Sky Betting case update: a score draw but an objective answer on marketing consent

Businesses will welcome the clarity provided by the Court of Appeal in RTM v Bonne Terre Limited that consent to personalised marketing and data processing should be judged objectively rather than by reference to an individual’s state of mind. 

Background 

Following the ICO’s reprimand against Bonne Terre Limited in September 2024 for the unlawful placement of cookies on users’ devices, a recovering problem gambler (RTM), brought a claim against Bonne Terre Limited and Hestview Limited, who together operate the Sky Betting and Gaming platform (SBG). 

In 2025, the High Court held that the test for consent under both the UK GDPR and the PECR rules on direct marketing is subjective and depends on the actual state of mind of the individual whose consent is being sought. Applying this to RTM’s case, the court concluded that RTM’s gambling addiction prevented him from giving valid consent to receive targeted direct marketing by email. SBG appealed and the case was heard early this year, with the Information Commissioner as an intervening party. 

Court of Appeal decision

The Court of Appeal overturned the High Court’s findings and concluded that a controller does not have to prove what was actually in the mind of the individual at the time of consent. The test is an objective one, which is supported by EU and UK case law on consent (including on the GDPR requirements that it must be specific, informed, freely given and unambiguous). 

The ICO and SBG had submitted that actual or constructive knowledge of the state of mind of an individual is still relevant, but the court rejected this argument too. Warby LJ did however explain that such knowledge could be relevant to other aspects of compliance, such as the GDPR concept of fairness.

In its detailed analysis, the Court of Appeal also accepted that the purposes for which consent is sought, how that is done, and the context in which it is done (including the controller’s regulatory environment, the kinds of people it is dealing with and the particular risks of the business) are all relevant factors that feed into the objective assessment for consent. Those factors could, for example, indicate that simpler and clearer language should be used. But crucially, these factors are relevant to a controller’s assessment of its relationship with data subjects in general, rather than a requirement to assess the actual state of mind of each individual whose consent is sought.

Similarly, the court also rejected the argument  that “a clear imbalance of power” between SBG and its customers could invalidate consent on an individual basis. The court took the view that a clear imbalance is concerned with the general character of the relationship between a controller and the relevant data subjects, rather than with the particular circumstances of any one subject. 

Commentary 

The decision will be welcomed by gambling businesses and more broadly by those relying on consent for marketing purposes or data processing. It is a pragmatic judgment, reflecting extensive submissions, that recognises the importance of legal certainty: if the test for consent were subjective, organisations would have to make considerable efforts to enquire into individuals’ states of mind, yet without ever entirely eliminating the risk that someone’s ability to consent may be impaired. As Warby LJ explains, it is unlikely that lawmakers intended to create a consent regime that data controllers would find impossible to comply with. 

To have followed the High Court’s decision would also have challenged the generally accepted principle that unwise or even irrational decisions made by individuals with capacity are considered legally binding. The Court of Appeal recognised that this would have broader implications beyond the gambling sector.  

The decision may yet be appealed and in the meantime, the case has to be remitted to the High Court to address certain factual issues that were originally pleaded but not determined. 

In the meantime, the message is a reassuring one for businesses, albeit with a few important considerations. Actual or constructive knowledge of an individual’s state of mind may be relevant in other contexts, such as fairness and how privacy information is drafted and presented, but a properly engineered, regularly reviewed and well-documented consent mechanism can deliver valid consent without detailed enquiries into particular individuals’ state of mind.