{"page":"/blog/loyalty-data-advertising-consent","modified":"2026-11-10","license":"https://creativecommons.org/licenses/by/4.0/","columns":["Data element","Can it leave?","In what form","What has to be true"],"rows":[["Raw transactions and baskets","No, in this architecture","Not exported","Analysed inside only"],["Member name, email, phone","Only with a lawful route","Hashed identifiers for matching","US: treated as sale or sharing in most cases; EU and UK: still personal data when hashed"],["Segment ID (\"lapsed coffee buyers\")","Yes","ID plus segment size","Consent flags checked; minimum size; no sensitive categories"],["Aggregate results (overlap, lift, sales)","Yes","Counts and rates above a threshold","Thresholds stop re-identification of small groups"],["Health or other sensitive inferences","No, unless specific consent","Usually excluded","MHMDA consent and authorization; GDPR Art. 9"],["Payment card numbers","No","Tokens only, inside","Regulation P bars banks from disclosing account numbers for marketing (12 CFR 1016.12)"],["Device identifiers and cookies","Only with consent where required","IDs passed to an owned or partner bidder","EU and UK consent for device access; US opt-out of targeted ads"]],"sourceUrls":[[],[],[],[],[],["https://www.law.cornell.edu/cfr/text/12/1016.12"],[]]}