Loyalty programmes collect purchase history, phone numbers and sometimes birthdays to build customer profiles for personalised offers — this is profiling and marketing, which needs consent that is separate and specific from the consent given to complete a purchase or transaction. A single bundled enrolment checkbox that covers loyalty enrolment, profiling and marketing together does not meet the unbundled-consent standard under Section 6 of the DPDP Act 2023. This checker scores your loyalty programme consent flow.
Does your loyalty programme collect consent correctly for enrolment, profiling and marketing? Check adequacy in 60 seconds.
Loyalty programmes look like a simple value exchange — points for purchase history — but under the DPDP Act 2023 they combine at least three distinct processing purposes: programme administration, customer profiling for personalisation, and marketing communication. Retail and D2C brands commonly collect all of this through a single enrolment checkbox at checkout, which is exactly the kind of bundled, forced consent that Section 6 prohibits. A shopper who wants loyalty points but not marketing SMS has no way to say so.
This matters more as loyalty data grows richer — birthday capture for special offers, tier-based segmentation, and increasingly, sharing anonymised or pseudonymised profiles with partner brands in co-branded programmes. Each of these is a separate purpose that needs its own legal basis, and undocumented consent is difficult to defend if a customer complains to the Data Protection Board.
A defensible approach unbundles consent at the point of enrolment: one specific opt-in for programme membership, a separate opt-in for profiling and personalisation, and a separate opt-in for marketing messages — each independently withdrawable. Niti Bharat's Loyalty Consent Framework Generator produces this structure as ready-to-implement enrolment copy, a consent logging schema, and a privacy notice addendum specific to loyalty and rewards programmes, so retail and D2C teams can fix this without a lengthy legal review.
A ready-to-use enrolment consent flow with separate opt-ins for membership, profiling and marketing, plus a sample consent log structure.
One real DPDP development explained in plain English, one practical how-to, one number from our own assessment data. Nothing else — no daily noise, no sales pitch.
No spam. Unsubscribe with one click, anytime.
