Esther Egunyomi

Associate Editor

Loyola University Chicago School of Law, JD 2028

It seems like every time you visit a store, you’re asked the question, “Do you have a rewards account?” Most do. They either scan a barcode or give their phone number to earn points, get discounts, or receive tailored offers. Although customers walk away with some savings, businesses end up with an even more valuable resource: data. What appears to be a simple transaction has become a sophisticated exchange of personal information, raising significant privacy and compliance issues involving consumer consent, transparency in data collection, third-party data sharing, and businesses’ obligations to protect personal information.

From Customer Loyalty to Consumer Data

Loyalty programs offer businesses far more than simply a means of rewarding customers who make repeat purchases. Every purchase, redeemed coupon, website visit, or mobile app interaction generates information about their shopping behavior. Companies use the data to personalize promotions, predict customer preferences, forecast demand, and improve long-term relationships. As Deloitte has noted, today’s loyalty programs have become strategic business assets, with their true value usually found not in the rewards customers redeem but in the consumer insights they generate.

Although those insights involve important legal and compliance duties, the more information businesses gather, the more responsible they are for collecting it transparently and protecting it properly. Loyalty programs are no longer marketing initiatives but compliance programs that require agencies to address consumer protection and data governance from the first stage of the programs’ design.

When the Law Catches Up

As businesses have become more dependent on loyalty programs to gather and analyze consumer data, the regulatory environment surrounding these programs has adapted as well. Modern loyalty programs do not just record a customer’spurchase history; they create in-depth consumer profiles that enable companies to customize their marketing and gain a better understanding of how customers behave. As data collection has grown, lawmakers and regulators have responded by introducing new privacy laws to give consumers greater transparency and control over their personal information. A critical step in elevating consumer protections was the passage of the California Consumer Privacy Act (CCPA).

The (CCPA) requires qualifying businesses operating in or doing business in California, including business headquarter outside the state, to disclose their data collection and sharing practices, while granting California residents greater control over their personal information through the rights to access, correct, and delete their data, opt out of its sale or sharing for targeting advertising, and limit certain uses of sensitive personal information. Since the  CCPA’s enactment, an increasing number of states have introduced comprehensive privacy laws. Businesses must now view consumer data not only as an asset but also as a key aspect of their compliance obligations. Privacy professionals are increasingly promoting a privacy-first approach, which involves embedding transparency, genuine consent, and responsible data governance into loyalty programs from the beginning. Traditionally, companies often addressed privacy concerns only after developing their programs, relying on privacy policies and reactive compliance measures rather than incorporating privacy protections into the initial design.

Compliance Beyond the Checkout

For companies that run loyalty programs, meeting compliance requirements goes well beyond just guarding customer data against cyberattacks. In July 2026, Chick-fil-A informed customers in 10 states that their accounts linked to the Chick-fil-A One loyalty program might have been affected by a credential-stuffing attack. A credential-stuffing attack occurs when cybercriminals use stolen usernames and passwords from previous data breaches to gain unauthorized access to other online accounts, potentially exposing personal information such as names, email, addresses, membership numbers, and partial payment card details. While the hackers did not breach Chick-fil-A’s systems directly, the incident shows that loyalty accounts have become a desirable target for cybercriminals.  The newfound desirability of loyalty accounts is the same reason why many privacy professionals are advocating for an approach known as ‘privacy by design’, which is a proactive approach that integrates privacy protections into the design and operation of loyalty programs from the outset, rather than addressing privacy concerns after they arise.

The Other Side of Loyalty: Are Businesses Protecting Consumer Data?

Businesses should go beyond simply meeting the minimum legal requirements, and consumers should not have to sacrifice their privacy just to enjoy a few rewards. Although loyalty programs offer benefits to both businesses and consumers, the relationship is not always balanced. Additionally, consumers are often not fully aware of the extent to which their information is being collected or shared.

Businesses have a responsibility to ensure their loyalty programs are not designed to take advantage of this lack of awareness. Companies should clearly explain what information they collect, limit data collection to what is necessary, and provide consumers with meaningful choices about how their information is used. They should communicate their data practices to customers in a way that is accessible, straightforward, and easy to understand, and their communications should not be limited to a display of a company’s lengthy privacy policy. Ultimately, while loyalty programs offer consumers convenience and rewards, they also raise important concerns about how businesses collect, use, and protect personal information. As these programs continue to evolve, businesses must prioritize transparency, meaningful consumer consent, and responsible data governance to maintain consumer trust and meet their regulatory obligation. The true value of consumer loyalty should not come at the expense of consumer privacy.