Guide 42 · Data and privacy

Loyalty data: ownership and consent

Your member data, transaction history and program rules are the lasting asset of a loyalty program; the platform that stores them can be replaced. Secure that asset in the platform contract with clear ownership, export and exit terms. Use the data only on a lawful basis: what members need to run their account, plus separate, recorded consent for marketing, and honor members' privacy rights without taking away the benefits they are entitled to.

Published Oct 27, 2026Updated Oct 27, 20267 min readBy Loyalty Register Editorial Team

Loyalty program data privacy comes down to two jobs: make sure you, not your platform vendor, control the member data, and use it only in ways members agreed to and the law allows. Underneath the rewards, a program is a database: who your members are, what they bought, what they earned and redeemed, and what they agreed to. This guide covers the contract terms, the consent rules, the US notice most programs need and a yearly audit.

Who owns it

What data does a loyalty program hold, and who owns it?

Most programs hold four kinds of data: identity (name, email, phone, account number), transactions (what was bought, where and when), program records (points earned, redeemed and expired, tier history) and preferences (consents, communication choices and anything members tell you directly, often called zero-party data).

All of it is first-party data: collected by you, from your own customers. But the data often lives on a vendor’s platform, and ownership on paper is not the same as control in practice. If you cannot get a complete copy of member histories and tier logic out of the platform, you cannot change vendor without starting your members again from zero. The platform is replaceable; the member record is not.

The contract

What should your platform contract say about data?

Treat data terms as a selection criterion, not fine print. Before signing, check that the contract covers:

Term	What to look for
Ownership	You own member, transaction and program data, including data the platform derives from it
Export during the contract	Full raw exports on request, in a documented format, without extra fees
Exit	Complete export of members, balances, transaction history and rule settings, plus help with migration
Vendor use	Limits on using your data for other clients, models or benchmarks
Security and location	Where data is stored, who can access it, breach notice terms
Deletion	Confirmed deletion after exit and when members request it

Test the export before you depend on it: ask for a sample during the evaluation. If a vendor will not commit to full export, that is a reason to negotiate or choose another. For the practical side of switching, see loyalty platform migration.

Lawful basis

What legal basis do you need to use member data?

Under the GDPR, which applies to EU members, every use of personal data needs a lawful basis. Running the member’s account, crediting points and sending statements can usually rest on the contract with the member. Marketing usually cannot, because it is not necessary to run the account, so it generally needs consent: a genuine, specific choice that is not bundled with joining and that members can withdraw at any time. Your privacy counsel should confirm the basis for each use.

The stakes are high. Under Article 83 of the GDPR, infringements of the basic processing principles, including the conditions for consent, can be fined up to 20 million euros or 4% of worldwide annual turnover, whichever is higher. For programs with members in several regions, see loyalty program laws.

Sources for this section

Regulation (EU) 2016/679, Article 83(5) (EUR-Lex) F-GDPR-01

Collect consent

Keep it separate and provable:

One box to accept the program terms, and a separate, unticked box for each marketing channel or purpose, such as email offers, text messages or partner offers.
No pre-ticked boxes, and no making membership conditional on marketing consent.
A record of each consent: member ID, the exact wording shown, its version, the date and time, and where it was given.
A simple way to withdraw, such as a preference center, that takes effect quickly.
Staff trained not to tick boxes on a customer’s behalf at the counter or on the phone.

Withdrawing marketing consent is not leaving the program. The member keeps their account, points and status; only the marketing stops. A consent management tool, or a clear table in your platform, keeps these records in one place.

US member rights

What rights do members have in the US?

There is no single federal privacy law for loyalty programs, but state laws apply. Under the California Consumer Privacy Act, California consumers have the right to know what personal information a business collects and how it is used, the right to delete it (with some exceptions) and the right to opt out of its sale or sharing.

The CCPA speaks directly to loyalty-style offers. The California Attorney General says businesses may offer promotions, discounts and other deals in exchange for personal information, but only if the incentive is reasonably related to the value of that information. At the same time, businesses cannot deny goods or services, charge a different price or offer a lower quality of service because a consumer exercised their CCPA rights.

In practice, that means a Notice of Financial Incentive. Under the CCPA regulations it must be available where people see it before they opt in (online, a link to the right section of your privacy policy is enough), and it must include:

a short summary of the incentive and its material terms, including the categories of personal information involved;
how to opt in, and how to withdraw at any time;
a good-faith estimate of the value of the member’s data, the method used to calculate it, and how the benefit relates to that value.

The regulations use loyalty examples. A grocery store that drops a member from its coupon program after they opt out of the sale or sharing of their data acts in a discriminatory way unless it can show the discounts are reasonably related to the value of that data. A retailer, on the other hand, may keep a member’s email and spend history after a deletion request when the member wants to stay in the program. The California Attorney General has also reported enforcement against loyalty programs that ran without a compliant notice; the fixes included notices posted at cash registers and enrollment redesigned to capture express opt-in. Have legal counsel review your version.

Keep less

How much data should you keep?

Less than you think. Every field you collect has to be protected, disclosed and eventually deleted. Apply data minimization: for each field, write down why you need it, and drop fields with no clear purpose. A full date of birth or home address, for example, is often collected out of habit when a birth month or postal code would do.

Set retention periods for inactive accounts and for marketing records, publish them in your privacy notice, and delete or anonymize data when they end. Shorter retention lowers the cost of a breach and the work of answering access and deletion requests.

Audit it

How do you audit your program’s data?

List every field you collect, where it is stored and why you need it.
Map every use of the data to a lawful basis or a recorded consent.
Check the consent records for wording, version and timestamp.
Test a member request: export, correct and delete one account end to end, and time it.
Ask your platform for a full export and confirm it is complete and usable.
Check the incentive notice still matches the program’s current benefits and data use.
Review the contract against the table above, and fix gaps at renewal.
Repeat yearly, and whenever you add a partner, channel or new use of the data, such as personalization.

Back to the seven questions

Frequently asked questions

Who owns the data in a loyalty program?

The business running the program should own its member and transaction data, but only the platform contract makes that true in practice. Check that the contract states ownership, gives you full export rights during the contract and at exit, and limits what the vendor can do with the data.

Do you need consent to run a loyalty program?

Not always for the core program. Under the GDPR, running a member's account, crediting points and sending statements can rest on the contract with the member. Marketing usually needs separate consent. US state laws differ, so check the rules where your members live.

Can marketing consent be part of the program terms?

It should not be. Bundling marketing consent into the terms means members cannot join without agreeing to marketing, which under the GDPR undermines the consent. Use separate, unticked boxes for each marketing channel.

What happens to a member's points if they withdraw marketing consent?

Nothing should. Withdrawing marketing consent is not the same as leaving the program. Keep the account and balance, and stop the marketing.

Does a loyalty program need a Notice of Financial Incentive?

If the program gives California consumers rewards or discounts in exchange for personal information and the CCPA applies to your business, yes. The notice must be available where people see it before they opt in, and it must explain the terms, how to withdraw and how the benefit relates to the value of their data.

Can a member opt out of the sale of their data and stay in the program?

Under the CCPA regulations, removing a member from a coupon and discount program because they opted out of the sale or sharing of their data is discriminatory, unless the business can show the benefits are reasonably related to the value of that data. Plan for members who opt out and still want to earn.

Sources

Checked 2026-10-23