Consent and Loyalty Programmes: What Members Actually Agree to Share

Published 2026-10-23

A loyalty card feels like a simple swap: the shop tracks what you buy, and you get points, discounts, and the odd free coffee. The tracking behind that swap now reaches far past the till. Purchase histories feed advertising profiles, partner offers, and data products that members rarely picture when they tap sign up on a phone screen.

This guide unpacks the consent inside loyalty programmes: what joining reasonably covers, where partner sharing crosses a line, how long data should be kept after you leave, and the questions a scheme should be able to answer in plain language.

Joining covers the scheme, not every future use

Signing up fairly covers the retailer recording your purchases, linking them to your account, and using them to run the scheme and personalise its own offers. That is the deal as members understand it. It stretches badly when the same tap is treated as agreement to share identifiable purchase data with partners, brokers, or advertisers the member has never heard of. Each step away from the original scheme needs more justification, not less. A layered notice at sign up, with the essentials on the first screen and sharing choices as real switches, respects both the members time and the weight of what is being asked.

Purchase history is more revealing than it looks

A basket history is not a list of groceries. It shows health conditions through pharmacy buys, finances through spending patterns, household makeup, celebrations, and struggles. Alcohol, pregnancy tests, and debt advice leaflets all sit in the same record as milk. That sensitivity is why aggregated insight products built from scheme data deserve scrutiny: groups can be small enough, and combinations detailed enough, that anonymity is thinner than the brochure claims. Schemes should test their sharing against a simple standard: would a reasonable member, shown this exact use, feel the sign up form had honestly described it.

Leaving a scheme should end the story

Members who close an account usually assume their history goes with it. In practice, purchase records often persist for years under retention policies written for fraud or accounting, then quietly keep feeding models. Some retention is legitimate: tax records and chargeback windows are real. But retention for record keeping is not a licence to keep using the data for marketing or sharing. On exit, marketing use should stop at once, sharing should stop with it, and what remains should be named, minimised, and deleted on a stated date. A scheme that cannot say when a leavers data is gone has not finished designing its consent.

Questions every scheme should answer on one page

Members should be able to find, without a lawyer: what is collected, who it is shared with by name or clear category, whether insights are sold, how long data is kept after leaving, and how to opt out of sharing while keeping basic membership. Publishing those answers in one place is cheap and revealing. Schemes that do it tend to find their own teams finally agreeing on what the programme actually does, which is half the battle. For shoppers, the practical move is to check that page before joining, use a separate email, and treat any scheme that hides its sharing list as telling you something important.

Related reading

These earlier guides cover connected questions in more depth: Storing Consent Proof: Logs, Receipts, and Records That Survive an Audit, Cookie Consent in Single Page Apps: Routing Without Reloads, and Debugging Consent Mode Signals When Numbers Do Not Match.

Frequently asked questions