit clear affirmative actions from data subjects.
• Organizations are not required to assess the subjective mental state of individuals when obtaining consent.
• Maintaining comprehensive records of consent obtained through objective means is crucial for compliance.

For a detailed analysis, refer to the article by Clifford Chance.