{"page":"/blog/loyalty-data-advertising-consent","modified":"2026-11-10","license":"https://creativecommons.org/licenses/by/4.0/","columns":["Item","Check","Evidence an auditor asks for","Rule it maps to"],"rows":[["1","Each advertising use is listed separately in the privacy notice","Notice text and version history","GDPR Arts. 13-14; state notice rules"],["2","A Notice of Financial Incentive exists where California applies, with a value estimate","Notice and valuation method","11 CCR 7016"],["3","Joining the program is an opt-in, not a pre-ticked box","Sign-up screens","Civ. Code 1798.125(b)(3); CCPA Regs § 7004"],["4","Consent records hold purpose, time, channel and notice version","Consent store export","GDPR Art. 7(1)"],["5","Opt-out preference signals are honoured as opt-outs of sale and sharing","Test logs with GPC on","11 CCR 7025"],["6","Opt-outs apply across every brand and service the member uses","Cross-service test","California AG enforcement record"],["7","Marketing objections stop all related profiling","Objection handling logs","GDPR Art. 21(2)-(3)"],["8","Email and SMS consent is separate from advertising consent","Preference centre screens","PECR reg. 22; ePrivacy Art. 13"],["9","Cookies, pixels and SDKs fire only after consent where required","Tag audit","ePrivacy Art. 5(3); PECR reg. 6"],["10","Sensitive and health categories are excluded or separately consented","Exclusion list","MHMDA; GDPR Art. 9"],["11","Raw transactions are not exported to brands","Data-flow diagram, egress logs","Architecture rule"],["12","Segments have a minimum size and a written definition","Segment registry","Architecture rule"],["13","Each segment carries the consent flags it needs","Registry fields","Architecture rule"],["14","Hashed identifiers are treated as personal data","Data map","GDPR Art. 4; Civ. Code 1798.140(ah)"],["15","No data co-op or list swap runs outside the notice","Contract review","California AG, DoorDash"],["16","Clean-room outputs are aggregates above a threshold","Clean room settings, query log","Architecture rule"],["17","Every partner contract limits use to the stated purpose","Executed contracts","CCPA contract terms; GDPR Art. 28"],["18","Deletions and opt-outs reach partners within a set time","Propagation logs","CCPA; GDPR Art. 17"],["19","Ad delivery logs show which segment and consent state applied","Sample log","Accountability"],["20","The design is reviewed when a new state law takes effect","Review calendar","State law tracker"]],"sourceUrls":[[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[]]}