Rules and ethics
Part of Why loyalty marketing rules and ethics matter for UK schemes
Check consent, disclosure and ad claims in loyalty marketing data protection
A UK loyalty marketing checklist covering lawful bases, PECR email consent, partner-data disclosure, UK GDPR privacy notices and CAP Code reward claims.
What to take away
- Record a lawful basis for each purposecontract may cover scheme administration, while electronic marketing and referral sharing need separate checks.
- ICO consent standards require a positive, informed and unambiguous action, so pre-ticked boxes and bundled terms fail.
- Reward and referral wording is an advertising claim, and CAP Code rule 3.1 bars wording that materially misleads.
- The ICO can reprimand, order processing to stop and fine up to £17.5 million or 4% of annual global turnover.
- The ASA cannot fine, but it can pull ad space and refer repeat offenders to Trading Standards or the CMA.
Decide the lawful basis before you collect a record
Enrolment, points statements, profiling and passing details to a referral partner are separate purposes under the UK GDPR. Each one needs its own basis, as the Data Protection Act 2018 and the UK GDPR set out.
Administering the scheme usually rests on contract. Direct marketing by email or SMS to individual subscribers is also governed by the Privacy and Electronic Communications Regulations (PECR): prior consent is generally needed, unless the soft opt-in applies to your own similar products or services and the required opt-out opportunities are given.
A UK GDPR lawful basis does not replace PECR's rules. Record a separate basis for profiling and referral sharing; do not assume that consent is always the only possible basis.
At collection, explain the controller's identity and contact details, the purposes and lawful basis, recipients or recipient categories, retention, relevant international transfers and the person's rights, including access, erasure, objection and the right to complain to the ICO. Include the data protection officer's contact details where applicable, explain whether providing the data is required and the consequences of not doing so, and describe relevant automated decisions. If data comes from a referrer, also explain its source and categories, and provide the information within the applicable statutory time limit or earlier when first contacting the person or disclosing the data, as applicable. Name known referral partners and state what each receives and why; the guide to a loyalty marketing disclosure policy is worth reading before you publish that wording.
Write opt-in wording that passes the ICO test
Consent must be freely given, specific, informed and unambiguous. The ICO's Guide to the UK GDPR, section 'Consent', says silence, pre-ticked boxes and inactivity do not count. Withdrawal must be as easy as opting in; stop the activity that relied on that consent when someone withdraws.
Keep service messages separate from optional marketing. Ask separately about referral sharing, naming the partner and explaining the purpose before the member agrees.
Points statements are service messages; they are not conditional on marketing consent.
I agree to receive promotional emails about offers from [scheme name]. This is optional, and I can withdraw at any time using the unsubscribe link or my account settings.
I agree that [scheme name] may share my name and email address with [named referral partner] so it can [specific purpose]. This is optional; the privacy notice explains how the partner will use my details.
Consent vs pre-ticked box
Valid consent
- Freely given
- Yes
- Specific
- Yes
- Informed
- Yes
- Unambiguous
- Yes
- Withdrawal
- As easy
Pre-ticked box
- Freely given
- No
- Specific
- No
- Informed
- No
- Unambiguous
- No
- Withdrawal
- Harder
Keep reward and referral claims inside the CAP Code
The ASA administers the CAP Code across the UK; the Committee of Advertising Practice writes it. Marketing communications must be identifiable as advertising, and their commercial intent must be clear when it would not otherwise be obvious. If a referral or affiliate promotion offers a reward for a post, label it as an ad at the outset and make the incentive clear. A promised £10 voucher is an advertising claim, so its value and conditions must be clear before anyone joins.
Reward and referral claims
| Wording you publish | CAP Code reference | What must be clear |
|---|---|---|
| Voucher or cashback value | Rule 3.1 | The amount, how to redeem it and any minimum spend |
| Up to 20% off | Rule 3.7 | Evidence for the maximum, plus the qualifying spend |
| Referral bonus for two people | Section 8 | Eligibility, expiry and who pays the reward |
The ASA publishes rulings and expects amended wording. CAP Code rule 3.7 requires documentary evidence for objective claims before publication; it is a substantiation requirement, not a complete test for an 'up to' saving. Check the overall impression against rule 3.1, disclose material conditions and check the applicable CAP price rules; keep evidence for the calculation, eligibility and exclusions with the claim. Repeat breaches can cost you ad space and trading privileges, and the ASA can refer a case to Trading Standards.
Example: a compliant reward claim
Illustrative example: a coffee chain advertises a free drink on joining, then another after eight stamps. Its terms say the drink is any size, stamps expire after 12 months of inactivity, and staff apply them at the till. Members discover nothing new after signing up.
Before release, review each customer-facing touchpoint: the sign-up page, referral invitation, email and advert. Record what a member sees before joining, compare the stated reward and conditions across the advert and terms, verify evidence for objective claims, and check that incentivised promotions are identified as ads. Apply the same review to tier benefits and paid promotions; Loyalty marketing advertising rules also walks through these checks.
Ad claims compliance checks
- Reward descriptions match stated terms
- Qualify vague wording like 'up to'
- State referral incentive conditions
- Label paid partnerships and affiliate links
- Test sign-up to reward journey
- Flag paid-tier-only benefits before joining
Enforcement: what the ICO, ASA and CMA can do
The ICO can reprimand a scheme, order it to stop processing and fine up to £17.5 million or 4% of annual global turnover. Its £20 million penalty for British Airways in 2020 shows the scale. The ICO's enforcement action against Flybe over marketing emails sent to people who had opted out illustrates that asking recipients to update their preferences can itself be direct marketing. Consent records are your defence when a complaint arrives.
The ASA has no fining power. It can withdraw ad space, impose pre-vetting and refer persistent offenders to Trading Standards or the CMA, which gained direct consumer law enforcement powers under the Digital Markets, Competition and Consumers Act 2024.
Keep consent records and set a retention period
Audit each purpose and channel at launch and when a partner, message or scheme term changes. Keep evidence that lets you check consent, disclosure, claims and how requests to stop or access data were handled:
- The purpose, lawful basis and data source, plus the PECR consent or soft opt-in evidence for email or SMS marketing.
- The exact wording and privacy notice version shown, and the date, channel and source of each opt-in.
- Which partner receives which data, for what purpose, and the information given to the member or other person.
- The date of any withdrawal or objection, plus the action taken across the relevant systems and partners.
- How access and erasure requests are received, tracked and actioned.
- The scheme's record of processing activities, including its purposes, data categories, recipients, retention and security measures.
UK GDPR sets no universal fixed retention period. Set and record a period for each purpose, review it and delete or anonymise data when it is no longer needed; retain only what you can justify for compliance or a live complaint.
Check the ICO's data protection fee self-assessment. Controllers must pay the annual fee unless exempt; confirm the applicable tier and amount with the ICO before budgeting.
Where a partner or platform sits between you and the member, loyalty marketing commercial contracts explains what the CMA's consumer enforcement powers mean for those agreements.
Common questions
Do I need consent to run a loyalty scheme in the UK?
Not always. Running the scheme may rest on contract, but marketing, profiling and referral sharing need a documented basis. Direct marketing by email or SMS to individual subscribers is separately governed by PECR, so do not make scheme membership conditional on optional marketing consent.
Can I share a member's details with a referral partner?
Only where sharing has a valid lawful basis and the member has been told which partner receives the data and why. If details came from a referrer, provide the required privacy information to the person whose details were shared. A UK GDPR lawful basis does not remove PECR requirements for a partner's email or SMS marketing.
Who enforces advertising claims for loyalty promotions?
The ASA administers the CAP Code and can require changes to misleading claims. The ICO handles data protection separately, so one promotion can attract both regulators.
How long must I keep consent records?
For as long as you process the data, plus a documented tail to evidence compliance. UK GDPR sets no fixed figure, so choose one and note your reasoning.
