Uncertainty in the UK GDPR consent framework

The High Court's decision in RTM [2025] EWHC 111 (KB) raises several questions around the future of consent under the UK GDPR.

Key takeaways

• The Court introduces a novel three-part test for assessing consent, incorporating subjective and autonomy-based elements beyond the legislative text of the UK GDPR,¹ existing case law, and regulatory guidance on this issue.
• The judgment does not appear fully consistent with established regulatory guidance, insofar as it appears to determine the validity of consent based on the data subject's state of mind and behavioural circumstances.
• As of June 2025, the Court's decision is currently being appealed. A hearing date has not yet been set but is expected to take place by June 2026.

On 23 January 2025, the High Court delivered its judgment in RTM [2025] EWHC 111 (KB), a claim brought by an individual ("RTM") against the operators of the Sky Betting & Gaming platform ("SBG"). RTM, a recovering gambling addict, alleged that his personal data had been unlawfully processed through tracking cookies and direct marketing communications, which in turn exacerbated his compulsive behaviour.

Notwithstanding that RTM had consented to SBG's use of non-essential cookies, the claim centred on whether this consent was in fact valid under the GDPR, considering RTM's circumstances, for the purposes of delivering personalised advertising.

The High Court's Judgment

Justice Collins Rice ruled in favour of RTM, concluding that SBG had failed to obtain valid consent to serve non-essential cookies or deliver direct marketing communications. In doing so, the Court introduced a tripartite framework for assessing consent:

1. Subjective – The individual's state of mind when giving consent.
2. Autonomous – The individual's ability to make an informed and uncoerced decision.
3. Evidential – The controller's ability to demonstrate that valid consent was obtained.

The Court cited CJEU case law in support of the view that the threshold for valid consent must be "relatively high"². In this case, the Court emphasised that RTM was a "vulnerable individual",³ whose compulsive gambling behaviour necessarily impaired his autonomy – rendering the consent that he had provided (i.e., by way of positively affirming SBG's cookie consent banner) to be invalid.

Confusingly, however, the Court elsewhere conflated elements (1) and (2) of the framework set out above. It found that by not "giving his mind to the issue"⁴ and without reading the cookies policy, RTM had not consented, and any appearance of passive consent (e.g., "clicking of the relevant buttons")⁵ was not enough to show he had made an autonomous choice. The judgment stated that:

"He clicked through without reading any privacy notice, simply to get rid of the messages on his screen and get on with gambling. He had not informed himself of the nature and use of cookies to obtain and use raw data for ultimate marketing purposes…he just wanted to get on and gamble".⁶

The Court went on to affirm that a controller that collects user consent through a standardised consent capture mechanism cannot rely on the fact that "nearly everyone who has been through the consenting process will have either subjectively consented or taken an autonomous decision (to the requisite standard)…"⁷.

A decision that raises more questions than it answers

Unclear legal analysis

The judgment notably departed from the established interpretation of "freely given, specific, informed and unambiguous"⁸ consent under the UK GDPR by layering on an "autonomy" requirement that is undefined in law or guidance. To address this, the Court cited the right to privacy set out in Article 8 ECHR as evidence of the role "individual autonomy, including the genuinely autonomous control of personal data."⁹ At no point, however, does the Court provide any analysis or threshold for determining when an individual's engagement becomes compulsive enough to no longer be considered autonomous, or how this can realistically be measured in the context of the internet, where service providers do not necessarily have accurate information co. The test applied by the Court also does not appear to be reflected in the guidance published by the Information Commissioner's Office concerning valid consent. It remains unclear how data controllers should apply the Court's analysis to other factual circumstances. For example:

• Could a compulsive online shopper or social media user assert that their autonomy was impaired when accepting tracking cookies?
• Could this line of argument be extended to children, neurodivergent users, or individuals suffering from mental health conditions?

If the benchmark for valid consent under the UK GDPR now depends on the fluctuating and undisclosed mental state of the affected individual, the Court's decision inadvertently suggests that individuals may have to disclose more personal information to controllers in order for their consent to be valid. This is because the controller cannot know whether it has obtained valid consent without much more detailed information about the individual's mental state when giving consent. Not only does this result in processing of more personal data across the board (which would seem at odds the principle of data minimisation set out in Article 5(1)(c) UK GDPR), but it creates a burdensome additional requirement for controllers to have a separate legal basis for processing the personal data required to assess whether consent can be relied upon in the first place.

Lack of practical guidance

The Court offered no guidance on how the mental state of an individual giving consent should be ascertained by controllers – especially those operating at scale in environments with a high volume of users, over the internet. There is no indication of how controllers are expected to realistically detect compulsive or impaired behaviour at the point of consent, especially where no external markers are visible or where the impairment is asserted only retrospectively. Likewise, it is unclear what additional processes or safeguards (if any) controllers may practically implement to assess or ensure users are able to provide valid consent.

Appeal and quantum

The judgment does not address damages. In March 2025, the Court granted SBG leave to appeal to the Court of Appeal where these issues will be heard in full. Controllers can therefore expect to receive further clarity, legal analysis and guidance on the issues raised in this case in due course.

Looking ahead

In seeking to address a sympathetic claimant's experience, the Court has created broader legal ambiguity with potentially disruptive consequences for any digital service premised on user engagement and personalisation. The introduction of "autonomous consent" creates a novel and untested legal standard that appears to contradict existing regulatory guidance, and seems to undermine existing compliance frameworks and established practices around consent capture. Its long-term significance will depend on how it is treated on appeal, but in the short term, the case creates substantial doubt as to how businesses should obtain consent, especially in an online context.

1 While the facts of this case relate to processing that took place while the (EU) GDPR remained applicable in the UK, this case going forward is primarily relevant to the interpretation of the UK GDPR.
2 RTM[2025] EWHC 111 (KB), para. 152.
3 RTM[2025] EWHC 111 (KB), para. 161.
4 RTM[2025] EWHC 111 (KB), para. 162.
5 RTM[2025] EWHC 111 (KB), para. 173. 
6 RTM[2025] EWHC 111 (KB), para.162. 
7 RTM[2025] EWHC 111 (KB), para. 179.
8 RTM[2025] EWHC 111 (KB), para(s). 148 - 151. 
9 RTM[2025] EWHC 111 (KB), para. 147.