Court of Appeal of England and Wales backs bookmaker in landmark consent ruling
This week, the Court of Appeal of England and Wales overturned a High Court ruling that had found Sky Betting & Gaming (SBG) liable for processing the personal data of a player with a diagnosed gambling disorder without valid consent. In a decision dated 21 April 2026, the court held that consent to data processing and direct marketing must be assessed based on the user’s observable actions, not on their psychological state at the time of consent. The ruling sets an important precedent for how consent is assessed across the online gambling industry.
Problem gambling, cookies and targeted advertising
The claimant, anonymised in court documents as RTM, is a player with a diagnosed gambling disorder. He brought a claim against SBG, one of the UK’s largest gambling operators, alleging that the company had unlawfully processed his personal data.
RTM claimed that SBG placed cookies on his devices, collected personal data and sent him personalised, targeted gambling advertisements without lawful consent. He argued that this marketing activity materially worsened his gambling disorder, resulting in significant financial losses and emotional distress. RTM disclosed losses of £45,000 between 2007 and 2019, during which he used SBG’s platforms, though not exclusively.
The High Court decision
At first instance, Mrs Justice Collins Rice applied what she termed a subjective consent test. In her interpretation, valid consent to data processing requires more than a formal act such as ticking a checkbox. It requires a “fully autonomous choice” by the user, assessed by reference to the individual’s actual mental state at the time consent was given.
The judge accepted that RTM had performed the formal actions indicating consent. However, taking into account his “gambling addiction, associated vulnerability and limited autonomy,” she concluded that “the autonomous quality of his consent was substantially impaired” and that consent had been given in a way that fell significantly below the required standard and was “insufficiently freely given.”
Notably, RTM himself had not advanced arguments regarding impaired autonomy; the judge independently introduced that criterion into her legal analysis. This became one of the grounds for appeal. SBG appealed on two bases: procedural unfairness, on the basis that the decision rested on arguments the claimant had never raised; and legal error in the application of the consent test. The Information Commissioner’s Office (ICO), the UK’s data protection regulator, intervened in support of SBG, arguing that the consent test should be exclusively objective in nature.
The Court of Appeal: an objective standard for consent
The Court of Appeal upheld SBG’s and the ICO’s arguments. Lord Justice Warby, writing the court’s judgment, held that establishing consent requires proof that the data subject made a statement or took a “clear affirmative action” indicating their wishes regarding data processing or direct marketing.
“These are purely objective questions,” Lord Justice Warby emphasised. Such an action can be “as simple as ticking a box or a similar act.” Consent must be freely given, specific, informed and unambiguous, and each of these criteria is also objective in nature.
The court held that proving consent does not require a data controller to determine what was “actually in the mind” of the data subject at the time. Nor is there any obligation to prove vulnerability or assess the extent to which their capacity to make fully autonomous decisions may have been impaired.
RTM’s gambling disorder was therefore found to be irrelevant to the validity of his consent. The court held that the first-instance decision was a “legally mistaken approach” and allowed the appeal. The case will now return to the High Court.
GDPR and consent requirements in gambling
The case turns on core provisions of European and UK data protection law. Article 4(11) of the GDPR defines consent as “any freely given, specific, informed and unambiguous indication of the data subject’s wishes.” UK GDPR retains this definition post-Brexit, while the Privacy and Electronic Communications Regulations (PECR) impose additional requirements for cookies and direct marketing.
In the context of the gambling industry, these rules carry particular weight. Operators rely heavily on targeted advertising to acquire and retain players, a practice that involves processing substantial volumes of personal data. The UK Gambling Commission (UKGC) has significantly tightened marketing requirements in recent years, particularly regarding vulnerable players. Those rules primarily concern the content of advertising rather than the legal basis for data processing.
| Instrument | Key consent requirements |
| GDPR (Art. 4(11)) | Freely given, specific, informed, unambiguous |
| UK GDPR | Clear affirmative action (checkbox, click) |
| PECR | Specific requirements for cookies and direct marketing |
Source: SiGMA News.
Related data protection cases in iGaming
The RTM v SBG ruling sits alongside a series of data protection disputes in the gambling sector.
- In Lloyd v Google (2021), the UK Supreme Court rejected a class action over unlawful cookie use, holding that individual assessment of loss was required for damages claims, significantly limiting the scope for mass data protection claims.
- In Galvin v BGO Entertainment (2023), the operator was fined £5.4m for sending marketing communications to players registered with a self-exclusion scheme. That case concerned the breach of an explicit prohibition rather than the quality of consent.
- In 2024, Entain paid £17.5m under a settlement with the UKGC for systemic failures in its treatment of vulnerable customers: a matter primarily of responsible gambling obligations rather than data protection law.
Implications for the gambling market
The Court of Appeal’s ruling substantially clarifies operators’ legal position. Where a user has taken an objective action indicating consent, ticking a box, clicking a button, or following a confirmation link, that consent is valid regardless of the individual’s psychological state or the presence of a gambling disorder.
That does not, however, mean operators face no further obligations. The UKGC continues to require operators to adapt their marketing practices to account for player vulnerability. GamStop self-exclusion, deposit limits and AI-based behavioural monitoring remain mandatory elements of compliance programmes.
The UK online gambling market, the largest in Europe, generates approximately £17bn in gross gaming revenue annually, with a significant share of that income tied to digital marketing. The ICO is expected to publish updated guidance on consent in the online gambling context in the coming year, Stephen Almond, ICO Executive Director of Regulatory Risk, stated. The UKGC, meanwhile, continues to develop tighter requirements for responsible marketing.
This article was first published in Russian on 28 April 2026.
Stay ahead of iGaming’s biggest stories with SiGMA’s Top 10 News countdown. The world’s biggest iGaming community brings you weekly insights and subscriber-only offers. Join HERE today.
