Rules and ethics
What does CMA consumer law mean for loyalty software terms?
How CMA consumer law applies to loyalty software terms: drip pricing, urgency claims, dark patterns, pre-ticked consent, expiry and the evidence pack to keep.
What to take away
- Loyalty software now sits inside the CMA's consumer law remit: the same pricing, urgency and consent prompts that sell memberships are the ones under scrutiny.
- Drip pricing is the biggest single risk, because a free-to-join scheme that later reveals paid tiers or delivery conditions can mislead at the point of sign-up.
- Dark patterns in loyalty schemes, such as buried expiry terms or pre-ticked consent, fall under the same unfair commercial practices test as any other retail promotion.
- The DMCC Act 2024 gives the CMA direct enforcement powers, so it can decide a breach and fine a business without going to court.
- Redrafting loyalty T&Cs and reward disclosures means stating the price, the expiry rule and the eligibility condition before the customer commits.
- Keep a dated evidence packscreenshots, A/B test records, consent logs and the approval trail for every prompt.
What the CMA means by online choice architecture
Online choice architecture is the design of the choices you present: what appears first, what is pre-selected, how many clicks it takes to decline, and how clearly a price is framed. The Competition and Markets Authority treats that design as a consumer protection question, not a design preference.
CMA choice architecture red flags
- Pre-ticked consent boxes for marketing
- Countdown timers that reset on reload
- Free labels requiring purchase or data
- Paid tier disclosed three screens later
- Sign-up screen hides true cost
If the layout pushes a shopper towards a paid option they would not otherwise pick, the architecture itself is the problem.
The CMA is the UK's independent competition and consumer authority, and its consumer enforcement role covers loyalty markets directly: supermarket schemes, coffee chains, airline points and retail credit all sit in scope. Our governance - Competition and Markets Authority - GOV.UK
The practical test is whether the average consumer can understand the offer at the moment they act. That means the sign-up screen, not the terms page. A loyalty scheme that advertises free membership on the banner and discloses a paid tier three screens later is failing that test, even if the wording is technically accurate.
Three habits draw attention. Pre-ticked consent boxes for marketing. Countdown timers that reset when the page reloads. And "free" labels attached to anything that requires a purchase, a subscription or a data trade. None of these are banned outright, but each needs a defensible reason and a clear disclosure.
The CMA's consumer protection guidance for businesses collects the relevant expectations on promotions, price framing and loyalty offers in one place, and it is the document your legal team should read alongside the DMCC Act. Consumer protection guidance for businesses - GOV.UK
For loyalty teams, the consequence is that prompt copy and screen order are now legal artefacts. Treat the Figma file and the CMS configuration as evidence, because a reviewer will ask for them. If your commercial contracts with partners allocate responsibility for claims, that allocation should match what the screens actually say.
The CMA's consumer enforcement powers are the reason those clauses now need reviewing rather than filing.
Drip pricing, urgency claims and dark patterns in loyalty T&Cs
Drip pricing is the practice of revealing mandatory costs in stages. In loyalty terms, the classic version is a free-to-join scheme that requires paid delivery, a minimum spend or a subscription to gain the advertised reward. The headline is true in isolation and misleading in context.
The CMA has pursued drip pricing in online retail and holiday bookings, and loyalty pricing is the same mechanic with a points wrapper. If the reward is only available to members who pay a monthly fee, the fee belongs on the sign-up screen, not in clause 14.
Urgency claims in loyalty schemes usually appear as expiring bonus points, limited-time multipliers or "only 200 rewards left". Each needs a factual basis you can evidence at the time it was displayed. A timer that restarts on refresh is a dark pattern, not a marketing tactic.
Dark patterns in loyalty schemes
- Pre-ticked marketing consent at enrolment
- Expiry terms hidden behind full terms link
- Skip button styled almost invisible
- Points balances shown without expiry date
- Cancellation requires phone call in office hours
- Free rewards require purchase to redeem
- Confusing double negatives in opt-out wording
The underlying unfair trading rules predate the DMCC Act and still apply to loyalty pricing and promotions. The Consumer Protection from Unfair Trading Regulations 2008 set out the misleading actions and omissions that make a commercial practice unfair. The Consumer Protection from Unfair Trading Regulations 2008
A useful discipline is to write the terms as a disclosure policy without hiding the small print. If a term would change a customer's decision, it belongs in the main flow. If it would not, it can sit in the annexe.
Urgency also interacts with the Advertising Standards Authority, which polices misleading availability claims in ads. A loyalty promotion that says "ends Sunday" and continues on Monday is an ASA problem as well as a CMA one. The two regulators read the same screens.
DMCC Act 2024 powers behind CMA consumer enforcement
The Digital Markets, Competition and Consumers Act 2024 changed the enforcement model. It gives the CMA the power to decide whether a business has breached consumer law and to impose penalties directly, rather than applying to court for an enforcement order. Digital Markets, Competition and Consumers Act 2024
DMCC Act 2024 enforcement shift
- 2024Act passed
- Direct CMA penaltiesNo court order needed
- Subscription rulesRenewal reminders and easy cancellation
The Act also introduces specific rules on subscription contracts, including reminder notices before renewal and a clearer cancellation route. Loyalty memberships with paid tiers, points subscriptions and auto-renewing reward clubs fall inside that regime.
For loyalty teams, the practical shift is speed. A CMA investigation can now end in a financial penalty and a published decision without a court timetable. That raises the cost of a badly worded prompt from reputational to financial.
Penalty levels are set out in the Act and in CMA guidance rather than being fixed in advance for every case. Do not rely on a remembered figure from a conference slide. Read the current guidance and the CMA's published decisions.
Three consequences follow for scheme design:
DMCC Act 2024 powers
- Renewal reminders must be sent before the customer is charged, not after.
- Cancellation must be as easy as joining, measured in clicks and in steps.
- Cooling-off rights must be explained at sign-up, not only in the terms.
The CMA's role in consumer enforcement affecting loyalty markets is set out on its own pages, including how it selects cases and what it expects from businesses under investigation. Competition and Markets Authority - GOV.UK
This is also where data protection overlaps. The Information Commissioner's Office enforces UK GDPR and the Data Protection Act 2018, and PECR governs electronic marketing. A loyalty prompt that collects consent must satisfy both the CMA's transparency test and the ICO's consent standard.
Redrafting reward disclosures and expiry terms
Start with the reward itself. A customer should be able to answer four questions before joining: what do I get, what does it cost me, when does it expire, and how do I leave. If any answer requires a click into a PDF, the disclosure is too thin.
Reward disclosure redraft
Before
- Sign-up copy
- Join free and start earning
- Paid tier
- Not mentioned
- Renewal
- Not mentioned
- Cancellation
- Not mentioned
After
- Sign-up copy
- Join free. Points expire 12 months
- Paid tier
- Optional Plus membership costs stated fee
- Renewal
- Renews monthly until cancelled
- Cancellation
- Cancel any time in account settings
A fashion retailer runs a points scheme with a paid tier at a monthly fee, a 12-month points expiry and a birthday bonus. The current sign-up screen says "Join free and start earning".
The redraft says: "Join free. Points expire 12 months after they are earned. Optional Plus membership costs the stated monthly fee and renews monthly until cancelled. Cancel any time in account settings." Same offer, different legal position.
The redrafted loyalty T&Cs and reward disclosures should follow this order:
Redrafting reward disclosures
- State the price of membership, including any paid tier, in the same place as the word free.
- Put the expiry rule next to the balance, in the app and on the web.
- Explain how to cancel in the same number of steps as joining.
- Describe what happens to points on cancellation, closure or account inactivity.
- Name the data uses and separate them from the loyalty benefit.
- Give a version date and a change-notice period.
Expiry terms deserve particular care. A points balance that silently disappears is an omission, and omissions count as misleading under the unfair trading rules. Send a reminder before expiry and show the date beside the number.
Where rewards depend on partner brands, the terms must say who is responsible for fulfilment and what happens if a partner leaves the scheme. Vague partner language is a common source of complaints to both the CMA and the ASA.
Change clauses need a notice period that a customer can actually act on. Thirty days is a common commercial standard, but the test is whether the customer had a real chance to cancel before the new terms applied. This is one area where rules and ethics matter as much as drafting technique.
Testing loyalty software prompts against the guidance
Your loyalty software is where the guidance becomes a build ticket. Most platforms let you configure sign-up copy, consent defaults, expiry reminders and cancellation flows, so the compliance question is a configuration question.
Run a prompt audit in this order:
Loyalty prompt audit steps
- List every screen from first click to first reward
- Screenshot each with date and build reference
- Mark screens missing cost, expiry or condition
- Check default state of every consent toggle
- Time cancellation flow against join flow
- Record fix, owner and release date
Test with the timer running. If a countdown resets on refresh, log it as a defect rather than a design choice. If a points balance displays without an expiry date, that is a disclosure gap, not a UI preference.
Consent defaults are the highest-risk setting. Pre-ticked boxes fail the UK GDPR standard of freely given consent and also fail the CMA's transparency expectation. Default to off, and record the moment of consent with a timestamp.
Check how your platform handles A/B tests. A winning variant that lifts sign-ups by hiding a condition is not a win. Keep the test record, because it shows intent and it shows whether the losing variant was the honest one.
Finally, check the mobile app separately from the web. Small screens compress disclosures, and a term that is visible on desktop can be effectively hidden on a phone. Review both at the same time with the same checklist.
Evidence pack for a CMA-facing review
If the CMA asks questions, the business that answers quickly and completely is in a better position than the one that reconstructs history from memory. Build the pack before you need it.
CMA evidence pack contents
- Dated screenshots of every customer-facing prompt
- Consent log with timestamps
- A/B test records
- Terms version history
- Change-notice emails
- Internal approval trail
- Cancellation and join flow recordings
- Claims register for urgency statements
Add the cancellation flow recording and the join flow recording side by side. Reviewers count steps, and a video is harder to dispute than a description.
Keep a claims register for urgency statements. Each entry should name the claim, the evidence behind it, the period it ran and the person who approved it. If a claim cannot be evidenced, retire it.
Name an owner. A single accountable person for loyalty compliance, with a named deputy, avoids the gap where legal assumes marketing has checked the screen and marketing assumes legal has.
Review quarterly, and after any platform release that changes a prompt. The guidance is stable in principle and specific in application, so the pack needs to move at the speed of your release cycle.
