Why clear consent and legitimate interest is vital when processing personal data

In January 2025, a High Court judgment found Sky Betting & Gaming (SBG) had breached data protection regulations and ruled in favour of an ex-gambling addict who challenged SBG’s use of his personal data for profiling and targeted marketing. The Court ruled in RTM v Bonne Terre Ltd & Hestview Ltd [2025] EWHC 111 (KB) that SBG did not have a lawful basis to gather the Claimant’s personal data through the use of cookies, finding that the Claimant’s personal data was used to market to him in ways beyond his knowledge and that he could not consent to. The Claimant gambled through SBG for nearly a decade and lost over £45,000.

The Claimant argued SBG used cookies to harvest transactional data without obtaining proper consent. He accepted SBG was allowed to use his data to take and process bets and to comply with regulations, however it could not use his transactional data and employ cookies for profiling, algorithmic predictions and personalised marketing.

SBG argued the Claimant had agreed to the use of cookies and marketing communications as he had accepted the ‘cookies policy and privacy notice’ pop up and GDPR updates. Furthermore, SBG maintained it was allowed to rely on its own legitimate interest for the ‘behind the scenes’ processing of the data for marketing purposes.

The UK General Data Protection Regulation (GDPR) (Art.4.11) is clear that consent for data processing must be “freely given”, “specific”, “informed” and “unambiguous” - a standard that SBG failed to meet and that due to the Claimant’s gambling addiction, he “lacked subjective consent” and his decision making was “impaired to a real degree”. Justice Collins Rice noted that consent cannot be freely given where there is a “clear imbalance” between the data controller and the subject. Legitimate interest could not be argued here as there is no legitimate interest to this data subject of processing personal data and profiling for marketing.

When making the judgment, Justice Rice Collins stated the ruling should not be used as a precedent and that the gambling community’s data protection practices have since improved and that this ruling was specific to the timeframe in which the events happened and the relevant period in the claim (around 2017 and 2018). Justice Collins Rice also emphasised in her judgment that she was working with the facts of the case, which need to be looked at and studied on a case-by-case basis. In the case of the Claimant, he was in an incredibly vulnerable position, which was taken advantage of by the use of cookies and targeted marketing by the Defendant, Sky Betting & Gaming.

As the Judgment states, it is not necessary for online gambling companies to market to their users in order for the users to gamble, it is something the companies, such as SBG, choose to do for commercial benefit. It will be interesting to see the impact this Judgment has on the behaviours and conduct of those marketing gambling, or indeed other industries that are unable to prove legitimate interest in their forms of marketing and whether we will see more cases examining the concept of consent or legitimate interest within data protection law.

A remedy hearing is to be listed later this year. The Judge specified at the end of her judgment that she does not, by any means, expect this to be an easy task by way of quantification.

We support clients across multiple industries to deliver commercial, regulatory and structuring, data and data protection expertise. We advise our clients on how to keep pace to remain regulatory compliant with data privacy legislation. If you would like a conversation about how we can assist you, please get in touch.