Key points

• Loyalty programs generate the richest first-party data a retailer holds, and that data is increasingly regulated as personal information, sometimes with special rules for financial incentives.
• State privacy laws, including California's, require specific notices and, in some cases, a good-faith valuation when a program offers benefits in exchange for personal data.
• Regulators treat confusing enrollment, hard-to-find opt-outs and pressure tactics as dark patterns. Consent obtained through them may be invalid.
• Devaluing points, shortening expiry or changing tiers can be unfair or deceptive if the program terms do not allow it or if customers were not told clearly.
• A governance process that brings marketing, privacy, legal and finance together before changes are launched is the most effective control.

Why loyalty programs attract attention

A loyalty program is a bargain: the customer shares purchase and contact data, and the retailer provides discounts, points or perks. The bargain works only if both sides understand it. Regulators have begun to look closely at whether shoppers do, particularly as programs have evolved from simple punch cards into data platforms that feed personalization, retail media and partner offers.

Data use and privacy law

Under the GDPR and UK GDPR, loyalty data is personal data, and profiling for personalized offers or advertising must have a valid legal basis. Where consent is the basis, it must be freely given, which becomes difficult if access to a basic benefit is conditioned on agreeing to unrelated marketing profiling. Transparency is a recurring weakness. Notices should state plainly what data is collected, how purchase history is used, which partners receive it and how a member can withdraw.

In the United States, comprehensive state privacy laws give residents the right to opt out of targeted advertising, sale and certain profiling, and most contain a provision allowing loyalty programs as bona fide arrangements, subject to conditions. California's regulations go further and require a notice of financial incentive that describes the material terms and explains how the business values the data it receives. Other states have their own limits on discriminatory treatment of consumers who exercise privacy rights. A program that withholds a core benefit because a member opted out of data sharing is the situation most likely to draw an inquiry.

Sensitive data deserves a separate look. Purchase histories can reveal health conditions, pregnancy or religious practices, and several state laws restrict processing of sensitive data without consent. Programs that segment members using such inferences should be reviewed by privacy counsel before launch.

Dark patterns in enrollment and consent

Regulators in the United States and Europe use the term dark patterns for interface designs that steer users into choices they would not otherwise make. In a loyalty program, examples include pre-checked boxes for marketing, a prominent accept button next to a muted decline link, repeated prompts after a refusal, and enrollment flows that make it difficult to see what data is being shared. California's privacy regulations provide that consent obtained through such designs is not valid, and the FTC has brought actions based on similar conduct. Teams should test consent screens as a user would, in the app as well as on the web.

Point devaluations and program changes

Points and rewards are a promise, and consumer protection law asks whether that promise is kept. Common sources of complaints include raising the number of points needed for a reward without notice, shortening expiry periods, removing a tier benefit mid-year, and advertising a bonus without stating its limits. Whether a change is lawful depends on three things: what the program terms allow, whether the change was communicated clearly and in advance, and whether marketing created a different expectation.

In the United Kingdom, the CMA treats unfair contract terms and misleading omissions as enforcement priorities, and the Digital Markets, Competition and Consumers Act now allows it to impose fines directly. In the United States, plaintiffs have brought class actions alleging that retroactive changes to earned points were deceptive or breached contract. Reserving the right to modify the program is useful but not decisive, particularly for points already earned.

Practical steps

• Map the data collected through the program and the uses, including sharing with advertisers and retail media partners.
• Check that notices, financial incentive disclosures and consent records match what actually happens.
• Audit enrollment and preference flows for dark patterns and confirm that opting out of marketing does not remove core benefits unless the law permits it.
• Review program terms for change provisions, and apply a notice period and a transition plan for earned points.
• Create a launch checklist so that tier changes, partner offers and new data uses go through legal review.

Retailers that expand loyalty data into retail media should read our related alert on advertising and privacy risks, since the same data set is then being used for a second commercial purpose. A single privacy and consumer review that covers both is more efficient than two separate exercises.