© Getty images
The courts have reinforced an objective approach to cookies & direct marketing practices, report Amanda Leiu, Hamish Corner & Jess Mant
- The Court of Appeal has confirmed that ‘consent’ under the General Data Protection Regulation and Privacy and Electronic Communications Regulations is to be assessed objectively, not by reference to an individual’s internal state of mind.
- Organisations are not required to prove what a data subject actually thought or understood when giving consent.
- However, vulnerability may be relevant in assessing wider fairness principles, particularly where a controller knew or ought to have known of it.
The Court of Appeal in RTM v Bonne Terre Ltd and another [2026] EWCA Civ 488 has overturned a High Court decision on what amounts to valid consent for cookies and direct marketing under the General Data Protection Regulation (GDPR) and Privacy and Electronic Communications (EC Directive) Regulations 2003 (SI 2003/2426) (PECR).
The background
The claim was brought by RTM, a recovering problem gambler, against Bonne Terre Limited and Hestview Limited, the companies behind the online
