Why loyalty marketing rules and ethics matter for UK schemes

What to take away

Loyalty schemes sit where advertising, consumer contract and data protection law meet. A points programme or refer-a-friend offer is a promotion, a contract and a data processing operation at once. Each area brings its own regulator: the Advertising Standards Authority for advertising, the Competition and Markets Authority and Trading Standards for consumer law, and the Information Commissioner's Office for data protection. Getting it wrong can mean an ASA ruling, an enforcement order or an ICO penalty.

This guide explains the main rules and the ethical principles behind them. It ends with a checklist for any scheme.

The advertising and data protection rules here apply across the UK: the CAP Code, the UK GDPR and PECR are UK-wide, enforced by the Advertising Standards Authority and the Information Commissioner's Office. Consumer law is set out as it applies in England, where the Competition and Markets Authority and local Trading Standards services enforce it. It differs in places in Scotland, Wales and Northern Ireland, so check the position where you trade.

Advertising and promotional rules

The CAP Code and promotional marketing

The Committee of Advertising Practice Code, enforced by the Advertising Standards Authority, applies to most marketing communications in the UK. Section 3 covers misleading advertising and Section 8 sets the rules for sales promotions: promotions must be legal, decent, honest and truthful. For loyalty schemes, the key rules concern the availability of benefits, the clarity of terms and the avoidance of misleading claims.

If a scheme advertises a reward, its terms must be clear before the consumer commits. The ASA has ruled against promotions that buried significant conditions in small print, or changed them after launch.

A common failing is a reward called "free" when a purchase is required. The advertising advice for businesses from the ASA and CAP explains how to keep promotions compliant, so it is a sensible first stop for scheme designers.

Make the main terms prominent: what the consumer must do, what they receive, and any time limits. Do not rely on a link to full terms alone. The CAP Code also requires that promotional marketing is administered fairly, so if a scheme has limited stock or a closing date, say so.

If a loyalty scheme includes a prize draw or an instant-win mechanic, promotion rules on closing dates and availability sit on top of the ordinary loyalty terms. Treat the two sets of conditions as one promise to the member.

A separate question is who is responsible. The advertiser, the agency and the publisher can all be liable. If you run a referral programme through a platform, you remain responsible for the claims made. For more on the specific advertising rules that apply to loyalty schemes, see loyalty marketing advertising rules in England.

Consumer protection law

Consumer protection law in England mixes statute and regulation. The Consumer Rights Act 2015 sets out rights in contracts for goods, services and digital content.

For loyalty schemes, the relevant parts cover the ban on unfair terms and the need for transparency. A term letting a scheme change rewards without notice, or expire points unfairly, may be challenged.

The Consumer Protection from Unfair Trading Regulations 2008 prohibit misleading actions and omissions. A loyalty scheme that hides a material condition, such as a minimum spend to redeem, can breach these rules. The Competition and Markets Authority enforces them and can take action against traders, and consumers can also seek redress. The Digital Markets, Competition and Consumers Act 2024 strengthens this: it gives the CMA direct enforcement powers, so it can decide a breach itself and impose a penalty without going to court.

Enforcement is shared. The CMA takes on cases with a wider market impact, while Trading Standards services in England handle many local complaints. Either route usually turns on the impression the scheme created at sign-up, so keep a dated record of what members were told and when.

The Consumer Rights Act 2015 also implies terms into contracts, such as that a service will be performed with reasonable care and skill. If a scheme administrator fails to credit points correctly, that may be a breach. Part 3 of the Consumer Rights Act 2015 covers miscellaneous consumer protections, including the powers of enforcement bodies.

The Consumer Contracts (Information, Cancellation and Additional Charges) Regulations 2013 add pre-contract information duties for distance and off-premises contracts, and they require express consent for any extra charge, such as a paid tier or premium membership, rather than a pre-ticked box. If a scheme sells anything online, these rules sit on top of the loyalty terms.

When drafting scheme terms, treat them as a consumer contract. Use plain English, avoid disproportionate penalties and give reasonable notice of changes. If you operate in Scotland, Wales or Northern Ireland, check for devolved differences in enforcement and procedure. For a fuller discussion of the contractual side, read loyalty marketing commercial contracts in England.

Data protection and consent

UK GDPR and PECR

Loyalty schemes process personal data: names, contact details, purchase histories and sometimes location. The UK GDPR, read with the Data Protection Act 2018, requires a lawful basis, transparency and data minimisation. Consent is one basis, but it must be freely given, specific and informed. If you rely on consent for marketing, you must also comply with the Privacy and Electronic Communications (EC Directive) Regulations 2003, usually called PECR.

PECR governs electronic marketing. For consumers, you generally need consent to send marketing emails or texts. The soft opt-in applies only in limited circumstances, such as where you obtained the details during a sale and offer an opt-out.

For business-to-business marketing, the rules differ. The ICO's business-to-business marketing guidance explains when consent is needed and when legitimate interests may apply, which matters for trade loyalty schemes.

A loyalty scheme involves profiling: segmenting customers by spend, frequency or preferences. Profiling can trigger additional rights: the right to object and to human intervention in automated decisions.

Be transparent about what you do with data and how long you keep it. If you use data for a new purpose, such as selling insights, you need a lawful basis and clear notice.

Data security is also part of the law. A breach that exposes loyalty account details can lead to an ICO investigation and a penalty. For a detailed look at data protection in the context of loyalty, see loyalty marketing data protection in England.

Two ICO duties are easy to overlook. Most organisations that process personal data must pay the ICO's annual data protection fee and appear on its register of fee payers. The ICO's direct marketing guidance also sets out, in practical terms, how consent, the soft opt-in and the right to object apply to email, text and calls.

Consent and preference management

Consent is not a one-off. You must be able to demonstrate it, and you must honour withdrawals. A common failing is to bundle consent for loyalty participation with consent for third-party marketing. That is not freely given.

Use separate opt-ins for different purposes. Let members update preferences easily. Keep records of when and how consent was obtained. If you rely on legitimate interests, carry out and document a balancing test. The ICO expects you to respect the right to object at any time.

Records matter as much as wording. Keep a log of the source, date and wording of every opt-in, and of every withdrawal. If a member asks why they are receiving messages, you should be able to answer from that log within minutes rather than days.

Referral schemes add a layer. When a member refers a friend, you may get their contact details, so you need a lawful basis to contact them.

The safest approach is to ask the member to share a link or message rather than handing over data directly. If you receive data, tell the friend how you got it and what you will do with it.

Referral platforms such as Mention Me and Buyapowa handle tracked links, reward issuing and reporting for many programmes. Using one does not move responsibility: the brand is still the advertiser under the CAP Code and the data controller for any personal data the programme collects. Ask the platform how it captures consent, honours withdrawals and logs the referral chain, and keep that evidence.

Ethically, consent should be meaningful. Do not use dark patterns to obtain it. Do not make loyalty benefits conditional on consent to unrelated marketing. The DMA's responsible marketing guidance sets out principles that align with this approach, and it works well as a benchmark when you are writing scheme rules.

Ethics, disclosure and complaints

Ethical scheme design

Ethics in loyalty marketing goes beyond legal minimums. It is about fairness, transparency and respect for the member. A scheme that relies on confusion, hidden conditions or pressure to redeem is unlikely to build long-term loyalty.

Key ethical principles include: do not make promises you cannot keep; do not change terms retrospectively without a good reason and clear notice; do not use expiry rules to confiscate value unfairly; and do not sell data without explicit consent. These mirror the position that the consumer comes first, which sits behind most published responsible-marketing codes.

Another ethical issue is accessibility. If a scheme is only available through a smartphone app, it may exclude some customers. Consider alternative ways to participate. Also consider vulnerable customers, who may be more susceptible to pressure or confusion. The ASA and the CMA both expect advertisers to take care with vulnerable audiences.

A written ethics policy helps. It sets expectations for staff and partners, and it gives you a framework for decisions when the law is unclear. For a template and discussion, see loyalty marketing disclosure policy in England.

Disclosure and complaint routes

Disclosure means telling consumers what they need to know, when they need to know it. For loyalty schemes, disclose the value of points, any expiry, any restrictions on redemption and any data sharing. Do this at sign-up and at redemption. Do not hide key facts in a lengthy terms document.

If something goes wrong, consumers can complain to the trader, the ASA (advertising), the ICO (data protection) or the CMA (consumer law breaches).

The GOV.UK page of help for consumers explains how to complain and where to get advice. Point members there when they are unhappy.

Internally, have a complaints procedure. Log complaints, investigate promptly and remedy where appropriate. If a complaint is about a regulated issue, consider whether you need to report it to a regulator. The ICO expects organisations to report certain data breaches within 72 hours.

Keep the complaints log under review. Recurring complaints usually point to a term that needs rewriting, and a trader who has ignored repeated warnings from members will struggle to argue the scheme was administered fairly.

For a broader view of the market and enforcement trends, see loyalty marketing: England market guide for 2027.

Checklist for compliant and ethical loyalty schemes

Use this checklist when setting up or reviewing a scheme. It is not legal advice; individual cases need a qualified adviser.

This checklist is a starting point. Laws and guidance change. Always check the current position with a qualified adviser before making decisions.

Common questions

Do I need consent to send loyalty scheme marketing emails to members?

Generally yes, unless the soft opt-in applies. The soft opt-in allows you to email existing customers about similar products if you obtained their details during a sale and gave an opt-out. For new members who did not buy, you need consent. The ICO's guidance on business-to-business marketing covers the B2B position.

Can I change loyalty scheme terms after launch?

You can, but you must not do so unfairly. The Consumer Rights Act 2015 prohibits unfair terms, and the CAP Code requires promotions to be administered fairly. Give reasonable notice, explain the change and allow members to exit if they disagree. Retrospective changes that remove accrued benefits are risky.

What are the rules for referral schemes?

Referral schemes must comply with advertising, consumer and data protection law. The referrer should not receive a reward for spam. The referred friend must be contacted lawfully. The ASA expects referral promotions to be clear about rewards and conditions. If you process the friend's data, you need a lawful basis and must provide a privacy notice.

Where can consumers complain about a loyalty scheme?

Consumers can complain to the trader first. For advertising, the ASA; for data protection, the ICO; for consumer law breaches, the CMA or Trading Standards. The GOV.UK help for consumers page provides guidance on complaint routes. In Scotland, Wales and Northern Ireland, some routes differ; check locally.

Official sources:

• ICO guidance on lawful basis for direct marketing
• Explanatory notes to Digital Markets, Competition and Consumers Act 2024