# Data, privacy and the loyalty card economy
A shopper scans her loyalty app at checkout, gets 15% off diapers, and three days later her phone shows an ad for baby formula from a brand she's never bought. She never told anyone she was pregnant. The app inferred it from her basket. This is not hypothetical: Target's pregnancy-prediction scoring model, reported publicly over a decade ago, remains the textbook case regulators cite when explaining why "just personalization" can cross into unlawful profiling.
Loyalty programs are retail's biggest legal data collection engine. They also sit at the center of the most consequential privacy rules retailers face. This lesson maps those rules and what compliant personalization looks like in practice.
A loyalty card links a name, phone number or email to every purchase a customer makes. Over time this builds a detailed behavioral profile: health conditions inferred from pharmacy or grocery purchases, financial stress inferred from discount-seeking patterns, even sexual orientation or religion inferred from product categories.
Regulators treat this as personal data (any information relating to an identified or identifiable person) and, when the inferences touch health, religion, sexuality or similar categories, as special category data, which gets stricter protection under EU law.
The core tension: loyalty economics depend on granular tracking and targeted offers. Privacy law demands minimization, transparency and, often, opt-in consent before that tracking happens.
Key requirements for loyalty programs:
Fines can reachreachThe number of unique people exposed to your message in a given period. Unlike impressions, reach counts each person once, no matter how often they see it.Voir la définition complète → 4% of global annual turnover or €20 million, whichever is higher. Reference: EDPB guidelines.
Separate from GDPR, the ePrivacy Directive (sometimes called the "cookie law") governs tracking technologies: cookies, pixels, device fingerprinting. It requires prior opt-in consent before non-essential cookies are placed, including tracking cookies that feed loyalty personalization engines.
This is why EU retail sites show cookie banners with granular toggles rather than a single "accept" button. A banner that only offers "Accept All" with no equally easy "Reject All" is considered non-compliant by most DPAs.
Enforced by the California Privacy Protection Agency (CPPA). CCPA gives California residents the right to know what data is collected, to delete it, and, critically, to opt out of the sale or "sharing" of personal information for cross-context behavioral advertising.
"Sale" is defined broadly: sharing loyalty data with an ad-tech partner for value (even non-monetary value like better ad performance) can count. Retailers must post a clear "Do Not Sell or Share My Personal Information" link. CPRA also created a category of sensitive personal information (precise geolocation, health data, racial/ethnic origin) with extra restriction rights.
Other US states (Virginia, Colorado, Connecticut, Utah, and a growing list as of 2026) have similar comprehensive privacy laws, creating a patchwork retailers must navigate state by state, since the US has no single federal privacy law equivalent to GDPR.
The Federal Trade Commission (FTC) polices "unfair or deceptive acts or practices" nationally. It has repeatedly gone after retailers for privacy-policy mismatches: saying data won't be shared, then sharing it; or using dark patterns to obscure opt-out choices. FTC settlements have also required companies to delete data and algorithms trained on improperly collected data ("algorithmic disgorgement").
Profiling itself isn't banned. What's restricted is:
1. Solely automated, high-impact decisions without human review or a way to contest them (GDPR Article 22).
2. Using sensitive inferences (pregnancy, health, financial hardship) for targeting without a valid legal basis and, in the EU, often without explicit consent.
3. Combining datasets (loyalty purchase history + third-party ad-tech data + location data) to build profiles more detailed than what the customer reasonably expected when they signed up.
A concrete compliance example: a supermarket chain wanting to send personalized diabetes-friendly recipe offers based on sugar-purchase patterns would, under GDPR, likely need explicit consent because it touches health inference, plus a clear opt-out, plus documentation of why this isn't "solely automated" if any auto-triggered decision affects pricing or eligibility.
Vérification des acquis
1. What is the core lesson from the loyalty program pregnancy-prediction case cited in the material?
2. Why does loyalty card data create heightened legal risk compared to anonymous transaction data?
3. What is the fundamental tension the lesson identifies between loyalty program economics and privacy law?
4. Select ALL correct answers about how GDPR applies to retailers using loyalty program data.
Sélectionnez toutes les réponses correctes.
5. Select ALL correct answers about what qualifies as 'special category data' under GDPR in a loyalty program context.
Sélectionnez toutes les réponses correctes.
Retailers that get this right share common practices:
A simplified consent-check logic a retailer's engineering team might implement before triggering a personalized offer:
if user.marketing_consent == True and user.region in EU_countries:
if offer.uses_sensitive_inference:
require(user.explicit_consent_sensitive == True)
send_offer(user, offer)
elif user.region == "California" and user.opted_out_of_sale == True:
exclude_from_third_party_sharing(user)
send_offer(user, offer) # first-party personalization still allowed
else:
send_offer(user, offer)This illustrates the practical point: opting out of *sale/sharing* doesn't mean opting out of *all* personalization. First-party, on-platform offers built from a retailer's own dataown dataData collected directly from your own customers and prospects through your own channels: your most reliable and privacy-compliant source.Voir la définition complète → generally remain lawful even after a customer restricts third-party sharing.
GDPR Explained in Simple Terms