Arguably no.

The CCPA makes clear that a business can offer different prices or rates to consumers as part of a financial incentive program if those different prices or rates are “directly related to the value provided to the business by the consumer’s data.”¹  The CCPA does not, however, directly prohibit the offering of a financial incentive if the value provided to the business by the consumer’s data is not “directly related” to the value of the financial incentive.

The CCPA also states that a business may not, through a financial incentive program (or any other activity), discriminate against a consumer because the consumer “exercised any of [their] rights” under the CCPA (e.g., access, deletion, or opt-out of sale), unless the difference in price, rate, or quality that forms the basis of the discrimination is “reasonably related to the value provided to the business by the consumer’s data.”²

In commentary published with the issuance of the regulations implementing the CCPA, the California Attorney General informally suggested that the Act might be interpreted as requiring that the benefit provided by all loyalty programs should be “reasonably related to the value of the consumer’s data to the business.”³  The California Attorney General did not explain, however, the basis for his assertion, and such a position would directly conflict with the text of the CCPA (described above) which applies the “reasonable relationship” test only to situations in which “discriminat[ion]” is prompted by the “exercise[] . . . of the consumer’s rights.”⁴ Furthermore, in other statements made by the Attorney General, he concedes that the “reasonable related” standard applies only in the context of discrimination.⁵

As a result, there is a strong argument that the price or rate discounts offered through a loyalty program do not need to be reasonably related to the value that a business derives from data, so long as the business does not discriminate against a consumer that attempts to exercise a privacy right.

Yes.

Some retailers have expressed confusion about whether a loyalty program might be considered a “financial incentive” program under the CCPA. If a loyalty program were classified as a “financial incentive program,” it might, among other things, require the business to confirm that differences in “price, rate, level, or quality of goods or services” offered to consumers are “directly related to the value provided to the business by the consumer’s data.”¹

Most loyalty programs have a strong argument that they are not financial incentive programs as the main purpose of the program is to provide benefits in recognition of (or in exchange for) repeat purchasing patterns, and not “for the collection of personal information.”  Nonetheless, some retailers have expressed concern that privacy advocates, or plaintiffs attorneys, might attempt to argue that all loyalty programs amount to financial incentives.  In order to avoid the cost of defending such an argument, they have considered excluding Californians from the scope of their loyalty programs.

While the CCPA prohibits discriminating against a consumer that exercises one of their rights under the Act,² the CCPA does not confer a right to join loyalty programs.  As a result, a company can elect to exclude Californians completely from loyalty programs in order to avoid the risk that the program might be alleged to be a financial incentive program.

No.

The CCPA generally prohibits a business from “discriminat[ing]” against a consumer that chooses to exercise “any of the consumer’s rights” – including the right to be deleted.¹  As a result, to the extent that a consumer’s name is included in a marketing list, and the act of deletion would deprive the consumer of an exclusive price, discount, or service offering, a business could be alleged to have “discriminated” against the consumer.

That does not, of course, mean that all marketing lists inevitably lead to discrimination when a deletion request is made.  Many – if not most – marketing lists are not structured to lead to a discriminatory outcome.  For example, a strong argument could be made that the following types of marketing lists would not cause discrimination when, or if, a consumer exercised a right to be deleted:

• Discounts to join a marketing list. Many businesses offer consumers a discount for joining a marketing list (e.g., “Receive a 10% coupon when you join our mailing list”).  Incentivizing a consumer to join a marketing list does not “discriminate against a consumer” that has “exercised any of the consumer’s rights” under the CCPA.²  Specifically if the consumer submits a deletion request after joining the marketing list, and their information is deleted, discrimination has not occurred unless the consumer is denied the ability to utilize the discount that they received when they initially joined (e.g., the 10% coupon).
• Alerts of sales. Many businesses offer consumers the ability to sign up to receive emails or mailings that describe sales or promotions offered by the business (e.g., “Sign up and never miss our sales!”).  Notifying a consumer of upcoming sales does not “discriminate against a consumer” that has “exercised any of the consumer’s rights” under the CCPA. ³  Specifically if the consumer submits a deletion request after joining the program, and their information is deleted, discrimination has not occurred unless the consumer is denied the ability to avail themselves of the actual sale or promotion being offered.  To the extent that the sales or discounts are available elsewhere (e.g., on the company’s website, or in the company’s store), discrimination arguably has not occurred. 

Probably not.

Typically, businesses are not required to delete information maintained as part of a loyalty program in response to a right to be forgotten request.  Some businesses, however, may consider voluntarily agreeing to a right to be forgotten request in order to confer upon consumers greater control over their data.

Based upon the current drafting of the CCPA, voluntarily agreeing to a right to be forgotten request may raise unintended complexities.  Specifically, the CCPA states that a business “shall not discriminate against a consumer because the consumer exercised any of the consumer’s rights” under the Act.¹  Among other things, the CCPA provides the following examples of discrimination under the statute:

• Denying “goods or services” because the consumer exercised a deletion right;²
• Charging “different prices or rates for goods or services” because the consumer exercised a deletion right;³
• Charging different rates “through the use of discounts or other benefits” because the consumer exercised a deletion right;⁴ or
• Providing “a different level or quality of goods or services” because a consumer exercised a deletion right.⁵

In the context of a loyalty program, a potential conflict arises if an individual requests to be forgotten.  If the business voluntarily honors such a request, the consumer’s participation in the loyalty program would presumably need to be terminated as the business would no longer have data about the consumer needed to track purchases and provide loyalty-related benefits.  For loyalty programs that provide free products or services, termination could lead a consumer to argue that they were either “den[ied] goods or services” or “charg[ed] different prices or rates . . . through the use of discounts or other benefits.”⁶  While some businesses might attempt to mitigate inadvertent harm by warning consumers that an inevitable consequence of a deletion request would be the loss of value, or the loss of benefits, associated with the loyalty program, the CCPA specifically prohibits a business from “[s]uggesting that the consumer will receive a different price or rate for goods or services or a different level or quality of goods or services” if the consumer were to exercise one of their rights.⁷  That prohibition seemingly puts a business between a rock and a hard place.  If they honor the consumer’s request, they may be accused of unlawful discrimination by denying the benefits of the loyalty program as a result of the exercise of the consumer’s rights.  If they warn the consumer of the inevitable consequence of a deletion request, the business could be accused of violating the CCPA by suggesting that the exercise of a right will lead to the loss of a benefit.

To the extent that the California Attorney General argues that the act of exercising a deletion request leads to a form of “discrimination,” the CCPA provides an affirmative defense that may be available to some loyalty programs.  The CCPA states that, notwithstanding the anti-discrimination prohibition within the Act, a business may charge a different price or rate, or provide a different level of quality or service, if that “difference is reasonably related to the value provided to the business by the consumer’s data.”⁸ The CCPA does not, however, set forth a standard by which courts should judge whether the difference in price or quality is “reasonably related.”  Nor does the CCPA set forth a methodology for how a business should calculate the value provided to it by the consumer’s data.

The net result is that there remains a great deal of uncertainty concerning the practical ability of a business to rely upon the “business value” exception.  Specifically, it remains to be seen whether courts will (1) assign the burden to a plaintiff to prove the value of data to a business, or assign the burden to a business to prove the value to the business of the data, (2) perceive the question of whether two values are “reasonably related” to be a question of fact suitable for juries, and/or (3) establish a consistent methodology for calculating the value of data to a business.

Anytime a new statute or regulation comes along, some law firms unfortunately flag issues that may not be of true concern to companies, or highlight problems that may not, in fact, exist.  Unfortunately, that continues to happen in connection with the California Consumer Privacy Act (“CCPA”).  In the context of retailer loyalty or reward programs, firms have said that the CCPA may spell the “end of loyalty programs,” or implied that the CCPA could lead to “the potential elimination of loyalty programs due to the nondiscrimination requirements.”  Some law firms have gone so far as to advise retailers to “address the issue[s]” caused by their loyalty programs by “not offer[ing] preferential pricing through loyalty programs” or by “mak[ing] loyalty program pricing available to all customers” regardless of whether they are, in fact, members of the loyalty program.  Such changes would, of course, destroy the business-case for having a loyalty program in the first place.

These concerns are incorrect and demonstrate a lack of understanding of the requirements of the CCPA.  While the Act is, without a doubt, flawed, poorly drafted, and prone to misinterpretation, it does not lead to the conclusion that most loyalty programs are inherently problematic, nor should it cause most retailers to drastically change the terms and structure of their program.  The hyperbolic treatment of loyalty programs by some law firms may also have contributed to several companies and industry groups echoing these concerns with the California legislature and the California Attorney General and alleging (incorrectly) that “the CCPA may prevent[] marketers from offering loyalty programs,” or that the CCPA, as currently written, prohibits “tiered pricing, discounts or coupons.”

The following dispels five (mis)statements that have been made in connection with the CCPA’s impact on loyalty programs.

1. Myth: The CCPA prohibits “charging different prices or rates for goods or services.”

It does not.

The prohibition against price discrimination in the CCPA only applies to situation in which a consumer exercises a right conferred by the CCPA.  Nothing within the CCPA confers a right to join (or not join) a loyalty program.  For more information, see FAQ: Is a business prohibited from giving discounts to  loyalty program members?

2. Myth: The CCPA states that the benefit provided to the consumer through a loyalty program must be reasonably related to the value provided to the business by the consumer’s data.

It does not.

As indicated above, the CCPA prohibits a business from engaging in price discrimination when a consumer exercises  a right under the CCPA.  The CCPA provides an exception to that prohibition when the discrimination relates to a “price or difference” that is related to the value provided to a business by the consumer’s data.¹

While some lawyers have misinterpreted this as requiring that all loyalty program benefits be related to the value provided to the business by the consumer’s data, as noted above, the operation of the loyalty program itself is not prohibited by the CCPA and, thus, does not require the benefit of this exception.

For more information, see FAQ: Does a loyalty program benefit have to relate to the value provided to a business by consumer data?

3. Myth: Businesses must honor deletion requests for loyalty members.

They generally do not.

One of the rights conferred by the CCPA is the ability of a consumer to request that a business delete personal information “which the business has collected from the consumer.”²  While numerous retailers have expressed confusion regarding whether that right requires the deletion of loyalty program related data, it is important to remember the right to deletion is not an absolute right and may rarely apply in the context of a loyalty program.

As an initial matter, because the right to deletion is limited to information that the business has collected “from” the consumer, if a business receives a deletion request under the CCPA, there is a strong argument that the business is permitted to keep information about the consumer that it developed itself (e.g., its transactions or experiences with the consumer), or information that it received from third parties (e.g., third party businesses that may participate in the loyalty program).  As this information was not collected “from” the consumer, it arguably does not fall within the gambit of a deletion right.

In connection with information that is collected directly from a consumer (e.g., name, email address, enrollment details, etc.), there are several exceptions to the CCPA which would allow a business to refuse a deletion request.  For more information about each of those exceptions, and a description of how they apply to most loyalty programs, see FAQ: Is a business required to delete loyalty program information if it receives a deletion request from an active member? and FAQ: Is a business required to delete loyalty program information if it receives a deletion request from an inactive member?

4. Myth: Businesses that offer loyalty programs must include a “do not sell my personal information” link.

Not necessarily.

The CCPA requires that a business that sells personal information disclose within its privacy policy a “list of the categories of personal information it has sold about consumers in the preceding 12 months.”³  The business must then include a link on its homepage titled “Do Not Sell My Personal Information” and allow consumers to opt-out of the sale.

The net result is that if a business sells loyalty program information, the business must disclose that fact and then include a “Do Not Sell” link; if a business does not sell loyalty program information, the business is not required to include such a link.

For more information go to FAQ: Is a business required to post a “do not sell” link if it offers a loyalty program?

5. Myth: Businesses that allow consumers to redeem points with third parties are selling information.

They generally are not.

The CCPA broadly defines the term “sale” as including the act of “disclosing” or “making available” personal information “for monetary or other valuable consideration” from one business to another.⁴  In the context of loyalty programs, it is not unusual for the operator of a loyalty program to enter into an agreement with a business partner (e.g., another company) to permit a consumer to redeem points accumulated through the loyalty program of business A in order to receive goods or services provided by business B.  For example, a hotel may have an agreement with a car rental service through which a consumer can redeem hotel loyalty points to receive a free car rental.

Such redemption arrangements may require the disclosure of personal information from one business (e.g., business A) to a second business (e.g., business B), and may include the payment of money or other consideration for the ability to receive advertising or promotion as a rewards provider.  As a result, and depending upon the structure of the business relationships, it is possible that, at first glance, the arrangement could fit the definition of “sale” under the CCPA.

Assuming that the transfer of information to a redemption partner did satisfy the definition of a “sale,” the CCPA contains an exception for situations in which a “consumer uses or directs the business to intentionally disclose personal information.”⁵  As a result, if a consumer uses a loyalty program in order to interact with another business, or directs a loyalty program to disclose personal information as part of a points redemption, the loyalty program operator arguably has not “sold” information.

For more information, go to FAQ: If a business allows consumers to redeem loyalty program benefits for products or services offered by a partner, does that constitute the sale of information?