The free-cups-of-coffee and 10-percent-off coupons that frequent shoppers prize may be at risk of disappearing in California as businesses evaluate whether they can keep customer loyalty programs under the state’s new privacy law.
Parts of the California Consumer Protection Act alter the basis of loyalty programs: that customers trade valuable data about themselves in return for discounts. Starting in January, Californians will be able to request that their consumer data be deleted, and they’ll be able to stop companies from selling the information to third parties.
Companies in most cases won’t be able to offer different prices or discounts to customers who opt out of letting their loyalty data be sold, and the firms must be able to quantify the value of their programs to consumers.
Partly because those provisions are vague, businesses are weighing whether these programs can continue to exist, given higher compliance costs, less revenue from selling information, the need to overhaul data-use practices, and the possible risk of enforcement, privacy attorneys said.
“The CCPA’s financial incentive and anti-discrimination provisions are the most unnecessarily complicated provisions of an unnecessarily confusing statute,” Mark Brennan, privacy partner at Hogan Lovells US LLP, said. “The programs and efforts most in the cross-hairs are the ones that provide significant benefits to their customers.”
The future of an individual company’s rewards program depends on whether it sells loyalty data to third parties, privacy attorneys said. Businesses that keep data in-house for internal analytics likely won’t have to overhaul programs, while companies that sell data will need to map out where it’s headed in case loyalty members want to opt out of the sale of their information.
Developing those sorts of compliance plans will increase reward programs’ operating costs because it’s no small task to “rebuild systems” to meet the California law’s anti-discrimination provisions, said Eddie Holman, of counsel at Wilson Sonsini Goodrich & Rosati LLP.
What’s Loyalty Worth?
The law raises particularly complex questions for supermarket loyalty programs.
The CCPA requires businesses offering loyalty programs to clearly show “the material terms of the financial incentive programs.” Businesses with California operations have to give a good-faith estimate of the value of the data used under the program and detail how they reached that figure, according to proposed rules.
How supermarkets will make these valuations remains unclear.
“Is this going to be something done by a product by product basis (X off for soft drinks, Y off for cheese, Z off for detergents), or is it going to be more that we have all these programs and here are the benefits we get and give,” said Dan Jaffe, executive vice president of government relations at the Association of National Advertisers. The association represents retail and supermarket giants with California operations including Target Corp.,
California Attorney General
The valuation provisions will hit companies that “haven’t done that calculation or haven’t even contemplated it,” Holman said.
No Data Discrimination
In most situations, businesses can’t offer different prices or deals for customers that exercise their new California privacy rights, like the right to know what information is being collected, the right to delete information, and the right to opt out of the sale of data to third parties, said
But businesses can still use data that loyalty program customers ask to delete if it is for the purpose of providing requested services, said Hutnik, chair of Kelley Drye’s privacy and information security practice. The firm represents companies with rewards programs like retail giant
The California law provides exceptions to these rules when the price differences under a deal are related to the value of the data given by a customer. This means that businesses don’t have to offer the same price to customers that don’t join rewards programs in the first place, privacy attorneys said. For example, a California resident who goes to Petco for the first time, and elects not to sign up for a rewards program, doesn’t have to be offered coupons.
Petco declined to comment.
Still, companies are worried that these provisions could make some rewards programs unworkable. Businesses don’t want to violate the law and face state attorney general investigations for using data they didn’t have permission to use, advertising representatives and privacy attorneys said.
Companies are concerned with “whether or how the AG’s office will look to second guess how competitive businesses view the value of consumer data,” Brennan said. “It’s strange that the AG’s office thinks it is better suited to calculating the value it places on something rather than the marketplace itself,” he said.
Businesses have until December 6 to file comments with the office. Final rules are expected no later than early January, privacy attorneys and trade groups said.
A bulk of the concerns come down to one issue: how to comply with a law that is so open to interpretation.
“Multiple aspects of the CCPA are just clear as mud,” Hutnick said.