Loyalty glossary · 11. Legal and compliance (15)
Gdpr Consent
GDPR consent is a freely given, specific, informed and unambiguous indication of a member's wishes by which a loyalty programme can lawfully process personal data where consent is the chosen legal basis.
Many loyalty programmes treat consent as a tick box buried in the terms and conditions. That is not valid consent under GDPR. Valid consent must be separate, granular, and freely given. A programme that bundles data processing for marketing into the membership contract is asking for a complaint. Most loyalty consent is defective as a legal basis.
The arithmetic is simple and unforgiving. A programme accrues 1 million points each month. Under a valid GDPR consent basis, it can use 20 percent of those points, or 200,000 points, for personalised offers. If consent is withdrawn for 5 percent of that 200,000 point pool, the programme loses 10,000 points per month of usable data. That is not a rounding error, it is a structural constraint.
Consent is not a permanent asset. A member can withdraw consent at any time, and the withdrawal must be as easy as the original opt-in. An active member rate does not restore consent, and activity-based qualification does not create a new legal basis. Once consent is gone, the programme must stop using that member's data for the stated purpose.
The larger mistake is using consent as the default basis for every processing activity. Some loyalty operations, such as fraud prevention, can rely on legitimate interests. Trying to force consent onto those activities weakens the legal position. When a member refuses consent, the programme cannot quietly switch to legitimate interests for marketing. The regulator treats that as bad faith.
Consent is a design parameter, not a compliance footnote. The size of the consenting base directly limits how many personalised offers the programme can send. Programmes that treat consent as a relationship to be maintained, rather than a one-off hurdle, hold a larger addressable base over time. That is the only sustainable position.