Loyalty Program Compliance Across US States and Canada: Privacy, Promotions and Tax

Loyalty program compliance across US states and Canada means meeting each jurisdiction's rules on three things at once: how member data is collected and used, how chance-based promotions are run, and how rewards and prizes are reported and taxed.

A program that works in one state is not automatically compliant in the next, and a US program that opens to Canadian members takes on a second federal framework and, in Quebec, a third. The differences are practical: which consent a member gives, whether a sweepstakes needs a filing and a bond, which tax form a prize triggers. This guide sets out the rules that matter most for US and Canadian programs, and how to build them into the program so they are enforced by the platform rather than just written into the terms.

Key Takeaways

What privacy rules apply to a loyalty program across US states?

A loyalty program serving members across the US has to meet the privacy law of each state where its members live and whose applicability thresholds the business meets, because there is no single federal privacy law.

The IAPP's state privacy legislation tracker counts 19 enacted comprehensive state privacy laws, with Indiana, Kentucky and Rhode Island taking effect on January 1, 2026. At the federal level, the FTC's authority over unfair or deceptive practices still applies to how a program describes its data use.

Three requirements matter most for loyalty programs:

• California's financial incentive rules. A covered business whose program collects personal information in exchange for benefits must give a Notice of Financial Incentive before enrollment and obtain prior opt-in consent. The terms and conditions guide covers the notice in detail. The California Privacy Protection Agency's inflation-adjusted amounts from January 1, 2025 are up to $2,663 per violation, or $7,988 for intentional violations and violations involving minors under 16. The Attorney General's enforcement page notes that since January 1, 2023, the CCPA no longer requires notice or an opportunity to cure before an enforcement action. Separately, a business may not sell or share the personal information of a consumer it knows is under 16 without affirmative authorization (Civil Code section 1798.120).
• Opt-out preference signals. California's regulations (section 7025, as published by LII) require a business that sells or shares personal information to process a qualifying opt-out preference signal as a valid opt-out request. Colorado has required businesses within its law to honor the Global Privacy Control since July 1, 2024. The IAPP reported in July 2025 that universal opt-out requirements were in effect in California, Colorado, Connecticut, Montana, Nebraska, New Hampshire and Texas, with Delaware, Maryland, Minnesota, New Jersey and Oregon to follow. A program that uses member data for targeted advertising has to detect and honor these signals.
• Consumer rights. The state laws give residents rights to access, correct and delete their data, with deadlines for responding. The program needs a process that can find a member's data across the loyalty platform, the CRM and any partners, and act on it.

What changes when the program includes Canadian members?

Adding Canadian members adds a federal privacy law, a separate Quebec privacy law, and Canada's anti-spam rules for marketing email and texts.

• Federal privacy. The Office of the Privacy Commissioner explains that PIPEDA applies to private-sector organizations that collect, use or disclose personal information in the course of commercial activity, and that consent is one of its ten fair information principles. Alberta, British Columbia and Quebec have their own private-sector laws deemed substantially similar.
• Quebec. Quebec's private-sector privacy law requires consent that is clear, free and informed, given for specific purposes and requested for each purpose in clear and simple language, and presented separately from other information when requested in writing. A single bundled consent at enrollment is unlikely to meet that standard. Quebec also has French-language requirements for commercial documents and rules on communicating personal information outside the province, for example to a US-hosted platform; confirm both with Quebec counsel.
• Anti-spam. Under Canada's anti-spam legislation, as the CRTC explains, a commercial electronic message needs consent, sender identification and an unsubscribe mechanism. Express consent requires an opt-in; implied consent from an existing business relationship is time-limited. The sender carries the burden of proving consent, so the program must record how and when each member agreed.

How do sweepstakes and contest rules differ between the US and Canada?

Both countries treat a prize awarded by chance in exchange for payment as an illegal lottery, but they avoid it differently: the US through a free way to enter, Canada through a skill-testing question, often alongside a no-purchase entry route, and required disclosures.

Canada's Competition Act (section 74.06) makes it reviewable conduct to run a promotional contest without adequate and fair disclosure of the number and approximate value of prizes and the chances of winning, to delay prize distribution unduly, or to select winners other than by skill or at random. A US program extended to Canada therefore needs Canadian official rules, not just a Canada line added to the US rules. Loyalty programs carry a specific risk in both countries: entries bought with points earned through purchases can count as consideration, so the free entry route must give non-members and non-purchasers equal odds and equal prominence. The Brandmovers promotions compliance guide covers US sweepstakes mechanics in more depth.

What tax and reporting rules apply to prizes and rewards?

US sponsors report most prizes from promotions without a wager on Form 1099-MISC, and the reporting threshold rose to $2,000 in 2026.

• Prizes without a wager. The IRS instructions for Form 1099-MISC direct sponsors to report prizes and awards not for services in box 3, including "amounts paid to a winner of a sweepstakes not involving a wager," and fair market value for merchandise. For tax years beginning after 2025, the threshold is $2,000 (previously $600), and it may be adjusted for inflation beginning in 2027.
• Gambling winnings. Form W-2G and 24% regular gambling withholding apply to gambling winnings, including from sweepstakes, wagering pools and lotteries; the IRS W-2G instructions require withholding when winnings minus the wager exceed $5,000. Because the 1099-MISC instructions direct sponsors to report prizes from sweepstakes not involving a wager in box 3, confirm with a tax advisor whether withholding applies to a large no-purchase prize.
• Non-US winners. Prizes paid to Canadian or other non-US residents generally fall under separate IRS rules for payments to foreign persons, reported on Form 1042-S rather than Form 1099-MISC. Confirm withholding and any treaty treatment with a tax advisor.
• Backup withholding. If a winner does not provide a taxpayer identification number, backup withholding applies at 24%. For a non-cash prize there is no cash to withhold, so official rules commonly make the award conditional on a completed tax form.
• Gift cards and stored value. Rewards issued as gift cards carry separate rules. Federal rules exclude loyalty and promotional gift cards from some protections only when required disclosures appear on the card (12 CFR 1005.20), and California's gift certificate law lets loyalty rewards given without any money or other thing of value in exchange carry an expiration date, provided the date appears in capital letters in at least 10-point type on the front (Civil Code section 1749.5).
• Unclaimed property. Whether unredeemed balances must be reported to a state depends on each state's law and on how the currency works, for example whether members bought it or earned it free. Confirm the treatment state by state rather than assuming either way.

Canadian prize and reward tax treatment differs from the US; confirm it with a Canadian tax advisor before launch. Across both countries, unredeemed points are also an accounting liability that finance must estimate. Alcohol and tobacco programs carry additional federal, state and provincial rules on promotions, eligibility and age; review them separately before launch.

How do you build compliance into a multi-jurisdiction program?

Build compliance into three layers: platform controls that apply each jurisdiction's rules automatically, jurisdiction-specific documents, and consent records that can prove what each member agreed to.

1. Platform controls. Eligibility, age limits (including the legal drinking age for alcohol promotions), exclusion of sponsor employees, entry mechanics and consent prompts should follow the member's location automatically: a free entry route for US members, Canadian rules and a skill-testing question for Canadian winners, excluded jurisdictions blocked at entry rather than only in the terms. When Brandmovers runs a program on BLOYL™, Brandmovers' promotions team, which includes in-house legal, works these rules into program setup, and they must match what the official rules and terms promise.
2. Jurisdiction-specific documents. Use core terms for what is common, with addenda for what differs: US official rules, Canadian official rules with the required disclosures, a California Notice of Financial Incentive, and privacy notices that reflect state and Quebec requirements.
3. Consent and reporting records. Record each consent with a timestamp, the version of the terms and notice the member saw, and the channel. Keep winner tax forms and filing confirmations for state registrations. CASL places the burden of proving consent on the sender, and California's regulations require businesses to keep records of consumer privacy requests and how they responded for at least 24 months (section 7101).

For a smaller program, the practical sequence is to launch in the jurisdictions where most members are, apply the strictest applicable rule where rules align, handle genuine conflicts (such as consent models or language) by jurisdiction, and add jurisdictions once the controls and records are in place.

Conclusion

A program that crosses state and national lines needs more than translated terms. It needs rules the platform enforces, documents written for each jurisdiction, and records that show what each member agreed to. Most of the requirements in this guide change often, from state privacy laws to IRS thresholds, so compliance is a standing process, not a launch task. If a regulator in your members' largest state asked tomorrow how a member consented, how quickly could you show them?

Sources

• IAPP, US State Privacy Legislation Tracker
• California Privacy Protection Agency, Updated Monetary Thresholds in CCPA
• California Attorney General, CCPA Enforcement Case Examples
• Legal Information Institute, Cal. Code Regs. tit. 11, section 7025 (opt-out preference signals)
• Colorado Attorney General, Universal Opt-Out and the Colorado Privacy Act
• IAPP, "There's no opting out of universal opt-outs" (July 2, 2025)
• Legal Information Institute, Cal. Code Regs. tit. 11, section 7101 (records)
• California Civil Code section 1798.120 (consumers under 16)
• Office of the Privacy Commissioner of Canada, PIPEDA in brief
• Quebec, Act respecting the protection of personal information in the private sector (P-39.1)
• CRTC, Frequently Asked Questions about Canada's Anti-Spam Legislation
• New York General Business Law section 369-E
• Florida Statutes section 849.094
• Criminal Code of Canada, section 206
• Competition Act of Canada, section 74.06
• Régie des alcools, des courses et des jeux, end of publicity contest oversight (legislation assented to October 27, 2023)
• IRS, Instructions for Forms 1099-MISC and 1099-NEC
• IRS, Instructions for Forms W-2G and 5754
• IRS, About Form 1042-S
• IRS, Backup withholding
• 12 CFR 1005.20, gift cards (Regulation E)
• California Civil Code section 1749.5 (gift certificates)