Rules and ethics
Part of Why loyalty marketing rules and ethics matter for UK schemes
UK loyalty marketing rules to check before launch
A pre-launch guide to UK loyalty marketing rules, covering UK GDPR, PECR consent and soft opt-in, consumer law, ASA sanctions and referral schemes.
What to take away
- The most common mistake is treating loyalty marketing as purely commercial. Across the UK, the UK GDPR and Data Protection Act 2018 govern personal data processing and its lawful bases.
- The Advertising Standards Authority (ASA) administers the CAP Code; misleading loyalty advertising can lead to ad alerts, pre-vetting, withdrawal of trading privileges or referral to other regulators.
- The ICO's direct marketing advice generator can help check consent and opt-out wording. PECR governs direct marketing by email and text, including the limited soft opt-in exception.
- Referral incentives need their own lawful basis. A member's enthusiasm does not amount to a friend's consent, and a business cannot use the soft opt-in for a friend's details supplied by that member.
- This is general guidance. Individual cases need a qualified adviser.
Where the rules come from
A loyalty scheme that collects personal data is subject to the UK GDPR and Data Protection Act 2018 across the UK, not just England. For current unfair-commercial-practices rules, the Digital Markets, Competition and Consumers Act 2024 succeeded the Consumer Protection from Unfair Trading Regulations 2008; the Consumer Rights Act 2015 also covers consumer rights and contract terms. The Competition and Markets Authority (CMA) and local Trading Standards are among the consumer-law enforcement authorities. A retailer configuring a loyalty marketing platform such as LoyaltyLion should check that its set-up records permissions and displays scheme terms clearly; using a platform does not itself establish a lawful basis.
Article 6 of the UK GDPR lists six lawful bases: consent, contract, legal obligation, vital interests, public task and legitimate interests. Choose and document a basis for each processing purpose; if you rely on legitimate interests, assess and record the balance between your interests and the individual's rights. Our guide to loyalty marketing data protection in the UK explains how members' rights to access, correct and erase personal data work in practice.
Advertising and ASA sanctions
The Advertising Standards Authority (ASA) administers the CAP Code. Loyalty promotions must be clear and not misleading. If it upholds a complaint, the ASA can publish its ruling, issue ad alerts, require pre-vetting of future ads, withdraw trading privileges or refer the matter to another regulator.
Imagine a retailer advertising "earn £10 in points for every £50 spent" while excluding most categories.
ASA complaint and sanctions
- Loyalty promotion must be clear
- Complaint upheld by ASA
- Pre-vetting of future ads ordered
- Outcome published
Consent and direct marketing
The Privacy and Electronic Communications Regulations 2003 (PECR) govern direct marketing by email and text. For individual subscribers, get consent unless the limited soft opt-in applies: you obtained the details directly during a sale or negotiations for a sale, you market your own similar products or services, and you offered a clear chance to opt out both when collecting the details and in each message. The ICO's consent for electronic marketing guidance is relevant; consent must be recorded, granular and as easy to withdraw as it was to give.
The ICO's direct marketing advice generator tests your setup and returns tailored answers, a sensible check before you build a sign-up flow. Part 2, Chapter 2 of the Data Protection Act 2018 sets out specific processing provisions. The ICO also maintains a register of fee payers: check whether your organisation must pay the data protection fee or is exempt.
Referral schemes and data sharing
Referral marketing raises a second set of questions. When a member gives you a friend's contact details, you need a lawful basis to use them, and the friend must know what happens next. Under PECR, the soft opt-in does not apply to a friend's details supplied by someone else; the member's consent cannot stand in for the friend's.
Ask the member to share a referral link so the friend can choose whether to visit and sign up. Do not send the friend a marketing email using details supplied by the member unless the friend has consented to receive it. Our pillar guide, Loyalty marketing: UK rules and compliance guide for 2027, covers the wider compliance picture.
Worked example: coffee shop scheme
A coffee shop in the UK runs a card scheme: one point per £1 spent, free drink at ten points. The sign-up form has a separate marketing email opt-in and links to the privacy notice.
First-year budget is £1,200, mostly printed cards and email software, while marketing emails go to 400 members a month at an average order of £6.
Referral offer: existing members get 50 points when a friend signs up and spends £5.
- Points accountdocument whether contract or legitimate interests is the appropriate Article 6 UK GDPR basis for administering the scheme; legitimate interests requires an assessment.
- Marketinguse the separate email opt-in as consent under Article 6 and meet PECR's requirements.
- Advertisingthe offer reads "50 points for you and a free drink for your friend when they spend £5", with the terms beside it.
- Referralthe member shares an invitation link and the friend chooses whether to sign up; do not use the friend's details for marketing simply because the member supplied them.
Ignoring those steps can lead to ICO action or ASA sanctions. For the most serious infringements, the UK GDPR fine cap is £17.5 million or 4% of global annual turnover, whichever is higher; that is a maximum, not an automatic penalty.
Common questions
Do I need consent to run a loyalty scheme?
Not always. The core scheme needs an appropriate Article 6 UK GDPR lawful basis, such as contract or legitimate interests, depending on the processing. Electronic marketing is separately subject to PECR and generally needs consent unless the soft opt-in applies.
What happens if the ASA rules against my loyalty ad?
The ASA can publish its ruling, issue ad alerts, require pre-vetting of future ads, withdraw trading privileges or refer the matter to another regulator. A ruling can also damage trust and cost sales.
Can I share referral data with third parties?
Only where you have an appropriate lawful basis and have informed the individuals; PECR also applies if the sharing is for electronic marketing. A friend's details should not be passed to third parties for marketing based only on the member's referral.
Is this article legal advice?
No. It is general guidance only. For your circumstances, consult a qualified adviser.
