Reed Smith LLP

ColoradoBiz

COMMENTARY: Colorado loyalty programs hit new regulatory bumps

Subscribe
Home Perspectives COMMENTARY: Colorado loyalty programs hit new regulatory bumps
Colorado businesses spent the better part of 2022 preparing to comply with the Colorado Privacy Act (“CPA”) by its effective date in mid-2023. However, many overlooked the numerous requirements that the later-enacted CPA regulations impose on loyalty programs. Given the CPA’s high potential penalties, the mistake could be a costly one.

1. What qualifies as a “loyalty program” covered by the CPA?

The CPA only applies to businesses that either control or process the personal data of 100,000 Coloradan residents or more each year, or 25,000 Coloradan residents for businesses that also derive revenue or discounts from the sale of personal data.1

The CPA regulations define a “bona fide loyalty program” as a “loyalty, rewards, premium feature, discount, or club card program established for the genuine purpose of providing [benefits] to consumers that voluntarily participate in that program, such that the primary purpose of processing personal data through the program is solely to provide [benefits]” to the participants.2 The regulations further define “benefits” as “an offer of superior price, rate, level, quality, or selection of goods or services,” whether provided directly by the business or a business partner.3

2. What do the CPA regulations require for my loyalty program?

Notice

In addition to the information already required to be in your privacy policy by the CPA, if you have a qualifying loyalty program under the CPA regulations, your privacy policy must disclose:4

  1. Categories of personal or sensitive data collected through the loyalty program that will be sold or processed for targeted advertising, if any;
  2. Categories of third parties that will receive personal or sensitive data, including whether it will be provided to data brokers;
  3. A list of any loyalty program partners, and benefits provided by each partner;
  4. Whether a consumer’s deletion request will prevent participation in the loyalty program, with an explanation as to why; and
  5. Whether sensitive data is required for a loyalty program benefit, with an explanation as to why.