How To Write Loyalty Program Terms and Conditions

Loyalty program terms and conditions (T&Cs) are the binding rules of a loyalty program: who can join, how members earn and redeem, when balances expire, and how the sponsor can change or end the program, written so members can understand them and so they meet the privacy and consumer protection disclosures that apply.

Weak loyalty T&Cs tend to fail in the same way: long on liability language members skip, short on the rules they actually look for, such as how points are earned, when they expire and what happens if the program changes. That gap now carries enforcement risk. On January 28, 2022, California's Attorney General announced an investigative sweep of businesses operating loyalty programs, sending notices of alleged CCPA non-compliance to major companies in retail, home improvement, travel and food services for failing to provide a notice of financial incentive. This guide covers what every US loyalty program's T&Cs must contain, the CCPA notice, state privacy rules, the modification clause, and the edge cases that trip programs up.

Key Takeaways

What jobs do loyalty program T&Cs have to do?

Loyalty program T&Cs have three jobs at once: they are a contract, a regulatory disclosure and an operating guide, and each job pulls the document in a different direction.

• Contract. The T&Cs define what the member is entitled to, what the sponsor commits to, and when either can change. This job demands completeness: every material rule and every reserved right written down.
• Regulatory disclosure. The T&Cs, or linked documents, must meet the disclosures that apply to the program, such as the CCPA's Notice of Financial Incentive for California residents and the Federal Trade Commission Act's ban on unfair or deceptive practices, which applies to how program rules are presented. This job demands specificity.
• Operating guide. Members read the T&Cs when something has gone wrong: a missing credit, an expired balance, a reward that costs more than they expected. If they cannot find the answer, they contact support. This job demands clarity.

What must every loyalty program's T&Cs include?

Every loyalty program's T&Cs should cover six elements: program and sponsor identity, eligibility and enrollment, earning, redemption, expiry and forfeiture, and modification, suspension and termination.

1. Program and sponsor identity

State the sponsor's legal name and contact details, the program name, the effective date of the current version, and every participating brand or partner. In a multi-brand or coalition program, naming each entity prevents later disputes over which company owes a member what.

2. Eligibility and enrollment

State the minimum age, any geographic limits or exclusions (for example, employees), how enrollment works, what information is required, whether membership is transferable, and when it can be revoked. Age deserves care: the FTC's COPPA Rule applies to online services directed to children under 13, or that knowingly collect personal information from them. Setting the minimum age at 13 or above, and saying so, reduces exposure, but COPPA still applies if the program is directed to children or the sponsor learns it has collected a child's data. Under the CCPA, a business also may not sell or share the personal information of a consumer it knows is under 16 without affirmative authorization (Civil Code section 1798.120).

3. Earning

State how members earn the program's currency, what counts as a qualifying purchase or activity, what is excluded (gift cards, alcohol, tobacco, third-party delivery orders), partner earn rates, how returns and cancellations reverse points, and how to report a missing credit. An exclusion the program applies in practice but never wrote down is hard to defend when a member disputes it.

4. Redemption

State the reward thresholds and redemption options, minimums, channel limits, whether points and cash can be combined, blackout dates, and how to report a redemption error. Reserve the right to change the catalog and thresholds, and say how members will be told.

5. Expiry, forfeiture and inactivity

State whether points expire, what inactivity triggers expiry, what activity resets the clock, any consequences short of expiry (such as tier loss), forfeiture conditions (fraud, abuse, breach of the terms), and whether forfeited points can be reinstated. Commit in writing to warn members before points expire. Once written, the commitment is a contractual obligation, so choose a warning schedule and channel the program can always deliver. A balance that disappears without warning turns a small liability saving into a complaint, and the written commitment gives the program a standard it can show it met.

6. Modification, suspension and termination

State the sponsor's right to change rules, earn rates, thresholds and the catalog; how and when changes are communicated; what members can do after a material change; the right to suspend or end the program; and what happens to balances on termination. This is the most sensitive clause, covered in detail below.

The document and the program have to match. When Brandmovers builds a program on BLOYL™, the earn, redemption and expiry rules configured in the platform and the rules written in the T&Cs need to say exactly the same thing; a mismatch between what the terms promise and what the system does is where member disputes begin.

How do you write T&Cs members can understand?

Write T&Cs members can understand by using short, direct sentences, consistent defined terms, descriptive headings and a plain-language summary alongside the full text.

For the CCPA notice, plain language is a legal requirement: section 7003 of the regulations requires disclosures to use plain, straightforward language and avoid technical or legal jargon, to use a format that is readable, including on smaller screens, to be available in the languages the business ordinarily uses with California consumers, and to be reasonably accessible to consumers with disabilities. The same standard works for the whole document.

• Write for the member who is about to call support. If a sentence needs reading twice, rewrite it.
• Use active voice. "Members earn 1 point per $1 spent" beats "Points shall be awarded to members on a one-point-per-dollar basis in connection with qualifying transactions."
• Define terms once and keep them. If the currency is "Reward Points" in section 1, it cannot become "credits" in section 5. Uncertain contract language is generally read against the party that caused the uncertainty, as California's Civil Code section 1654 provides.
• Use headings that describe content. "How points expire" is easier to find than "Currency forfeiture policy."
• Publish a short FAQ next to the full text, covering the questions members actually ask. It does not replace the terms, but it does the operating-guide job.
• Do not bury material terms. An expiry rule placed after pages of liability language has not been communicated effectively, whatever the document technically contains.

What does the CCPA require of a loyalty program?

The CCPA requires a covered business whose loyalty program collects personal information in exchange for benefits to give a Notice of Financial Incentive before enrollment, obtain the member's prior opt-in consent, and base the offer on a good-faith estimate of the value of the member's data.

Which businesses are covered?

The CCPA applies to for-profit businesses that do business in California and meet at least one of three tests: annual gross revenue above the statutory threshold in the preceding calendar year, which the California Privacy Protection Agency (CPPA) adjusts for inflation every odd-numbered year and which is $26,625,000 from January 1, 2025; annually buying, selling or sharing the personal information of 100,000 or more consumers or households; or deriving 50% or more of annual revenue from selling or sharing personal information. "Sharing" includes disclosing personal information to a third party for cross-context behavioral advertising, so ad retargeting can count toward the 100,000 test. B2B and channel programs are not exempt: the CCPA's exemptions for employee and business-to-business data expired on December 31, 2022, so California members of those programs are consumers under the law. A business below these thresholds is outside the CCPA, but the FTC Act and state laws on unfair or deceptive practices still apply to how program rules are presented, and other states' privacy laws use different thresholds.

Why is a loyalty program a financial incentive?

Under Civil Code section 1798.125, a business may offer financial incentives for the collection, sale, sharing or retention of personal information, but "may enter a consumer into a financial incentive program only if the consumer gives the business prior opt-in consent," which the consumer can revoke at any time. Financial incentive practices must not be "unjust, unreasonable, coercive, or usurious." A program that enrolls members, collects their data and gives benefits in return fits this description whether or not the sponsor thinks of it as a data exchange.

What must the notice contain?

The requirements sit at section 7016 of the CCPA regulations (renumbered from section 999.307 on May 5, 2022, and amended March 29, 2023, per the regulatory history; the text is unchanged in the regulations effective January 1, 2026). The notice must include:

• A succinct summary of the incentive.
• Its material terms, including the categories of personal information involved and the value of the consumer's data.
• How to opt in.
• The right to withdraw at any time, and how to exercise it.
• How the price or service difference is reasonably related to the value of the consumer's data, with a good-faith estimate of that value and the method used to calculate it.

The notice must be readily available where consumers will see it before they opt in. Online, it can be a link that goes directly to the relevant section of the privacy policy. It can live in the T&Cs, a separate document or the privacy policy; it cannot appear only after enrollment.

How do you value the member's data?

The valuation is a condition of running the program, not paperwork. Section 7080 states that a business unable to calculate a good-faith estimate, or unable to show that the price or service difference is reasonably related to the value of the data, "shall not offer the price or service difference." For most loyalty programs, the member benefits are that difference. Section 7081 lists permitted methods, including the marginal, average or aggregate value of the data to the business, related revenue, expenses or profit, or "any other practical and reasonably reliable method of calculation used in good faith," and requires the business to document the method.

Published notices show what this looks like. Marriott's combined California and Colorado notice for Marriott Bonvoy estimates the value of a member's personal data at "approximately $0.48 per Consumer in 2024," based on the value arising from its commercial relationships and the data of consumers who chose to join and stay in the program. A published estimate is a public statement, so document the method behind it.

What happens if the notice is missing?

As of January 1, 2023, the Attorney General's enforcement page states, "the CCPA no longer requires notice of a violation or an opportunity to cure before filing an enforcement action." The 2022 sweep letters gave businesses 30 days to cure; that grace period no longer applies. The same page describes how businesses that were notified responded: posting notices where in-store enrollment happens, deep-linking to online notices, redesigning enrollment to capture express opt-in consent, and revising notices to disclose material terms. The Attorney General is not the only enforcer: the California Privacy Protection Agency can also bring enforcement actions, and administrative fines, adjusted for inflation on the same schedule as the revenue threshold, are up to $2,663 per violation, or $7,988 for intentional violations and violations involving minors under 16, from January 1, 2025.

What about other state privacy laws?

Other state privacy laws also reach loyalty programs, and Colorado's rules address them directly.

The Colorado Privacy Act rules (4 CCR 904-3, current version effective December 1, 2025) define a "Bona Fide Loyalty Program" (Rule 2.02) as one established for the genuine purpose of providing benefits to consumers who voluntarily participate, and Rule 6.05 sets out what happens to those benefits when a member exercises privacy rights such as deletion. Marriott's notice covers California and Colorado in one document, which shows a workable approach: meet the stricter requirement on each point, since neither state is stricter on every point, then add state-specific sections where requirements differ. This guide covers US programs; programs with members outside the US need separate advice, and Brandmovers has a separate guide to cross-border loyalty compliance.

How should the modification clause balance flexibility and trust?

A good modification clause gives the sponsor the right to change the program while committing to advance notice, defining what counts as a material change, and giving members a window to redeem under the old terms.

The tension is real. The sponsor needs to adjust program economics; members reasonably expect that the value they earned will not be cut without warning. Federal regulators have taken an interest in exactly this point. On September 5, 2024, the Department of Transportation launched an inquiry into the rewards programs of American, Delta, Southwest and United, focused on the devaluation of earned rewards, hidden or dynamic pricing, extra fees, and reduced competition and choice. It followed a joint CFPB and DOT public hearing earlier that year. The then Secretary said many Americans view their points "as part of their savings," but that, unlike a savings account, they are controlled by a company that can change their value unilaterally. The release notes that many airlines reserve the right to change terms, and therefore the value of rewards, at their discretion. DOT's authority here is specific to airlines, but the concerns it raised apply to any program that reserves the right to change terms unilaterally.

A well-designed clause includes:

1. A clear right to modify earn rates, thresholds, the catalog and the terms. Avoid promising minimum earn rates the program may not be able to sustain.
2. A notice commitment for material changes: the channel (email, app, website) and a minimum period before changes take effect. Choose a period the program can always meet, and state it. If notices go by text message, marketing texts sent with automated technology generally need the member's prior express written consent under the Telephone Consumer Protection Act rules (47 CFR 64.1200), so keep promotional content out of expiry and change notices sent by text.
3. A definition of material change, naming at least earn rates, redemption thresholds, expiry rules and tier qualification. The definition also tells the sponsor's own team when the notice obligation applies.
4. A redemption window under the old terms after a material change. It costs some extra redemption and removes much of the appearance of bad faith.
5. A termination clause with minimum notice and a period after the announcement during which balances can still be redeemed. Agree on the treatment of outstanding balances with finance, because it changes the liability.

Which edge cases do loyalty T&Cs miss?

Five edge cases deserve specific attention: paid memberships that renew automatically, arbitration clauses, bonus promotions that become sweepstakes, rewards issued as gift cards or cash balances, and consent that is assumed rather than obtained.

• Paid tiers that auto-renew. A paid membership that renews automatically is subject to state automatic renewal laws. California's law was amended from July 1, 2025 to require the consumer's express affirmative consent to renewal terms, an annual reminder, and advance notice of price changes. At the federal level, the FTC's amended "click-to-cancel" Negative Option Rule was vacated by the Eighth Circuit on July 8, 2025. For online sign-ups, the Restore Online Shoppers' Confidence Act (15 U.S.C. 8403) still requires clear disclosure of material terms, express informed consent before charging, and a simple way to stop recurring charges, and state laws add further requirements.
• Arbitration and class-action waivers. Many programs require individual arbitration. The Supreme Court held in AT&T Mobility v. Concepcion (2011) that the Federal Arbitration Act preempted California's rule treating class-arbitration waivers in consumer contracts as unconscionable. Enforceability still depends on how the clause is presented and accepted, so counsel should draft it. Individual arbitration has a cost of its own: it can expose a sponsor to mass arbitration, with filing fees on thousands of separate claims.
• Bonus promotions that become sweepstakes. A points promotion that awards prizes by chance can become an illegal lottery if entry requires a purchase, which is why sweepstakes offer a free method of entry. Some states add filing and bonding rules for larger prize pools, including New York (filing 30 days before the start) and Florida (7 days). Run these under separate official rules; the promotions compliance guide covers them.
• Rewards issued as gift cards or cash balances. Federal rules exclude loyalty, award and promotional gift cards from some gift card protections only if required disclosures, such as the card's purpose and expiration date, appear on it (12 CFR 1005.20). California's gift certificate law exempts loyalty rewards only when they are given without any money or other thing of value in exchange (Civil Code section 1749.5). Points members can buy, or balances that act like cash, can raise gift card and unclaimed property questions, so confirm treatment with counsel.
• Consent assumed rather than obtained. Under the CCPA, notice is not enough: the member must opt in before being entered into the program. Section 7004 of the regulations states that "a consumer's silence or failure to act affirmatively does not constitute consent," so design enrollment around an affirmative opt-in, not a default.

How do you know the T&Cs are working?

You know the T&Cs are working when members rarely need support to understand them and the program can show it met its own commitments.

• Track support contacts by T&C topic. Tag contacts about missing credits, expiry, redemption costs and rule changes. A rising share on one topic points to the section to rewrite.
• Keep consent and notice records. Store when and how each member opted in and which version of the terms and notice they saw. California's automatic renewal law, for example, requires paid-renewal consent records to be kept for at least three years, or one year after the contract ends if that is longer.
• Log expiry warnings and change notices. Record that each warning was sent, and when, so the program can show it kept its notice commitments.
• Segment the obligations. California residents, Colorado residents, members of paid tiers and members near expiry each trigger different notices. Tag members so each group receives the notice that applies to it, and review the terms whenever a new state law takes effect.

This is general information, not legal advice.

Conclusion

T&Cs are usually the last document written before launch and the first one read when something goes wrong: a disputed expiry, a regulator's letter, a surge of complaints after a program change. Programs that treat them as part of program design, with the six elements covered, the CCPA notice and consent in place before enrollment, change rights paired with real notice, and the edge cases handled, have a defensible position when that moment comes. Would your current terms tell a member, in one reading, what happens to their points if the program changes tomorrow?

Sources

• California Attorney General, "On Data Privacy Day, Attorney General Bonta Puts Businesses Operating Loyalty Programs on Notice for Violations of California Consumer Privacy Act" (January 28, 2022)
• California Attorney General, CCPA Enforcement Case Examples
• California Civil Code section 1798.125 (financial incentives)
• California Civil Code section 1798.120 (consumers under 16)
• California Civil Code section 1798.140 (definitions)
• California Civil Code section 1749.5 (gift certificates)
• California Civil Code section 1654 (interpretation against the drafter)
• California Privacy Protection Agency, Updated Monetary Thresholds in CCPA
• California Privacy Protection Agency, Frequently Asked Questions
• California Privacy Protection Agency, CCPA Regulations (effective January 1, 2026), sections 7003, 7004, 7016, 7080 and 7081
• Legal Information Institute, Cal. Code Regs. tit. 11, section 7016 (regulatory history)
• Colorado Secretary of State, Code of Colorado Regulations, 4 CCR 904-3, Colorado Privacy Act Rules (effective December 1, 2025)
• Marriott International, California Notice of Financial Incentive / Colorado Bona Fide Loyalty Program
• US Department of Transportation, "USDOT Seeks to Protect Consumers' Airline Rewards in Probe of Four Largest U.S. Airlines' Rewards Practices" (September 5, 2024)
• Federal Trade Commission, Children's Online Privacy Protection Rule (COPPA)
• 15 U.S.C. 8403, Restore Online Shoppers' Confidence Act
• 12 CFR 1005.20, gift cards (Regulation E)
• 47 CFR 64.1200, telemarketing and text message consent (TCPA rules)
• California Legislature, AB 2863 (automatic renewal and continuous service offers)
• US Court of Appeals for the Eighth Circuit, Custom Communications, Inc. v. FTC (July 8, 2025)
• Legal Information Institute, AT&T Mobility LLC v. Concepcion, 563 U.S. 333 (2011)
• New York General Business Law section 369-E
• Florida Statutes section 849.094