In a ruling that provides much-needed legal clarity for the UK iGaming sector, Sky Betting and Gaming (SBG), a subsidiary of Flutter Entertainment, has won a high-profile appeal against a previous High Court decision regarding data consent.
Objective vs. Subjective Consent
The case centered on a problem gambler known as “RTM,” who claimed SBG acted unlawfully by using tracking cookies and sending targeted marketing despite his addiction. The original High Court ruling had favored RTM, arguing that his gambling problem meant he “lacked subjective consent” and could not make autonomous decisions.
However, the Court of Appeal overturned this judgment on all five grounds. The judges ruled that under UK data protection law, consent is an objective act. It is judged on what a person actually does, such as clicking an affirmative box, rather than what they are thinking or their internal level of vulnerability.
Lord Justice Warby was definitive in his lead judgment:
“To prove consent, the data controller does not have to prove what was actually in the mind of the individual data subject at the time of the ‘indication’. It is neither necessary nor relevant for this purpose to explore whether the individual data subject was vulnerable, with an impaired ability to make fully autonomous decisions.”
Implications for the UK Market
The Information Commissioner’s Office (ICO), which joined the case, agreed with the objective definition but suggested vulnerability should still be a factor. The court rejected this, noting it would create “unworkable uncertainty” for businesses.
This victory for SBG ensures that operators can rely on clear, affirmative user actions to satisfy legal requirements, rather than being forced to assess the mental state of millions of individual customers. The case now returns to the High Court to resolve RTM’s remaining claims regarding fair data handling, but the core precedent on consent has been firmly established.
