HOW EFFECTIVE IS CONSENT GIVEN BY A GAMBLING ADDICT?

In general, unwise or even irrational decisions made by individuals with capacity are considered legally binding.

Per Warby LJ: RTM v Bonne Terre Limited and another [2026] EWCA CIV 488

Introduction

An online betting and gaming business has successfully appealed against a High Court decision that it was unlawful to place cookies on a gambling addict’s devices and to send him targeted marketing emails. The addict had not given effective consent because it was “insufficiently freely given” on account of his “gambling condition and his associated vulnerability and compromised authority”.

In Lord Justice Warby's judgement handed down two weeks ago, the Court of Appeal disagreed.  The data controller does not have to establish what was in the mind of the data subject when it gives an indication of consent. It was irrelevant that he was a vulnerable gambling addict with an impaired ability to make his own decisions.

Nor must the data controller prove what was in its own mind. When the Information Commissioner’s Office intervened in the case to assist the court, he argued that in principle that there could be circumstances when the data controller had actual or constructive knowledge about the data subject’s personal circumstances or state of mind which might have a bearing on whether effective consent had been given.  Lord Justice Warby disagreed.

Facts

The claimant sued the gambling business for compensation contending that he was a gambling addict and that the betting company had acted unlawfully in its placement of cookies, its processing of his personal data and its direct marketing communications, as he had not been able to give effective consent. This had caused him to gamble more and to lose more than he otherwise would have done. He claimed compensation for financial loss and distress as a result.

What is effective consent

For consent to be effective, the data controller must show that the data subject made a statement or took some other clear affirmative action, such as ticking a box, that confirmed his agreement to the processing of his personal data, including in this case the placement of cookies and the sending of targeted marketing emails.

The indication or affirmative action must comply with the four criteria set out in the UK GDPR:

·      it must be freely given

·      specific

·      informed

·      unambiguous

Lord Justice Warby is clear that these are objective criteria. They refer to the circumstances surrounding the consent and the procedure adopted for obtaining it rather than the state of mind of the data subject. Otherwise, there would always be the possibility that a data subject suffers from a condition or otherwise gives consent in circumstances which the controller does or cannot know about that undermines its effectiveness. The Court of Appeal did not accept the High Court judge’s proposition that the law places an “irreducible minimum risk” on the data controller. This would mean that a data controller could not guarantee its ability to “demonstrate” conformity with the consent requirements of data protection law and PECR. No system for obtaining consent could achieve this. Absent another lawful basis the data controller’s processing would be unlawful.

Examples were given of how an individual’s consent to an oblivious controller could be undermined by a third party blackmailing the data subject, putting a gun to their head, or subjecting them to coercive and controlling behaviour.

In reaching his decision Lord Justice Warby relied on Recital 4 to the GDPR which explains that “The right to protection of personal data is not an absolute right; it must be considered in relation to its function in society and balanced against other fundamental rights” which include “freedom to conduct a business”. The balance is to be struck “in accordance with the principle of proportionality”.

He did not consider it likely that the legislature intended to create a regime for consent with which it would be impossible for data controllers to comply, exposing them to a legal risk over which they had no real control.

Perhaps the surprising aspect of this case is not so much Lord Justice Warby's decision or that the claimant managed to persuade the High Court judge to find in his favour, but that the Information Commissioner agreed there could be cases where a controller knew or ought reasonably to have known of circumstances or aspects of the data subject’s state of mind which might affect the validity of consent.

Point to consider

Do your consents need a refresh?

Mariel Irvine

7 May 2026