|
How this guide was prepared. Last updated October 2026. It draws on Brandmovers' experience designing loyalty programs and promotions for regulated categories, for clients including JTI Inc. and Deutsch Family Wines & Spirits. It also draws on federal statutes and regulations (FDA, HHS, TTB, the CFPB's Regulation DD and federal health care program law), the Federal Trade Commission, and California, Virginia and Washington privacy law, each checked at its source. This is general information, not legal advice. |
Compliance-first loyalty design means treating regulatory rules as inputs to a loyalty program's design, deciding which mechanics, data uses, rewards and messages are allowed before the program is built, rather than reviewing a finished design for problems. In regulated industries such as financial services, healthcare, alcohol and tobacco, those rules can exclude mechanics that work elsewhere.
A points program that works for a grocery brand may be prohibited for a cigarette brand. A sweepstakes that drives sign-ups for a snack brand needs a free way to enter everywhere. A pharmacy program that uses prescription data for marketing needs patient authorization. This guide covers why regulated categories change the design, which mechanics work in each, how to build consent into the program, the reward and communication rules to check, and a sequence for building compliance into the brief.
|
Regulated industries limit which rewards can be offered, what data can be used and how programs are promoted, so some standard loyalty mechanics are restricted or prohibited.
Most loyalty design assumes the main limits are budget, technology and customer behavior. In regulated categories, a second set of limits applies before a mechanic is chosen: product-specific federal rules, state law that varies by market, and privacy laws that treat some data as sensitive. A design that is allowed in one category or state may not be allowed in another, which is why the rules belong in the brief, not in a review after the program is built. The guide to incentive compliance in regulated industries covers incentive rules in more depth.
Common loyalty mechanics usually work in financial services and healthcare with the right disclosures and data limits, but tobacco purchase rewards are restricted federally and alcohol rules vary.
|
Mechanic |
Financial services |
Healthcare and pharma |
Alcohol |
Cigarettes and smokeless tobacco |
|---|---|---|---|---|
|
Points per purchase |
Check product rules; rewards for opening an account or maintaining or increasing a balance can be Regulation DD bonuses with disclosure rules |
Workable if no protected health information is used for marketing without authorization |
Varies by state; verify legal drinking age |
Gifts or non-tobacco items for purchases or proofs of purchase are prohibited (21 CFR 1140.34(b)) |
|
Tiered status |
Check whether benefits differ by product terms |
Workable; avoid tiers tied to clinical behavior |
Varies by state; verify legal drinking age |
Same prohibition applies to purchase-based rewards |
|
Sweepstakes and instant wins |
Free entry required |
Free entry required; avoid tying entry to prescriptions |
Free entry required; state alcohol rules vary |
Purchase-based entry conflicts with 1140.34(b) |
|
Referral rewards |
Check product and state rules |
Restricted where rewards steer federal program patients to providers |
Adults only; varies by state |
Purchase-linked rewards prohibited |
|
Non-purchase earning (surveys, content) |
Generally workable with privacy notices |
Workable if health data rules are met |
Adults only |
Avoid any link to purchase; no rewards bearing cigarette or smokeless brand indicia (1140.34(a)) |
The table shows starting points to check, not answers. State law, product type and the program's structure all change the result. This guide does not cover credit card rewards rules, lottery, cannabis or state-by-state alcohol rules in detail; check those against the specific product and each market before choosing mechanics.
Federal rules prohibit cigarette and smokeless tobacco manufacturers, distributors and retailers from giving gifts or non-tobacco items in exchange for a purchase or proof of purchase.
The FDA rule states: "No manufacturer, distributor, or retailer may offer or cause to be offered any gift or item (other than cigarettes or smokeless tobacco) to any person purchasing cigarettes or smokeless tobacco in consideration of the purchase thereof, or to any person in consideration of furnishing evidence, such as credits, proofs-of-purchase, or coupons, of such a purchase" (21 CFR 1140.34). A conventional points-for-purchase program that pays out merchandise, gift cards or experiences on cigarette or smokeless purchases conflicts with that rule. The same section bars manufacturers and distributors of imported cigarettes or smokeless tobacco from marketing, licensing, distributing or selling non-tobacco items or services bearing a cigarette or smokeless brand name, logo or other brand indicia, even without a purchase (1140.34(a)), and bars brand-name sponsorship of athletic, musical, artistic or other social or cultural events (1140.34(c)). The rule's only carve-out is cigarettes or smokeless tobacco themselves, but a separate rule bans free samples of cigarettes and other tobacco products and allows free smokeless samples only in qualified adult-only facilities (21 CFR 1140.16). Section 1140.34 names cigarettes and smokeless tobacco; other tobacco products face other federal and state rules. Programs in this category need to be designed around these limits, with age verification and state rules added.
HIPAA limits how covered entities market with health information, federal law penalizes rewards that steer Medicare or Medicaid patients to particular providers, and some states protect other health data.
HIPAA applies to covered entities. HIPAA's covered entities are health plans, health care clearinghouses and health care providers that conduct covered electronic transactions (45 CFR 160.103). Vendors that handle protected health information on their behalf are business associates, a separate category that HIPAA also regulates. A pharmacy is typically a covered entity; a consumer brand selling over-the-counter products is typically not. For covered entities, "a covered entity must obtain an authorization for any use or disclosure of protected health information for marketing," with exceptions for face-to-face communications and "A promotional gift of nominal value" (45 CFR 164.508). The definition of marketing excludes some communications, including refill reminders for a drug currently prescribed to the individual where any payment the covered entity receives is reasonably related to the cost of the communication (45 CFR 164.501).
Rewards to federal program patients. Federal law imposes civil monetary penalties on anyone who offers or transfers remuneration to a Medicare or state health care program beneficiary "that such person knows or should know is likely to influence such individual to order or receive from a particular provider, practitioner, or supplier any item or service" payable by those programs (42 U.S.C. 1320a-7a). Reward triggers tied to filling prescriptions or choosing a provider need to be checked against this rule. The statute excludes coupons, rebates or other rewards from a retailer that are offered on equal terms to the general public regardless of health insurance status and are not tied to items or services reimbursed by Medicare or a state health care program, so a pharmacy program that rewards general store purchases on those terms is treated differently from one that rewards prescription fills. A separate criminal statute, the Anti-Kickback Statute, applies to anyone who knowingly and willfully offers remuneration to induce the purchase of an item payable by a federal health care program (42 U.S.C. 1320a-7b), which matters for manufacturer programs on reimbursed products.
Worked example: one program across a pharmacy's front store and counter. A pharmacy that is a HIPAA covered entity can offer points on general store purchases on the same terms to every shopper, regardless of insurance status, which fits the retailer exception in 42 U.S.C. 1320a-7a. Points or sweepstakes entries earned by filling a prescription do not fit it, because they are tied to items Medicare or Medicaid may pay for. A refill reminder for a drug the member is currently prescribed is not marketing under 45 CFR 164.501 if any third-party payment only covers the cost of sending it, but using prescription history to promote a manufacturer's product when that manufacturer pays the pharmacy for the message is marketing that needs the patient's authorization under 45 CFR 164.508. The guide to AKS-compliant healthcare distributor incentives covers the channel side.
Health data outside HIPAA. Washington's My Health My Data Act protects "personal health data that falls outside the ambit" of HIPAA, and the state attorney general notes it defines consumer health data to include the "use and purchase of prescribed medication" (Washington Attorney General). Under the attorney general's guidance, non-prescription purchase data counts only if the business draws an inference about health status from it, and the law was developed to protect such data "from being collected and shared without that consumer's consent." Loyalty programs that infer health status from purchases need consent built into collection and sharing.
Financial services loyalty programs must follow the disclosure and fairness rules for the underlying product, such as Regulation DD for deposit-account bonuses, and state law on how rewards are offered.
For deposit accounts, Regulation DD defines a bonus as "a premium, gift, award, or other consideration worth more than $10 (whether in the form of cash, credit, merchandise, or any equivalent) given or offered to a consumer during a year in exchange for opening, maintaining, renewing, or increasing an account balance" (12 CFR 1030.2), and advertisements that state a bonus must disclose terms such as the time and minimum balance required to obtain it (12 CFR 1030.8). Regulation DD applies to depository institutions other than credit unions, but its advertising rules apply to "any person who advertises an account offered by a depository institution, including deposit brokers" (12 CFR 1030.1), so a loyalty or marketing partner that advertises a bank's account bonus is covered too. Credit unions follow the NCUA's parallel Truth in Savings rule, which defines a bonus as consideration "worth more than $10" given or offered to a member during a year for opening, maintaining or renewing an account or increasing its balance (12 CFR 707.2). Account disclosures must also state the amount or type of any bonus, when it will be provided, and any minimum balance and time requirements (12 CFR 1030.4). Credit, insurance and investment products have their own rules, so check reward conditions against the specific product. Unclaimed property rules for unredeemed balances vary by state and by how rewards are structured, so check them during design rather than after launch.
Alcohol loyalty programs need reliable age verification and must follow state alcohol rules, which vary widely on discounts, rewards, sweepstakes and supplier involvement with retailers.
Because alcohol rules differ so much by state and by who runs the program (a supplier, a distributor or a retailer), check each market before choosing mechanics. At the federal level, TTB rules allow "Contest prizes, premium offers, refunds, and like items" to be offered by industry members directly to consumers, with "Officers, employees and representatives of wholesalers or retailers" excluded, and allow coupons when all retailers in the market can redeem them (27 CFR 6.96). The federal tied-house rule also bars producers, importers and wholesalers from giving retailers money, services or other things of value to induce them to buy their products to the exclusion of others' products (27 U.S.C. 205), which matters when a supplier funds a retailer's program. Age verification should apply at enrollment, at each promotional entry point and, where relevant, at redemption; self-reported birth dates alone are weak protection. The guide to digital marketing for alcohol brands covers platform age rules and industry codes.
Sweepstakes need a free way to enter; requiring a purchase or payment to enter or to improve the odds can turn a sweepstakes into an illegal lottery under state law.
The FTC's consumer guidance on prize scams states the basic rule: "It's illegal to ask you to pay or buy something to enter or to increase your odds of winning" (FTC). Offer a free method of entry that is genuinely usable, publish official rules, and check state registration and bonding requirements for larger prize pools. In a loyalty program, entries bought with points earned from purchases can count as paying to enter, so give non-purchasers an equal free route to the same entries. The promotions compliance guide covers state requirements. In tobacco, purchase-based entries also conflict with the federal gift rule above.
Collect only needed data, disclose actual practices, and design sensitive-data handling for the strictest rule that applies: California gives a right to limit, while Virginia requires consent.
Know which law applies. California's privacy law applies to businesses that meet its thresholds, such as "gross annual revenue of $26.625 million or more" (effective January 1, 2025) (CPPA). It gives consumers "the right, at any time, to direct a business that collects sensitive personal information about the consumer to limit its use" to what is necessary (Cal. Civ. Code 1798.121). Separately, a business that offers financial incentives, such as discounts or other benefits in exchange for personal information, must notify consumers and may enter a consumer into the program only with "prior opt-in consent" that describes its material terms and "may be revoked by the consumer at any time" (Cal. Civ. Code 1798.125). Virginia requires a controller to "Not process sensitive data concerning a consumer without obtaining the consumer's consent" (Va. Code 59.1-578), and expressly allows different prices or benefits tied to a consumer's voluntary participation in a "bona fide loyalty, rewards, premium features, discounts, or club card program." Neither law reaches everything. Virginia's law applies to businesses that process data of at least 100,000 Virginia consumers, or 25,000 while deriving over half of gross revenue from selling personal data, and does not apply to financial institutions subject to the Gramm-Leach-Bliley Act or to HIPAA covered entities and business associates (Va. Code 59.1-576). California's law does not apply to personal information handled under the Gramm-Leach-Bliley Act (Cal. Civ. Code 1798.145) or to protected health information collected by HIPAA covered entities and business associates (Cal. Civ. Code 1798.146). For banks and pharmacies, the federal rules above often govern instead.
Disclose what actually happens. Enrollment notices should describe the data collected, why, and whether it is shared for marketing. A notice that describes data use in general terms while the program shares behavioral data with advertising partners invites enforcement.
Minimize and make rights work. Collect data progressively in exchange for value members can see, and make sure the platform can actually carry out deletion and opt-out requests. Brandmovers maintains SOC 2 Type II and PCI DSS compliance and is GDPR compliant. These address security controls, card data and EU data protection; they do not by themselves satisfy HIPAA, state health data or state privacy requirements, so the program's own data choices still need the checks above.
Check reward triggers, reward values and expiration terms against category rules, and check every deployed message against what was approved, since a message can change between approval and sending.
Reward triggers. Avoid triggers tied to clinical decisions, credit use or tobacco purchases, and keep rewards aligned with behaviors the category allows.
Program terms. Terms should state how members earn and redeem, expiration rules and the operator's right to change or end the program. The guide to loyalty program terms and conditions covers drafting.
Deployment. Version control and approval records matter, because a message approved as a template can change before it is sent. Check final deployed messages, not only templates.
Build compliance into the brief by identifying the category rules, markets and data types first, then choosing mechanics, rewards and messages that fit, before creative work and budgets are fixed.
Following this order surfaces restrictions before budgets and creative are committed, which reduces the risk of late redesign. BLOYL™, Brandmovers' enterprise loyalty platform, includes a promotions builder for sweepstakes, contests and instant wins alongside the loyalty program, with built-in fraud protection, so promotions and the program can be run under one set of rules.
In regulated industries, compliance decides which loyalty mechanics are available, so it belongs at the start of design. The most important rules are specific: no gifts for cigarette or smokeless tobacco purchases, authorization before covered entities use health information for marketing, no rewards likely to steer federal program patients to particular providers unless an exception applies, free entry for sweepstakes, and privacy rules that differ by state. Identify them at the brief stage, choose mechanics that fit, and check what is actually deployed.
|
Designing a loyalty program in a regulated category? Brandmovers designs loyalty programs and promotions on BLOYL, with a promotions builder for sweepstakes and instant wins and built-in fraud protection, and maintains SOC 2 Type II and PCI DSS compliance. Request a demo to talk through your category and markets with the Brandmovers team. |