Loyalty programmes, UK GDPR and PECR: consent for SMS, email and push

This is general information, not legal advice

This guide summarises the main UK rules that affect a small business loyalty programme. It is not legal advice, and rules and guidance change. Check the Information Commissioner’s Office (ICO) guidance and take professional advice for your situation.

Two sets of rules

Two pieces of law matter most. UK GDPR, with the Data Protection Act 2018, covers how you collect and use personal data, such as names, phone numbers and purchase history. The Privacy and Electronic Communications Regulations (PECR) add specific rules for electronic marketing, including marketing emails and text messages.

Running the loyalty scheme itself, meaning recording purchases and rewards for members who signed up, is part of providing the service the customer asked for. Sending them marketing is a separate activity with its own rules.

Marketing by SMS and email

Under PECR, you generally need the individual’s consent before sending marketing texts or emails. Consent must meet the UK GDPR standard: freely given, specific, informed and an unambiguous positive action, such as ticking an unticked box. A pre-ticked box or consent buried in terms and conditions does not count.

There is an exception known as the soft opt-in. It can apply when you obtained the contact details during a sale or negotiations for a sale, you are marketing your own similar products or services, and you gave the person a simple way to refuse when you collected the details and in every message since. If any of those conditions is missing, ask for consent.

Service messages are different

A neutral message telling a member that points have been added, that their balance has changed or that they have moved up a tier is a service message about their account, not marketing. Keep it that way: once you add a promotion to a service message, it becomes marketing.

What about push notifications?

Push notifications on a wallet card are delivered differently from texts and emails, and how the electronic marketing rules apply can depend on the details. UK GDPR still applies to the personal data involved. The safe approach is to treat promotional pushes with the same care as other marketing: explain at sign-up that members may receive offers on their card, keep them relevant and infrequent, and remember that customers can turn off notifications for the card or remove it at any time.

A practical checklist

Use this as a starting point when you set up your programme.

• Keep the joining form short; collect only what you need.
• Make marketing consent a separate, unticked choice, per channel if you can.
• Explain in plain words what members will receive and how often.
• Include an easy opt-out in every marketing text and email.
• Keep records of when and how consent was given.
• Link to your privacy notice from the joining flow.
• Review the ICO’s current direct marketing guidance.

Example wording for your joining form

Plain, specific wording is the easiest way to get consent right. The examples below are illustrative and should be adapted to your business and checked against current guidance; they are not legal advice.

• Joining: “Join our rewards to earn 5% back on every purchase. We use your details to run your rewards account. See our privacy notice.”
• SMS (unticked box): “Text me occasional offers and news from [Business]. I can reply STOP at any time.”
• Email (unticked box): “Email me offers and news from [Business]. I can unsubscribe at any time.”
• Wallet card: “You may receive occasional offers on your card. You can turn off notifications in your phone’s wallet settings.”

Handling opt-outs and data requests

Make opting out as easy as opting in, and act on it promptly. When someone replies STOP to a text or unsubscribes from an email, they should not receive further marketing on that channel. They can stay in the loyalty programme and keep earning rewards; opting out of marketing is not the same as leaving.

Under UK GDPR, members can also ask to see the personal data you hold about them, to correct it or, in many cases, to have it deleted. Know in advance who in your business handles these requests and how you would find a member’s data in your loyalty system. The ICO publishes guidance on responding to these requests and the time limits that apply.

Keep records you can rely on

If you are ever asked to show that someone agreed to marketing, you will need a record: when they agreed, how (for example, the joining form), what they were told and which channels they agreed to. A loyalty system that stores consent per member makes this much easier than a paper list.

Review your wording and processes at least once a year, and whenever you add a new channel or start a new kind of campaign. Rules and guidance in this area are updated from time to time, so check the ICO’s website rather than relying on an old checklist.

Further reading

The ICO publishes detailed guidance on direct marketing and PECR, which is the authoritative source. Unity’s own approach is described in our Privacy & GDPR policy. For choosing channels, read push notifications vs SMS vs email. Our customer notifications page explains how marketing preferences are applied to each campaign channel in Unity.