GDPR and your loyalty program: which messages need consent

A GDPR-compliant loyalty program needs two separate things: a reason to hold the customer's data so the card works, and a separate yes before you send them marketing. Card updates, such as "a stamp was added" or "your reward is ready", come with running the card. Promotional messages, such as "we miss you, here is a free stamp" or a birthday treat, need consent the customer gave themselves: an unticked box at joining, a record of that yes, and an easy way out in every message.

I'm writing this now because December is the month owners send the most messages, and the questions arrive with it: "Can I message everyone who has my card?" "Is a Wallet notification the same as an email?" When I read the pages that rank for "GDPR loyalty program" in November 2026, they talk about SMS and newsletters, and none of them mentions a message on a Wallet card. So this post explains how consent works for a Wallet loyalty card, from the QR poster to the unsubscribe. I'm not a lawyer, and this isn't legal advice. It's what the official texts say, put into shop language, plus how I'd set it up.

What GDPR means for a loyalty program

GDPR is the EU's data protection law, and a loyalty program falls under it as soon as a card is linked to a person: a name, an email address, a visit history. The business that gives out the card decides what happens with that data, so the business is responsible for it. The platform behind the card processes the data on the business's instructions.

Running the card itself is the easy part. The customer asked for a card, so you need their email to send it, their visits to count stamps and their balance to show the reward. That data serves the card the customer requested.

Marketing is a different purpose, and GDPR treats each purpose separately. The European Data Protection Board, which publishes the EU's guidance on consent, is clear on three points that matter here (as of its consent summary from April 2026):

• A pre-ticked box is not consent. The customer has to tick it themselves.
• Consent bundled with something else is not freely given. If the card only works when the customer accepts marketing, that consent doesn't count.
• Withdrawing has to be as easy as agreeing.

Which loyalty messages need consent?

Messages that promote a visit, an offer or a product need consent; messages that report what happened on the card usually don't. The test is what the message says, not which channel carries it.

Here is how I'd sort the messages a typical shop sends:

The birthday treat surprises people. It feels like a gift, but it is a message that invites someone into your shop with an offer, so it belongs in the marketing column. The last row is the one I'd watch: an opening-hours note becomes marketing the moment you add an offer to it.

Does a Wallet push message count as marketing?

A promotional Wallet push message is marketing, just like a promotional email. The EU's rule on unsolicited marketing messages, Article 13 of the ePrivacy Directive, was written with email and SMS in mind, and I haven't found an official text that says exactly where a Wallet notification falls. GDPR applies either way, because the message goes to a known person and uses their data. So the safe reading is simple: if the words would need consent in an email, they need consent on the lock screen.

Two more things are worth knowing about the channel. On an iPhone, a customer can switch off notifications for a single pass in that card's settings in Wallet, without deleting the card. And Google Wallet allows at most 3 messages that trigger a notification within 24 hours, according to its developer documentation (as of November 2026). A shop that gets anywhere near that limit has a bigger problem than GDPR.

How consent works, from the poster to the unsubscribe

Here is the whole flow as it should run in a shop, in six steps.

1. The poster says what people join. "Your card for Lipa Bakery, in Apple Wallet or Google Wallet" is enough. Nobody should feel tricked into a mailing list by scanning a QR code.
2. The join form asks separately. The customer enters their email and confirms it. Under it sits one unticked box for messages, with plain words such as: "Send me offers and news from Lipa Bakery on my card and by email. You can turn this off at any time." The card works whether they tick it or not.
3. The yes is recorded. GDPR asks you to be able to show that a person agreed: who, when and to which wording. A note on paper won't do this at scale; your loyalty system should.
4. Messages are split by the answer. Card updates go to everyone with a card. Offers, win-backs and birthday treats go only to those who ticked the box.
5. Every marketing message has a way out. An unsubscribe link in an email, and a setting on the card itself, take one tap each, just like the tick did.
6. A no takes effect at once. When someone withdraws, the next campaign doesn't reach them, and the card keeps working as before. They lose the offers, not the stamps.

Steps 3 to 6 are where a paper list or a spreadsheet of email addresses fails. In Loyalius, a loyalty platform that puts stamp, points and cashback cards in Apple Wallet and Google Wallet, consent is tracked for each customer, marketing messages go only to people who agreed to them, and a customer can withdraw from the card or through the unsubscribe link in a message. Consent tracking comes with every plan, so a single shop on Starter keeps the same record as a chain.

What about customers who never said yes?

Customers who joined without ticking the box keep their card and keep getting card updates; they don't get your offers. That's the whole answer for most shops.

There is one exception people ask about, usually called the "soft opt-in". Article 13(2) of the ePrivacy Directive lets a business send email marketing about its own similar products to an existing customer whose address it got in the context of a sale, if the customer could object when the address was collected and can object in every message. The EU Court of Justice confirmed in November 2025 that this route works without a separate GDPR consent when all its conditions are met (case C-654/23). Countries apply it differently, and it was written for email, not for Wallet cards.

My view: for a loyalty card, don't build on the exception. Asking takes one checkbox, and a customer who ticked it knows your messages are coming. That customer is far less likely to switch off notifications after the first one.

The best moment to ask the people who skipped the box is the next visit, in person. It's the same skill as getting people to join in the first place, which I wrote about in fixing the ask at the till.

Quick answers

Can I add my old customer email list to the loyalty program and message everyone?

Only within what those people agreed to when you collected the addresses. An email address on a list is not consent by itself, so if you can't show who agreed to marketing and when, invite them to join the card instead of sending them offers.

Can I make marketing consent a condition of joining the loyalty card?

Not if you want the consent to count. The EDPB's guidance says consent tied to something the person can't refuse is not freely given, so keep the card and the messages separate: the card for everyone, the offers for those who say yes.

How long can I keep loyalty card data under GDPR?

GDPR sets no fixed number of months; it says data should be kept only as long as it's needed for its purpose. Decide a period for inactive cards, write it in your privacy notice, and stick to it.

Does GDPR apply to a small shop with one location?

Yes. GDPR applies to any business in the EU that handles personal data, whatever its size. A single bakery with 200 cardholders has the same duties around consent as a chain, just with fewer people on the list.

Why I'd rather have fewer yeses

The tempting move in December is to send a Christmas offer to everyone who has your card. I think the people who ticked the box are the only ones worth reaching. A list of 200 customers who asked for your messages will bring more people back than 600 who never asked, because nobody among the 200 is annoyed by the first one.

So before your December messages go out, open your join form on your own phone. Check that the box is unticked, that the wording names your shop, and that the card works without it. If all three are true, your January win-back message can go out without a second thought.