How To Write Loyalty Program Terms and Conditions

How to Write Loyalty Program Terms and Conditions: Plain-Language Principles, Required Elements, and Jurisdiction Disclosures

Every loyalty program needs terms and conditions. Most loyalty programs have them. A significant share of those T&Cs are inadequate, not because the team did not try, but because terms and conditions are typically drafted after the program is designed, by whoever has time, using whatever language felt appropriate at the moment. The result is a document that is simultaneously overwritten in the sections members do not read, the legalese disclaimers, and underwritten in the sections they actually need: the clear explanation of how points are earned, how redemption works, and what happens if the program changes.

This quality gap has become commercially consequential. On January 28, 2022, California Attorney General Rob Bonta announced an investigative sweep of businesses operating loyalty programs in California, sending notices alleging non-compliance with the California Consumer Privacy Act to major corporations across retail, home improvement, travel, and food services. The alleged failure was a specific one: not providing consumers with the disclosure the CCPA requires when personal information is collected in exchange for program benefits. Enforcement interest has not receded since, and the mandatory cure period that once let businesses fix violations before penalties attached was removed when the CPRA amendments took effect.

At the same time, programs that write plain-language terms members can actually read tend to generate fewer disputes and fewer customer service contacts than programs whose dense, legalistic T&Cs obscure rather than communicate the rules. Clear terms are not only a legal requirement. They are a program quality signal.

This article covers the required elements every loyalty program T&C must include, the plain-language principles that make those elements readable, the CCPA and multi-state privacy disclosure requirements that apply to programs serving US consumers, the modification rights and governance language that protects the sponsor without alienating members, and the jurisdiction-specific disclosures that apply to programs with cross-border participants.

Three Functions, One Document

Loyalty program terms and conditions are a multi-purpose document with three distinct functions that pull in partially different directions, and failing to satisfy all three is the most common source of both legal exposure and member dissatisfaction.

The contractual function. The T&C is the binding agreement between sponsor and member. It defines what the member is entitled to receive, what the sponsor commits to provide, and the conditions under which either party's obligations can change. This function demands completeness: every material rule stated, every exception documented, every sponsor right to modify, suspend, or terminate clearly reserved.

The regulatory function. The T&C, or an associated disclosure document, must satisfy the sponsor's legal disclosure obligations under applicable consumer protection law, privacy law, and any sector-specific regulation. For US programs this includes the CCPA's Notice of Financial Incentive for California residents, equivalent requirements under active state frameworks (Virginia, Colorado, Connecticut, Texas, Oregon, Montana and others), and the FTC's unfair or deceptive acts standards governing the accuracy and completeness of program rule disclosures. This function demands specificity: the notices must contain the categories of information each applicable law requires, in the form those laws specify.

The operational function. The T&C is a member-facing document that members will read, at least partially, when they want to understand the program. A member who cannot find or understand the answer to how many points a reward costs, or what happens to their balance after six months of inactivity, will contact customer service, creating cost and dissatisfaction that a well-written T&C would have prevented. This function demands clarity: rules written in language members can understand without legal training.

The Six Required Elements of Every Loyalty Program T&C

Element 1: Program Description and Sponsor Identity

The T&C must identify the legal name and contact information of the sponsoring organization; the program name and a brief description of what it offers; the effective date of the current version; and which entities and properties participate, where the program spans multiple brands, business units, or partners.

Sponsor identity is required both contractually, since the member must know who they are contracting with, and as a regulatory matter, since the CCPA requires the business to identify itself in the Notice of Financial Incentive and the FTC requires promotional rules to identify the sponsor. For coalition or multi-brand structures, naming all participating entities at the T&C level prevents later disputes about which entity's liability attaches to which member claim.

Element 2: Eligibility Requirements and Enrollment Mechanics

The T&C must state who is eligible to join (age minimum, geographic restrictions, any employment or affiliation exclusions); how enrollment occurs; what information is required at enrollment; whether membership is transferable; and the conditions under which membership may be revoked.

Age eligibility deserves specific attention. Programs collecting personal information from children under 13 without verifiable parental consent violate COPPA. Programs extending membership into markets where the age of digital consent is higher require separate handling: the GDPR sets a default age of 16 for consent to information society services, with member states permitted to lower it, but not below 13. The eligibility clause must be explicit about the minimum age and any jurisdiction-specific variation.

Element 3: Earn Mechanics and Qualifying Activities

The T&C must state how members earn the program's currency; what constitutes a qualifying activity; which products, services, or channels are excluded; the earn rate for partner relationships; how earn is calculated on returns and cancellations; and the process for reporting missing credits.

From the member's perspective this is the most operationally important section: it is what they read when they believe they earned credit and the system disagrees. Ambiguous earn rules generate the highest volume of service contacts in loyalty programs. Every exclusion (gift cards, alcohol, tobacco, promotional items, third-party delivery channels) must be stated explicitly. An exclusion the program applies in practice but never disclosed is not a rule the sponsor can rely on.

Element 4: Redemption Mechanics and Reward Catalog

The T&C must state the redemption rate or reward thresholds; what rewards are available and at what cost; any minimum redemption threshold; channel restrictions; whether points and cash can be combined; blackout dates or reward-specific restrictions; how availability is managed; and the process for reporting missing or incorrect redemptions.

This section creates the contractual basis for the sponsor's reward delivery obligations, and for the right to modify the catalog without member consent. The T&C should be explicit that the catalog is subject to change, that specific reward availability is not guaranteed, and that thresholds may be modified. Those rights still operate within consumer protection law: retroactively devaluing already-earned points without adequate notice invites unfair contract terms claims.

Element 5: Expiry, Forfeiture, and Account Inactivity Rules

The T&C must state the expiry policy for accumulated currency; the specific inactivity trigger, including what activity resets the clock; the consequences of inactivity that stops short of expiry, such as tier loss or communication changes; forfeiture conditions such as fraud or T&C violation; and whether forfeited currency can be reinstated and on what terms.

Expiry provisions are the most emotionally charged terms in the document. Loss aversion is one of the most robust findings in behavioral economics, and members who discover a balance expired without adequate warning generate complaint volume and public criticism out of proportion to the value lost. Committing in the T&C to advance notice of impending expiry, typically 30 to 60 days, converts a pure risk into a trust investment, and creates a documented standard the program can point to if the policy is ever challenged.

Element 6: Modification, Suspension, and Termination Rights

The T&C must state the sponsor's right to modify rules, earn rates, thresholds, and catalog; the mechanism by which changes are communicated; the effective date of changes; the member's options on material change, typically to continue on new terms or redeem within a defined window; the right to suspend or terminate the program; and what happens to accumulated balances on termination.

This is the most legally sensitive clause in the document, and it is covered in detail below.

The Six Required Elements: Reference Table

Plain-Language Drafting Principles

Plain-language drafting is not a creative preference. It is an explicit requirement of the CCPA's financial incentive notice regulation, a practical necessity under the FTC's clear and conspicuous standard, and the most effective approach to member-facing documentation.

The regulation is worth stating precisely. Under the CCPA's implementing regulations, the Notice of Financial Incentive must use plain, straightforward language rather than technical or legal jargon; be formatted so that it draws the consumer's attention and is readable; be available in the languages in which the business ordinarily provides information to California consumers; be reasonably accessible to consumers with disabilities; and be readily available for consumers to find before they opt in.

Those requirements describe the standard for one disclosure, but they articulate a sensible design standard for the whole document. The principles that follow from it:

Write for the median member, not the legal team. If a sentence needs reading twice, rewrite it. A workable test: would the member who calls support about their points understand the relevant provision without someone explaining it to them?

Use active voice and direct statement. Members earn 1 point per dollar spent beats Points shall be awarded to members on a one-point-per-dollar basis in connection with qualifying transactions. The first is understood on first reading; the second has to be parsed.

Define terms at first use, then stay consistent. If the currency is Reward Points in section 1, it cannot become credits, rewards, and points later. Inconsistent terminology creates ambiguity, and ambiguity in a contract of adhesion is generally construed against the drafter.

Use section headers that describe content. How Points Expire is a better header than Currency Forfeiture Policy. Members looking for the expiry rule will search for the plainly labeled section; members who would need to know the phrase currency forfeiture policy may never find it.

Provide a plain-language summary alongside the legal text. A well-established practice is to publish a short FAQ covering the questions members actually ask, on the program page, alongside the full T&C. The summary does not replace the legal document, but it serves the operational function and reduces support volume.

Do not bury material disclosures. A member who must scroll past three pages of limitation-of-liability language to find the expiry policy has not received effective notice of it, whatever the document technically contains.

The CCPA Notice of Financial Incentive

The CCPA applies to for-profit businesses that do business in California, collect California residents' personal information, and meet any one of three thresholds: annual gross revenue above an inflation-adjusted figure that stands at $26,625,000 as of January 2025 and is revised every odd-numbered year; annually buying, selling, or sharing the personal information of 100,000 or more California consumers or households; or deriving 50% or more of annual revenue from selling or sharing personal information.

Two points about those thresholds are commonly missed. The revenue figure is worldwide, not California revenue, and it moves with inflation, so the familiar $25 million number is out of date. And the second prong turns on sharing as well as buying and selling. Under the CPRA, sharing includes disclosing personal information for cross-context behavioral advertising, which means routine retargeting and analytics can carry a business across the 100,000 threshold without any conventional sale of data taking place.

A covered business that offers rewards, discounts, or other benefits in exchange for consumer personal information is operating a financial incentive program. The definition is expansive: a financial incentive is a program, benefit, or other offering related to the collection, deletion, or sale of personal information. Because a loyalty program enrolls members, collects their personal information, and provides benefits in exchange, it is a financial incentive program regardless of whether the sponsor thinks of it as a data exchange.

What the Notice Must Contain

The requirements sit in the CCPA's implementing regulations at 11 CCR section 7016. Note the citation: this provision was originally numbered section 999.307 and was renumbered to section 7016 in May 2022, then amended in March 2023. Guidance still citing 999.307 is working from a superseded numbering. The Notice must include:

• A succinct summary of the financial incentive or price or service difference offered, in plain language.
• A description of its material terms, including the categories of personal information implicated and the value of the consumer's data.
• How the consumer can opt in.
• A statement of the consumer's right to withdraw at any time, and how to exercise it.
• An explanation of how the incentive is reasonably related to the value of the consumer's data, including a good-faith estimate of that value and a description of the method used to calculate it.

The valuation requirement is the hardest element, and the stakes are higher than they first appear. The business must estimate the value of the consumer's personal information to the business, not the value of the loyalty benefit to the consumer, and publish it. The regulations permit several methods, including revenue-based, expense-based, profit-based, and marginal or aggregate value approaches, or any other practical and reasonably reliable method applied in good faith. But a business that cannot produce a good-faith estimate, or cannot demonstrate that the incentive is reasonably related to that value, is not permitted to offer the incentive at all. The valuation is not paperwork attached to the program; it is a condition of running it.

Published notices show how differently businesses approach this. Marriott publishes a combined California and Colorado notice for the Bonvoy program, basing its good-faith estimate on the value arising from its commercial relationships and from collecting and retaining the personal data of members who voluntarily enrolled, and noting that the estimate is not specific to any individual and varies by consumer. Other businesses publish valuations at or near zero. Because these notices are revised periodically, any specific figure cited from a competitor's notice should be checked against the live document rather than a secondary summary. It is also worth remembering that a published valuation is a public statement by the business, and can be quoted back to it.

Format and Placement

The Notice must be provided before or at the time the consumer opts in, not after enrollment completes. It must use plain language, be formatted to draw attention, be available in the languages the business ordinarily uses with California consumers, be reasonably accessible to consumers with disabilities, and be readily findable before opt-in. It may live inside the T&C, stand as a separate document, or sit within the privacy policy. What it cannot do is appear only after the member has already joined.

Multi-State and International Disclosures

California is the most extensively enforced US privacy regime but no longer the only one relevant to loyalty programs. Comprehensive state frameworks are in effect across Virginia, Colorado, Connecticut, Texas, Oregon, Montana and a growing list of others, with further states phasing in.

Colorado is worth specific attention because its Privacy Act rules define a Bona Fide Loyalty Program, a program established for the genuine purpose of providing discounts, rewards, or other actual value to members who voluntarily participate, and set provisions specific to it. Marriott's combined California and Colorado notice illustrates the practical response: where two states' requirements overlap substantially, a single document can address both, with state-specific sections where they diverge.

For national programs, the workable approach is to design disclosures to the most demanding applicable standard, generally California's, and confirm the result also covers the material requirements of other active frameworks. Where a state's requirements materially differ, add a jurisdiction-specific section rather than blurring the differences into one undifferentiated notice.

GDPR and UK GDPR

Programs that accept members from the EU or UK, or whose members relocate there after enrolling, are processing personal data subject to the GDPR or UK GDPR. Those transparency requirements are more extensive than the CCPA's financial incentive notice: a full data processing notice covering the legal basis for processing, retention periods, data subject rights (access, rectification, erasure, portability, restriction, and objection), the right to lodge a complaint with a supervisory authority, and information about international transfers and the safeguards applied.

For a program designed for US consumers that accepts a small number of EU or UK participants, the practical approach is a compliant data processing notice for those members, either as a jurisdiction-specific section of the T&C or a separate linked document. Programs with substantial European populations should work with qualified counsel on the underlying data processing infrastructure, not only the disclosures, since GDPR obligations run well past what any notice can fix.

The Modification Rights Clause: Flexibility Against Trust

The modification clause is the provision most likely to draw scrutiny when exercised and the one most essential to have in place before any change becomes necessary. Drafting it well means anticipating a genuine tension: the sponsor needs to modify program economics without being locked into terms that may become commercially unsustainable, and the member reasonably expects that the program they joined will not be restructured without their knowledge or a fair chance to use what they earned.

The risk is not hypothetical. Law firm commentary on emerging loyalty program risk has noted that unilateral changes to program terms may be viewed through the lens of unfair contract terms, and that challenges are likelier where changes are applied retrospectively or communicated poorly. Federal attention has followed the same logic. In September 2024, the Department of Transportation, under then-Secretary Pete Buttigieg, opened an inquiry into the loyalty programs of the four largest US airlines, seeking records on devaluation of earned rewards, hidden and dynamic pricing, extra fees, and competitive effects. The framing was pointed: members treat their balances as savings, but unlike a savings account, those balances are controlled by a company that can unilaterally change their value. The inquiry followed a joint DOT and CFPB hearing earlier that year. The Department has since changed leadership and the inquiry's outcome has not been publicly reported, so it should be read as an indicator of how regulators frame the issue rather than as a settled enforcement position.

What a Well-Designed Clause Includes

A clear statement of the modification right, covering earn rates, redemption thresholds, catalog, and the terms themselves. State it without excessive self-limitation: programs that promise specific minimum earn rates or thresholds may find those promises commercially unsustainable later.

A notice commitment for material changes, specifying the channel (email to enrolled members, app notification, website posting) and a minimum notice period before material changes take effect, commonly 30 to 60 days for changes affecting accumulated balance value or tier qualification.

A definition of material change, ideally naming earn rate, redemption thresholds, expiry policy, and tier qualification criteria as material. This protects members from silent devaluation and gives the sponsor a clear trigger for its own notice obligation, which matters as much internally as externally.

A redemption window under the old terms for a defined period after a material change takes effect. This costs the sponsor a modest amount of incremental redemption and buys a disproportionate reduction in complaints and in the appearance of bad faith. It is the cheapest legal insurance in the document.

A termination clause specifying minimum notice for program termination and the window during which balances remain redeemable afterward. A 90-day post-announcement redemption window is a defensible standard: meaningful time for members to use accumulated value, without an indefinite legacy obligation.

Conclusion

Loyalty program terms and conditions occupy an unusual position: often the last thing drafted before launch, and the first thing that matters when something goes wrong. A member dispute over expired points, a regulatory inquiry about CCPA compliance, a support surge after a program change: in each case the T&C determines whether the sponsor has a defensible position or a live exposure.

The programs that get this right treat the T&C the way they treat program design: with a clear view of what the document must achieve across its three functions, the specific legal requirements that apply, and the member experience standards that make it useful to the people it governs.

Plain language, complete disclosure, modification rights paired with real notice commitments, and jurisdiction-specific sections for the frameworks where members actually live. These are the building blocks of terms that work as designed. They reduce regulatory exposure. They reduce disputes. And they signal that the program is operated with the member's understanding, rather than their confusion, as the design objective.