How to keep loyalty marketing advertising rules compliant

What to take away

Loyalty marketing advertising rules are the mix of advertising standards, privacy law and consumer protection that govern how a loyalty scheme is promoted and run in the UK. The checklist below sets out what to verify before a campaign goes live, from CAP Code claims to PECR consent and consumer law.

The CAP Code applies to loyalty promotions, points offers and referral incentives, and the ASA enforces it through its AdviceOnline library for marketers.
Electronic referral messages and loyalty emails need a lawful basis under PECR, which the ICO explains in its direct marketing and privacy guidance.
The Data Protection Act 1998 has been replaced by the UK GDPR, but its historical text still appears in older scheme documents and should be updated.
Consumer law on pricing, expiry and availability sits alongside advertising rules, so promotional terms must match what members actually receive.
This is general guidance only; individual campaigns need advice from a qualified solicitor or compliance adviser.

Check the claim before the creative

Every loyalty headline is an advertising claim. The CAP Code's misleading-advertising rules in Section 3 require claims to be accurate and not omit material information, and Section 8 adds specific rules for promotional marketing. If a scheme says members earn points on every purchase, that must hold for every category shown in the ad.

Main claim vs small print

Main claim

Points on every purchase: All categories
Points multiplier: Applies broadly
Delivery: Included
Sale items: Included
Placement: Near offer

Small print

Points on every purchase: Exclusions stated
Points multiplier: Gift cards excluded
Delivery: Excluded
Sale items: Excluded
Placement: Not footnote

Check the small print against the main claim. Under the CAP Code, significant conditions likely to affect a member's decision must be presented with the claim, not buried in a footnote. A points multiplier that excludes gift cards, delivery or sale items should say so near the offer.

Confirm consent for referral and loyalty messages

Referral marketing usually means sending a message to someone who has not opted in. Under PECR, electronic mail marketing needs consent unless the soft opt-in applies. That exception only covers an existing customer whose details were obtained in a sale or negotiations for a sale, marketing of similar products, and a simple opt-out at collection and in every message; a friend's recommendation does not supply it.

Loyalty programme emails and texts count as direct marketing even when they carry points balances. Segment transactional messages from promotional ones and record the consent basis for each, as the ICO's Direct Marketing Guidance expects. If your scheme sends on behalf of a partner brand, the consent must cover that brand.

Update the data protection paperwork

Older loyalty schemes often still cite the Data Protection Act 1998, which has been superseded. Privacy notices, consent wording and processor contracts should now point to the UK GDPR and the Data Protection Act 2018. The ICO's Direct Marketing Guidance and its Guide to the UK GDPR explain how to record consent, handle subject access requests and set retention periods.

Check that the privacy notice names every purpose you use member data for: points administration, profiling, partner offers and referral tracking. Keep a record of when it was last reviewed.

Align the offer with consumer law

Points expiry, minimum spend and reward availability are consumer terms as well as advertising content. The Consumer Protection from Unfair Trading Regulations 2008 prohibit misleading actions and omissions, including on price, availability and the conditions attached to a 'free' reward, and the CAP Code's Section 3 price-claim rules require 'free' and 'was' claims to be accurate. The CMA enforces consumer protection law, and the Digital Markets, Competition and Consumers Act 2024 gives it stronger powers to act against unfair commercial practices. Time-limited offers should carry a clear end date.

Referral rewards need the same care: the scheme must verify each introduction and pay within a stated period.

Checklist for UK loyalty campaigns

Claims match the offer across all advertised categories, as required by CAP Code Sections 3 and 8.
Significant conditions appear with the claim, not buried in a footnote.
Consent is recorded for every promotional channel used, with the PECR soft opt-in checked where relied on.
Referral messages have a lawful basis under PECR and follow the ICO's Direct Marketing Guidance.
Privacy notices reference the UK GDPR and the Data Protection Act 2018.
Retention periods are defined for points, referral and profile data under the UK GDPR.
Reward mechanics, expiry and payout times are stated clearly, and 'free' or 'was' claims meet the CAP Code and Consumer Protection from Unfair Trading Regulations 2008.
Terms are reviewed before each major campaign, and the CMA's powers under the Digital Markets, Competition and Consumers Act 2024 are considered.

For scheme design, partner contracts and enforcement, start with the CAP Code, the ICO's Direct Marketing Guidance and the CMA's consumer protection powers under the Digital Markets, Competition and Consumers Act 2024.

Common questions

These are the points that come up most often when loyalty and referral campaigns are checked against the CAP Code, PECR and UK GDPR.

Do loyalty points count as direct marketing under PECR?

A message that only confirms a balance or a transaction is usually service-related. Once it promotes an offer, a partner or a reason to spend points, it is marketing and needs a lawful basis under PECR.

Can a referral reward be paid without the friend's consent?

The reward can be paid to the member, but the friend must still receive a compliant marketing message. Consent is needed before sending promotional email or text to someone who has not opted in.

Does the CAP Code cover social media posts by members?

Member posts are not ads unless the brand controls or incentivises them. Paid partnerships fall within the Code and must be identifiable as advertising.

Is the Data Protection Act 1998 still relevant?

No. It has been replaced by the UK GDPR and the Data Protection Act 2018, so references to the 1998 Act in live scheme documents should be updated.