CCPA Notice of Financial Incentive: what a loyalty program has to disclose

Loyalty programs sit on an awkward seam in the CCPA. Section 1798.125(a) prohibits discriminating against a consumer for exercising privacy rights, including by charging different prices. Section 1798.125(b) then permits exactly that, if the difference is reasonably related to the value of the data and you disclose how you worked it out. The Notice of Financial Incentive is where that disclosure lives.

What the statute permits

Cal. Civ. Code Section 1798.125(b)(1) states that a business "may offer financial incentives, including payments to consumers as compensation, for the collection of personal information, the sale or sharing of personal information, or the retention of personal information", and may also offer a different price, rate, level or quality of goods or services "if that price or difference is reasonably related to the value provided to the business by the consumer's data".

Three conditions attach. Subdivision (b)(2) requires notifying consumers of the incentive under Section 1798.130. Subdivision (b)(3) requires prior opt-in consent that clearly describes the material terms and may be revoked at any time, and adds a cooling-off rule: if the consumer refuses, the business must wait at least 12 months before next requesting consent. Subdivision (b)(4) prohibits financial incentive practices that are "unjust, unreasonable, coercive, or usurious in nature".

It is also worth reading Section 1798.125(a)(3), which says nothing in the non-discrimination subdivision prohibits offering loyalty, rewards, premium features, discounts or club card programs consistent with the title. Loyalty programs are not suspect in themselves. The disclosure is the price of running one.

The five things the notice must contain

11 CCR 7016(d) is a closed list of five items:

(1) A succinct summary of the financial incentive or price or service difference offered.

(2) A description of the material terms, including the categories of personal information implicated by the incentive and the value of the consumer's data.

(3) How the consumer can opt in.

(4) A statement of the consumer's right to withdraw from the financial incentive at any time, and how to exercise it.

(5) An explanation of how the price or service difference is reasonably related to the value of the consumer's data, including (A) a good-faith estimate of the value that forms the basis for the offer, and (B) a description of the method or methods used to calculate that value.

Item (5) is the one that stops most drafts. The regulation does not prescribe a valuation methodology and does not require a particular number to be correct. It requires a good-faith estimate and a description of how you got there. A program that grants points redeemable for a known dollar amount already has most of its arithmetic done.

Where the notice has to sit

11 CCR 7016(c) requires the notice to be "readily available where consumers will encounter it before opting-in". For an online incentive the regulation allows a shortcut: the notice may be given by providing a link that takes the consumer directly to the specific section of the privacy policy containing the 7016(d) content.

Note the precision of "directly to the specific section". A link to the top of a long privacy policy does not meet it, and under 11 CCR 7004(a)(5) making a consumer scroll to find required content is treated as friction rather than disclosure.

Subsection (b) adds that the notice must comply with Section 7003(a) and (b), the general requirements for disclosures and communications to consumers.

The signup screen is regulated too

The notice is one half. The consent interface is the other, and the dark-patterns rule names loyalty programs specifically. 11 CCR 7004(a)(2)(E) states that a choice where the option to participate in a financial incentive program is selected by default, or featured more prominently, for example larger in size or in a more eye-catching color, than the choice not to participate is "neither equal nor symmetrical".

A preticked "Join our rewards program" box is therefore not a drafting nicety. It is the example the regulator wrote down.

How incentives interact with opt-out preference signals

There is a specific rule for the collision between a loyalty program and a browser opt-out signal. Under 11 CCR 7025(c)(4), where an opt-out preference signal conflicts with participation in a financial incentive program that requires consent to sale or sharing, the business may notify the consumer that honoring the signal would withdraw them from the program and ask them to affirm that intent.

If the consumer affirms, the business must process the opt-out. If the business asks and the consumer does not affirm, the business may ignore the signal as to that consumer's participation for as long as the consumer is known to it. If the business never asks, it must process the signal anyway. In every branch the business must display the status of the consumer's choice under Sections 7025(c)(6) and 7026(g).

The order matters: asking is what preserves the program, and silence defaults toward the consumer.

What a workable notice looks like

Short, in the privacy policy, linked from the signup screen, and specific. Name the program. List the categories of personal information it implicates. State the reward in the units the consumer will actually receive. Give the estimated value per member and one or two sentences on how you derived it, whether from margin on redeemed rewards, average incremental spend, or the cost of acquiring the same data elsewhere. Then state that members can leave at any time and say how.

The failure mode is not an unsophisticated valuation. It is omitting the valuation entirely and hoping the program reads as a marketing offer rather than a data transaction.

Next step