Guide 44 · Legal and compliance

Loyalty program laws: what changes by region

Loyalty program law changes by region on a few recurring questions: whether points can expire, how marketing consent must be collected, whether you can change the terms on your own, and what happens to dormant balances. The questions stay the same from market to market, but the answers do not. Map them for every market where members join, earn or redeem, and confirm the current rules with local counsel.

Published Oct 27, 2026Updated Oct 27, 20267 min readBy Loyalty Register Editorial Team

Loyalty program laws are rarely one statute. A program is governed by consumer contract law, privacy and marketing rules, gift card and unclaimed property rules, and in a few places regulations written for loyalty programs, and the answers change from one country, and in the US from one state, to the next. This guide sets out the questions that change, the US federal and state rules that apply most often, and how to build a market-by-market check. It is a map of the questions, not legal advice; confirm the current rules in each market with local counsel and record the date you did.

The recurring questions

Which legal questions change from one region to another?

Five questions come up in almost every market:

Expiry. Can points lapse, and with how much notice?
Consent. How must you collect permission to use member data for marketing?
Changes. Can you change the terms, including the value of points, on your own?
Dormant balances. Does unused value belong to the program, the member or the state?
Money-like points. Do points that can be bought, transferred or cashed out fall under gift card, stored value or payment rules?

The stakes differ too. In the EU, infringements of the basic principles for processing personal data, including the conditions for consent, can be fined up to 20 million euros or 4% of worldwide annual turnover, whichever is higher. A program built for one market and copied to another carries that market’s assumptions with it.

Sources for this section

Regulation (EU) 2016/679, Article 83(5) (EUR-Lex) F-GDPR-01

Point expiry

Can loyalty points expire?

The answer usually depends on what the points are. Where points are a free reward the business gives for purchases, expiry is generally a contract term like any other, provided it is clear and members get fair notice. Where points, or certificates issued from them, look like value the member paid for, the rules can be stricter.

California shows the distinction. Its Civil Code makes it unlawful to sell a gift certificate with an expiration date or a service fee. It exempts gift certificates given through an awards, loyalty or promotional program without the consumer paying for them, provided the expiration date is printed in capital letters in at least 10-point font on the front. A program that lets members buy points, or turns points into vouchers, should check how each market treats that value. See points expiry for the design side.

Sources for this section

California Civil Code section 1749.5 (leginfo.legislature.ca.gov) F-G4-02

Marketing consent

Opt-in regimes require an affirmative, separate choice before member data is used for marketing. The UK regulator, the ICO, says silence, pre-ticked boxes or inactivity do not constitute consent, that consent should be unbundled from other terms and conditions wherever possible, and that consent is presumed not freely given if a service depends on consent it does not need. An enrollment form with one box that joins the program, signs up for email and agrees to data sharing fails that test.

Opt-out regimes allow marketing until the member objects. That is the US starting point for email: the FTC says a business does not need members’ consent to send them marketing emails under CAN-SPAM, but members keep the right to opt out. Privacy law still applies. The California Consumer Privacy Act gives consumers the right to know what a business collects, to delete it (with exceptions) and to opt out of its sale or sharing. California’s Attorney General also says businesses may offer discounts and deals in exchange for personal information only if the financial incentive is reasonably related to the value of that information. A loyalty program is often exactly that trade.

Colorado has rules written for loyalty programs. A business must disclose at registration which categories of data it sells or uses for targeted advertising and list its program partners and the benefits each provides. If a member’s deletion request or opt-out makes a benefit impossible, the business may stop that benefit but must keep the others, and must tell the member at least 24 hours before discontinuing a benefit or membership. See GDPR consent and our guide to loyalty data and consent.

Changing the terms

Can you change the program terms whenever you like?

Most programs reserve the right to change their terms. Whether that clause holds depends on the market. In some jurisdictions consumer law lets courts or regulators set aside a term that allows the business to change the deal on its own, especially when the change takes away value members already earned. In others, a clear clause and reasonable notice are enough.

Regulators also watch how changes are made. The US Consumer Financial Protection Bureau received over 1,200 complaints about credit card rewards in 2023, including rewards devalued after cardholders had earned them. In a December 2024 circular it said rewards operators may act unfairly or deceptively when they devalue rewards already earned or revoke them based on buried or vague conditions, even when they follow their own terms. See points devaluation. Give notice before a change takes effect, explain what changes and when, and protect earned balances where you can. A material change notice process makes this routine rather than improvised.

Dormant balances

What happens to dormant balances?

In the US, state unclaimed property law can require businesses to hand dormant value over to the state. Whether loyalty points are covered depends on the state and on how the points work, in particular whether members paid for them and whether they can be exchanged for cash. Illinois, for example, excludes loyalty cards given without payment and redeemable only for goods, services or discounts from its unclaimed property act. Other countries have no equivalent, and an unused balance simply expires under the program terms.

Expiry windows and dormancy periods interact. A rule that cancels points after a period of inactivity may be fine in one market and, in another, sit next to a statutory period that treats the same balance differently. Our guide to unclaimed property and loyalty points covers the US questions in more detail.

One set of terms or many

Should you run one set of terms or one per market?

A program in several markets has a real choice, and both options cost something.

Approach	How it works	Advantage	Cost
One global set	Terms written to the strictest market’s rules	One document, one review, one member experience	Every market carries the strictest obligations, such as longer validity
Regional sets	Terms written per market or region	Each market carries only its own obligations	More documents to maintain and review at every change
Global core plus local annex	Shared terms with market-specific sections	Consistent core, local rules where needed	Annexes drift unless someone owns them

None of these is wrong; the risk is reaching one by default.

Build the market map

How do you build a compliance map by market?

List every market where members live, join, earn or redeem, including partners’ markets.
For each market, answer the five questions above with local counsel, and record the date.
Classify your points: free reward, bought value, transferable, or cash-redeemable. Each step toward money adds rules.
Separate the enrollment choices: program terms, marketing consent and data sharing as distinct actions.
Put expiry, forfeiture and change rights in plain words near the earning rules, not at the end of the terms.
Set a review date. Rules change, and a summary that was right two years ago can mislead.

See program terms and conditions for what the terms themselves should cover.

Back to the seven questions

Frequently asked questions

Are loyalty programs regulated?

Yes, though usually not by one loyalty law. Programs fall under consumer contract law, advertising rules, privacy and marketing consent rules, and sometimes gift card, stored value or unclaimed property rules. Which of these apply depends on where members live and on what the points can do.

Can loyalty points legally expire?

In many places yes, if the terms say so clearly and members get fair notice. The answer can change when points are bought with money or work like stored value. California, for example, bans expiration dates on gift certificates people buy but exempts certificates given free through a loyalty program, provided the date is printed clearly.

Do I need consent to email loyalty members?

It depends on the market. Opt-in regimes such as the UK and EU require a clear affirmative choice, and the UK regulator says pre-ticked boxes do not count. Opt-out regimes allow marketing until the member objects. Build the enrollment flow for the strictest market you serve.

Which loyalty program laws apply in California?

Two stand out. Civil Code section 1749.5 bans expiration dates on gift certificates people buy, but exempts certificates given free through a loyalty program if the date is printed clearly. Under the CCPA, the Attorney General says discounts and deals offered in exchange for personal information must be reasonably related to the value of that information.

Can we change our loyalty program terms at any time?

A clause that lets you change anything at any time is not equally enforceable everywhere. In some jurisdictions it can be set aside as unfair, and in the US the CFPB has said devaluing credit card rewards already earned may be unfair or deceptive even when the terms allow it. Give notice and protect earned balances where you can.

Should a global program use one set of terms?

It can, but one set built for the strictest market makes every market carry those obligations. Separate regional terms avoid that but multiply the documents and reviews. Decide deliberately and record why.

Sources

Checked 2026-10-26