CCPA Enforcement Priorities Include Loyalty and Rewards Programs

The California Attorney General continues to bring enforcement actions relating to the California Consumer Privacy Act (CCPA). While advertisers and marketers have generally focused on CCPA compliance with respect to privacy practices, it is important to highlight a marketing practice that may be overlooked — loyalty and reward programs.

Loyalty and Reward Programs

Loyalty and reward programs are generally optional programs whereby participants receive points, coupons, credits, rewards certificates or other benefits that can be redeemed for making purchases at a given company. They are often redeemed for merchandise, cash discounts or rewards certificates. A hallmark feature of these programs is that, in order to opt-into the program, a potential participant must provide personal information, such as full name, email and phone number.

CCPA Enforcement Trends

The passage of the CCPA in 2018 left industry stakeholders waiting expectantly to see how California regulators would enforce the new law. The CCPA has now been in effect for over a year and a half (since January 1, 2020), and the California Attorney General has begun to reveal its regulatory priorities through a series of enforcement actions. Among them is a focus on the CCPA’s requirement that businesses provide notice to consumers of any “financial incentives” offered in return for the collection of their personal information.

The California Attorney General issued an enforcement report in July 2021 that included example cases in which it sent notices of alleged noncompliance to businesses. Included among the targeted companies was a grocery chain that “required consumers to provide personal information in exchange for participation in its company loyalty programs.” The Attorney General targeted the grocery chain for not providing proper notice to participating consumers, and “[a]fter being notified of alleged noncompliance, the company amended its privacy policy to include a Notice of Financial Incentive.”

The CCPA’s Financial Incentives Requirements

The CCPA provides that businesses “may offer financial incentives, including payments to consumers as compensation, for the collection of personal information, the sale or sharing of personal information, or the retention of personal information,” and that businesses “may also offer a different price, rate, level, or quality of goods or services to the consumer if that price or difference is reasonably related to the value provided to the business by the consumer’s data.” Any business that offers such financial incentives must provide a formal Notice of Financial Incentive so that consumers can make informed decisions about whether to participate.

The CCPA regulations provide that notice must be “designed and presented in a way that is easy to read and understandable to consumers,” and must:

• Use plain, straightforward language instead of technical or legal jargon;
• Be formatted in a way that draws the consumer’s attention to the notice and makes the notice readable;
• Be available in the languages in which the business ordinarily provides information to California consumers;
• Be reasonably accessible to consumers with disabilities; and
• Be readily available for consumers to find before opting-in to the financial incentive or price or service difference.

Additionally, pursuant to CCPA regulations, the Notice of Financial Incentive must include the following information:

• “A succinct summary of the financial incentive or price or service difference offered,”
• “A description of the material terms of the financial incentive or price or service difference, including the categories of personal information that are implicated by the financial incentive or price or service difference and the value of the consumer’s data,”
• “How the consumer can opt-in to the financial incentive or price or service difference,”
• “A statement of the consumer’s right to withdraw from the financial incentive at any time and how the consumer may exercise that right,” and
• “An explanation of how the financial incentive or price or service difference is reasonably related to the value of the consumer’s data, including:
  • A good-faith estimate of the value of the consumer’s data that forms the basis for offering the financial incentive or price or service difference; and
  • A description of the method the business used to calculate the value of the consumer’s data.”

Online notice may be given by providing a link to the section of a business’s privacy policy that contains the above information.

The Bottom Line

• Promotional practices, such as loyalty and reward programs, have unique disclosure obligations under the CCPA.
• With enforcement actions ramping up in California, and new privacy laws on the horizon, it is important for companies to have all of their marketing practices reviewed in light of these new obligations.