Consumer protection when the client is treated as a VIP, not a number

A sales associate types four words into the client file after an appointment: "buys to impress, negotiates." Eighteen months later that client sends a written access request, and the house has one month to hand over a copy of everything it holds on her, free-text notes included. Nobody wrote that line expecting to publish it. That is the shape of most client-side compliance failures in luxury: not a campaign that broke a rule, but a relationship recorded carelessly.

VIP treatment changes what a brand offers. It suspends none of the obligations the client holds against it.

Why VIP status changes the marketing, not the obligations

The persistent client profile the clienteling lesson describes is, in legal terms, a personal data file with a controller, a stated purpose, a retention period and a set of client rights attached to it. Consumer and data law never asks whether a client is important. It asks four things:

• On what basis was this data collected, and can the house evidence that basis?
• Can the client see the file, correct it, and have it deleted?
• Are the rules that decide who gets scarce product the rules the house says they are?
• Is the price presented honestly, including when the price is personal to her?

Everything below sits under one of those four.

What a client can pull out of the client book

An access request under GDPRGDPREU regulation governing how organizations collect, store and use personal data, with fines tied to global revenue for breaches.View full definition → Article 15 reaches the whole file: purchase history, sizes, allocation notes, the internal potential score, and the associate's free-text commentary. One month to respond, extendable by two for genuinely complex cases. There is no exemption for the commercial sensitivity of an opinion about the client, and no version of the file that only the CRMCRMCustomer Relationship Management: software and strategy to manage and analyse customer interactions throughout their lifecycle.View full definition → sees.

The CNIL, France's data regulator, treats retention as a limit rather than a preference. Its guidance points to roughly three years from last contact for prospect data before deletion or anonymisation; client records live longer, justified by the commercial and accounting purpose, not by the hope that she will come back. In November 2020 the CNIL fined Carrefour France 2.25 million euros in a decision that turned partly on loyalty-programme data held for years beyond need and on privacy notices nobody could reasonably read. A client book that has never had a purge routine carries the same defect with fewer records and a far more intimate one.

Two rights bite harder in luxury than in retail generally:

• Rectification, Article 16. A client who disputes the "high refund rate" flag that quietly dropped her out of preview access can demand that it be corrected, and the house then has to explain how the flag was set.
• Automated decisions, Article 22. Where a tier score alone decides access to appointments or allocation, with no human weighing in, the client can ask for human review and an explanation of the logic. Keeping a named human in the loop is almost always cheaper than documenting the model.

Consent and opt-out, including for the top 100

Electronic marketing needs the same consent from a client who spends 200,000 euros a year as from one who spends 200. The recurring failure is the WhatsApp relationship: an associate messages her best clients from a personal handset, so the data sits outside the CRM. It cannot be produced for an access request, it survives the client's opt-out because nothing connects the two, and when the associate resigns it leaves the building with her.

Sephora, the LVMH-owned beauty retailer whose own tiered loyalty programme is exactly the kind of asset under discussion here, settled with the California Attorney General in August 2022 for 1.2 million dollars. The findings were narrow: it had not disclosed that it sold personal information, and it had not honoured Global Privacy Control opt-out signals sent by browsers. It had also not cured within the 30-day window the CCPA allowed at the time. Note what was not alleged. No breach, no leak, no manipulative campaign. An opt-out signal arrived and nothing on the other end was listening.

Second-order consequence worth naming to a commercial director: the tighter the segmentationsegmentationDividing a market into distinct groups of customers who share similar needs, characteristics or behaviours, so each group can be served with a tailored approach.View full definition →, the more expensive an unhandled opt-out becomes. A client who withdraws consent while remaining a major buyer still has to be served in-store, still expects her preferences remembered, and now cannot be contacted through any automated channel. Someone has to design that path deliberately, or the boutique will improvise it with an unlogged phone call.

Allocation: discretion is allowed, undisclosed conditions are not

A house may decide who receives a quota bag. What it cannot do is state one basis and operate another.

In March 2024, plaintiffs filed a class action against Hermès in the Northern District of California alleging unlawful tying under Section 1 of the Sherman Act: that access to Birkin bags was conditioned on the purchase of ancillary products. The structural allegation matters more to marketers than the headline. The complaint asserts that associates earn commission on the ancillary items and not on the quota bags themselves, which places the pressure in the compensation design rather than in the behaviour of one over-eager employee. Whatever the case produces, the exposure was built by an incentive plan and an unwritten rule, not by anything a copywriter approved.

An edge case worth pricing before it happens: once money moves in advance, discretion turns into contract. A deposit taken against a future allocation creates a consumer contract with refund consequences when the house changes its mind about her. And the 14-day withdrawal right on distance sales under Directive 2011/83 does not apply to goods made to the client's own specification, so the monogrammed, bespoke-leather special order that felt like the ultimate VIP gesture is also the one order she cannot send back. Say that at the point of sale, in writing, or the compliment becomes the complaint.

Pricing transparency when nothing carries a price tag

French rules require goods on display to show prices the client can read without asking; "price on request" is a boutique habit rather than a legal position, and it draws inspection attention precisely because it looks like a policy. The Omnibus directive (2019/2161) adds two obligations that land on luxury CRM directly. Any announced reduction has to reference the lowest price applied in the previous 30 days, which is why a private sale dressed as a discount is riskier than a private sale priced as an offer. And traders must tell the consumer when the price shown has been personalised on the basis of automated decision-making.

That second one separates two practices that feel identical inside the business. A quiet ten percent extended by a director to a long-standing client is a commercial gesture. An engine that infers willingness to pay from device, browser language or postcode and moves the number accordingly triggers disclosure, and it also carries proxy-discrimination exposure: a variable that correlates with nationality or disability produces disparate impact whether or not anyone intended it. Test tiering variables for that correlation before deployment, because after a complaint the burden of explanation sits with the house. Whether the scarcity language wrapped around the price counts as tolerated puffery or a substantiable claim is the line the sibling lesson draws; the question here is narrower, whether the basis of the number matches the basis you told her it had.

Two references worth keeping open while writing client-facing terms: the FTC's Business Guidance on deceptive pricing and endorsements and the European Commission's consumer protection guidance under the UCPD.

🎬 [VIDEO: "How Luxury Brands Use Scarcity Marketing" - youtube.com - search for recent explainer content covering waitlist psychology and its regulatory scrutiny in the handbag and watch sectors]

Key Takeaways

• The client book is a regulated file, not a private notebook. Access requests reachreachThe number of unique people exposed to your message in a given period. Unlike impressions, reach counts each person once, no matter how often they see it.View full definition → free-text notes and internal scores, with one month to respond, so write every line as though the client will read it.
• Retention needs a rule. CNIL guidance points to around three years from last contact for prospects, and the 2.25 million euro Carrefour France decision of 2020 shows what an unpurged loyalty database costs.
• Opt-out is mechanical, not relational. Sephora's 1.2 million dollar California settlement in 2022 involved no breach, only an unread browser signal and an undisclosed data sale.
• Allocation discretion survives; undisclosed conditions do not. The March 2024 Hermès tying class action targets an incentive structure, which is where a compliance review should look first.
• Personalised pricing carries a disclosure duty. Automated price personalisation must be declared under the Omnibus directive, announced reductions must reference the 30-day low, and tiering variables should be tested for proxy discrimination before launch.
• Channels outside the CRM are the standing failure mode: a personal handset holding VIP contacts defeats access requests, opt-outs and deletion in one move.