Loyalty Program Data in Advertising: a consent architecture for US, EU and UK programs

Most consent mistakes start with a vague purpose such as "personalised marketing". Advertising with loyalty data is at least five separate uses, and the law treats them differently.

Card-linked offers are covered in depth in Card-linked offers explained. The other four uses are the subject of this page.

US state privacy laws give consumers rights to opt out of the sale of personal data and of targeted advertising, and most require opt-in consent for sensitive data. The details differ by state, and Mayer Brown's tracker lists 20 states with comprehensive laws as of 3 September 2026 (Mayer Brown).

California is the strictest for loyalty programs. Its law lets a business offer rewards for personal data, but only with prior opt-in consent, a clear notice of the terms and a right to withdraw. It also bars incentive practices that are "unjust, unreasonable, coercive, or usurious" (Cal. Civ. Code 1798.125(b)). The required Notice of Financial Incentive must list the categories of data involved and explain how the price or service difference relates to the value of the member's data (11 CCR 7016).

Three more California rules shape loyalty advertising:

1. Sharing. Disclosing personal data to a third party for cross-context behavioural advertising is "sharing", with or without payment (1798.140(ah)). Sending a member list to an ad platform to target those members elsewhere fits this definition.
2. Opt-out signals. A business that sells or shares data must treat a valid opt-out preference signal, such as an HTTP header, as an opt-out request (11 CCR 7025(b)).
3. Symmetry. A sign-up flow that pre-selects joining a financial incentive program, or makes it more prominent than declining, is not a symmetrical choice. Silence does not count as consent (CCPA Regulations § 7004, text effective 1 January 2026).

Enforcement shows where regulators look. California's Attorney General listed a sweep of loyalty programs without incentive notices in its August 2022 Sephora release, and the Sephora settlement itself turned on Global Privacy Control (California AG, 24 August 2022). The DoorDash case concerned a marketing co-operative in which businesses swap customer data to advertise to each other's customers. Disney paid $2.75 million in 2026 over opt-outs that did not apply across its services (California AG enforcement list, accessed 9 November 2026).

Health inferences raise the bar further. A shopping history can reveal a health condition. Washington's My Health My Data Act requires consent to collect consumer health data, a separate consent to share it, and a signed authorization to sell it (RCW 19.373.030; RCW 19.373.070). Other states' health rules are compared in the state health privacy laws tracker. If the program is run by a bank, GLBA and Regulation P apply first; see Bank advertising rules.

Under the GDPR, each advertising use needs its own lawful basis, usually consent (Article 6(1)(a)) or legitimate interest (Article 6(1)(f)) (GDPR, EUR-Lex). Recital 47 says direct marketing "may be regarded" as a legitimate interest. That helps use 1, the owner marketing its own products. It does not decide uses 2 to 4, where a third-party brand benefits, and a balancing test is still required.

The right to object is absolute for direct marketing. Once a member objects, their data must no longer be processed for that purpose, including profiling linked to it (GDPR Art. 21(2)-(3)). In July 2023 the Court of Justice read Article 6(1) narrowly for personalised advertising on a large platform (CJEU C-252/21, Meta v Bundeskartellamt). Purchase data that reveals health, religion or other special categories falls under Article 9, which in practice means explicit consent or exclusion.

The ePrivacy Directive adds two rules. Reading or writing on a member's device, through cookies, pixels or SDKs, needs consent unless strictly necessary (Art. 5(3)). A company that got an email address in the course of a sale may use it without fresh consent only to market its own similar products, with an easy way to object each time (Art. 13(2)). The Digital Omnibus proposal may change the cookie rule, but no text was adopted by 9 November 2026 (Taylor Wessing, 2026). The bidstream side is covered in GDPR, ePrivacy and the TCF.

The UK kept the GDPR structure but changed two things that matter here. Since 5 February 2026, UK GDPR Article 6(11)(a) lists processing "necessary for the purposes of direct marketing" as an example of a legitimate interest (legislation.gov.uk, UK GDPR Art. 6). It is an example, not an exemption: the balancing test and the right to object remain. The new "recognised legitimate interests" in Annex 1 do not include marketing.

Electronic marketing still follows PECR. The soft opt-in covers a company's own similar products, with a simple way to refuse at collection and in every message (PECR reg. 22); the 2025 Act extended a version of it to charities from 5 February 2026. Cookies and SDKs follow PECR regulation 6 and the ICO's guidance on storage and access technologies. The full list of changes is in the UK Data (Use and Access) Act and advertising.

The architecture below is practice, not a legal requirement. It is the pattern behind the live networks that say advertisers receive no personal data.

1. Notices. A privacy notice that names advertising uses; program terms; a Notice of Financial Incentive where California law applies; a value estimate for the data. Each notice has a version number.
2. Consent and preference store. One record per member per purpose: own marketing, onsite third-party ads, offsite audiences, data collaboration, email and SMS. Each record holds the state, the notice version shown, the time, the channel and any opt-out signal received.
3. Data rules and segment-only export. Raw transactions stay inside. Segments are built from derived attributes, carry a minimum size and the consent flags they require, and leave only as segment IDs.
4. Clean room for collaboration. Brands bring their own data. Queries return aggregates above thresholds, and every query is logged. The clean room options are compared in Clean room architectures compared.
5. Suppression and propagation. Opt-outs, objections, deletions, minors and sensitive categories flow to every downstream system within a set time, including partners that already hold segment IDs.

A hashed email is a matching key, not anonymous data. In the EU and UK it remains personal data, and in California a hashed list sent to an ad platform for targeting fits the definition of sharing.

These are company statements, not legal findings, and they show the pattern.

United (MileagePlus). Kinective uses "aggregated and anonymized" segments, gives advertisers no personal data, and lets US customers opt out (United, 7 June 2024).

Marriott (Bonvoy). Marriott calls its media platform "consent-based, with easy opt-out options" (Hospitality Net, 12 June 2025).

Revolut. Ads appear only in a dedicated shopping section and only for customers who opt in to third-party marketing (The Media Leader, 2023).

CVS Media Exchange (ExtraCare). CVS joins loyalty members to platform users through clean rooms with Pinterest and Reddit, without passing identifiable data, and builds audiences on front-store purchases, not prescriptions (Beet.TV, 16 July 2025).

Cardlytics. The platform says its network analyses bank purchase data "without any personal data leaving" the bank, through an ad server hosted at the bank or on its behalf (Cardlytics 10-K, FY2025).

T-Mobile and Verizon. Both carriers split programs into opt-out tiers on app and browsing data and opt-in tiers that use network data (T-Mobile, 26 June 2026; Verizon, October 2026). The carrier version is explained in Telecom media networks.

Work through these questions in order. Each answer narrows the design; none of them replaces a review of your own facts.

1. Is any of the data sensitive, or could it reveal health, religion, sexuality or finances? If yes, exclude those categories from advertising, or plan for opt-in consent and, in Washington, a signed authorization (RCW 19.373.070). Most programs exclude.
2. Where do members live? If any live in California, check whether the program is a financial incentive and whether offsite use is sharing. If any live in the EU or UK, map a lawful basis to each of the five uses.
3. Does a third-party brand benefit? If no, you are in use 1, and notice plus the right to object usually carries it. If yes, move to question 4.
4. Does anything identifiable leave? If only aggregates and segment IDs leave, design for onsite ads and clean-room results. If hashed identifiers leave for offsite targeting, treat it as sale or sharing in the US and plan for consent in the EU and UK.
5. How will you prove what happened? Buyers and auditors will ask which members saw which ad and on what basis. If you cannot answer from logs, fix that before launch.

Four common outcomes follow. Owned-channel marketing needs the notice, consent store and suppression layers. Onsite ads for brands add segment-only export. Data collaboration adds the clean room. Offsite activation with identifiers needs all five layers and carries the heaviest consent burden.

Take a grocery chain with members in California, Texas and the Netherlands. A cereal brand wants to reach lapsed buyers of its products, first on the grocer's app and then on other sites. The scenario is illustrative; the rules it applies are cited above.

Onsite first. The grocer builds a "lapsed cereal buyers" segment inside its own systems from basket data. The brand's ad appears in the grocer's app to members in that segment. The brand receives impressions, clicks and a sales report, not names. In Texas and California the main questions are notice, the targeted-advertising opt-out and, in California, whether the rewards program has its financial incentive notice. In the Netherlands the grocer needs a lawful basis for profiling members for a third-party brand's benefit, and an objection route.

Then offsite. The brand asks to target the same members on social media. That means hashed member emails leave the grocer. In California this is sharing, so members who opted out, or whose browsers send an opt-out signal, are removed first (11 CCR 7025). In the Netherlands the grocer would usually rely on consent collected for this purpose. Members who never gave it are left out of the upload.

What the brand learns. A clean room returns how many members saw the ad and how their purchases changed against a holdout group. No member-level rows reach the brand. The grocer can show, for each member, which segment they were in and which consent applied, which is the evidence an audit asks for.

The example shows why the same segment can clear the rules onsite and fail them offsite for the same member. Consent has to travel with the segment, not sit in a separate system.

• Consent buried in program terms. A rewards sign-up that bundles advertising consent with membership fails California's symmetry rule if declining is harder than joining (CCPA Regulations § 7004).
• Opt-out signals ignored. Sephora's settlement turned on Global Privacy Control (California AG, 24 August 2022).
• Data leaving through a side door. DoorDash's data went through a marketing co-op and on to a data broker that resold it (California AG).
• Health hidden in baskets. Pharmacy networks build audiences on front-store purchases and keep prescriptions out, as CVS describes (Beet.TV, 16 July 2025).
• Soft opt-in stretched too far. The email exemption covers the sender's own similar products, not a partner brand's ads (PECR reg. 22).

1. California Privacy Protection Agency, CCPA statute text effective 1 January 2026 (Civil Code 1798.125, 1798.140, 1798.145). https://cppa.ca.gov/pdf/20260101_ccpa_statute.pdf
2. California Privacy Protection Agency, CCPA Regulations, text effective 1 January 2026 (incl. § 7004). https://cppa.ca.gov/regulations/pdf/ccpa_statute_eff_20260101.pdf
3. Cornell LII, Cal. Code Regs. tit. 11, § 7016, Notice of Financial Incentive (current). https://www.law.cornell.edu/regulations/california/11-CCR-7016
4. Cornell LII, Cal. Code Regs. tit. 11, § 7025, Opt-out preference signals (current). https://www.law.cornell.edu/regulations/california/11-CCR-7025
5. California Attorney General, "Attorney General Bonta Announces Settlement with Sephora as Part of Ongoing Enforcement of California Consumer Privacy Act" (24 August 2022). https://oag.ca.gov/news/press-releases/attorney-general-bonta-announces-settlement-sephora-part-ongoing-enforcement
6. California Attorney General, Privacy Enforcement Actions (DoorDash, 21 February 2024; Disney, 11 February 2026; accessed 9 November 2026). https://oag.ca.gov/privacy/privacy-enforcement-actions
7. Washington State Legislature, RCW 19.373.030 and 19.373.070 (current). https://app.leg.wa.gov/RCW/default.aspx?cite=19.373.030
8. Mayer Brown, State Privacy Law Tracker (3 September 2026). https://www.mayerbrown.com/en/insights/resource-centers/cybersecurity-and-data-privacy-resource-center/state-privacy-law-tracker
9. EUR-Lex, Regulation (EU) 2016/679 (GDPR). https://eur-lex.europa.eu/eli/reg/2016/679/oj
10. legislation.gov.uk, UK GDPR Article 21 (text of Art. 21(2)-(3) identical to the EU GDPR). https://www.legislation.gov.uk/eur/2016/679/article/21