Loyalty Register glossary
CCPA
The California Consumer Privacy Act, which gives California residents rights over their personal information and treats loyalty rewards as financial incentives.
The CCPA (California Consumer Privacy Act) is California’s main consumer privacy law. It gives California residents the right to know what personal information a business collects about them, to delete it (with some exceptions) and to opt out of its sale or sharing. For loyalty teams, the key part is the CCPA financial incentive rule, which covers rewards and discounts offered in exchange for personal information: in other words, most loyalty programs.
Updated · By Loyalty Register Editorial TeamRelated terms
Which businesses does the CCPA apply to?
According to the California Attorney General, for-profit businesses that do business in California and meet any one of three tests: gross annual revenue over $25 million; buying, selling or sharing the personal information of 100,000 or more California residents or households; or deriving 50% or more of annual revenue from selling it. Many national retailers, restaurant chains, hotels and airlines meet at least one. Covered businesses cannot deny service, charge a different price or give a lower level of service because a member used their rights.
Why is a loyalty program a CCPA financial incentive?
Because members get points, prices or perks in return for data. The law allows that only if the incentive is reasonably related to the value of the data, and the regulations add that a business that cannot make a good-faith estimate of that value, or show the link, must not offer the incentive. It is enforced: in 2022 the Attorney General found loyalty programs without a compliant notice; they then posted notices at registers and redesigned enrollment to capture express opt-in consent.
What must a notice of financial incentive include?
The notice must be easy to find before the member joins (online, a link to the relevant section of the privacy policy is enough). It must contain:
- a short summary of the program;
- its material terms, including the categories of personal information involved and the value of the member’s data;
- how to opt in, and the right to withdraw at any time and how;
- how the benefit relates to the value of the data, with a good-faith estimate of that value and the method used.
Accepted valuation methods include the marginal or average value of the data, the revenue or profit it generates and the cost of running the incentive; the business must document its method.
What happens when a member deletes data or opts out?
In the regulations’ examples, a grocery store that drops a member from its discount program after an opt-out of sale or sharing acts in a discriminatory way unless the discounts are reasonably related to the value of the data. A retailer may keep a member’s email and spend history after a deletion request if the member wants to stay in the program.
Map what data you collect and share, test what a deletion or opt-out does to points and tier, and keep the valuation on file. For other states, see loyalty program laws by region.