← all articles

What a loyalty card is actually buying

loyalty-programmes purchase-data personalised-pricing privacy retail

Two prices on one shelf label is the most honest object in this entire subject. Member and non member, printed side by side, by a retailer that has worked out precisely what your shopping history is worth and then put the figure up in public.

Everything else here gets argued in the abstract. That label is a price list.

The reward is real and the refusers underprice it

I added up a year of grocery receipts once out of curiosity, and the card had returned somewhere between one and two percent of the total. On a household food bill that is a couple of hundred dollars.

Fuel schemes do better. Cents off a litre on every fill, across a normal year of driving, is not a rounding error. Pharmacy and electronics programmes often run a member only clearance tier where the price is genuinely lower, and points balances that land usefully on one large purchase a year, which is the part people forget to count because it never shows up weekly.

So the standard advice, refuse every scheme on principle, costs the reader real money and returns nothing they can measure. I think poorly of privacy advice that works like that. If you are going to give up a few hundred dollars a year, you should at least know exactly what you bought with it.

What the card adds to a receipt

Without a card, the till has recorded a basket. Items, a time, a payment method, a lane number. That is stock control and rota planning. It describes a transaction and nobody in it.

With the card, the same basket carries a name.

The edit is small and it contains the whole mechanism, because next week attaches to that same name, and so does the week after, for as long as the card stays in the wallet.

One basket of yours is worth close to nothing. Two hundred of them in sequence, timestamped, is a different kind of object entirely. The value was never in any single shop.

What a sequence gives away

Nothing on this list has to be typed into a form.

Working hours, from the clock. Somebody who shops at eight in the evening for two years and then starts shopping at eleven on a Tuesday morning has had something happen to their job. The basket may not change at all.

Household size, from pack sizes read against how often they repeat. No individual item reveals it. It reads in reverse too. When a household that bought two of everything starts buying one, somebody has left.

The age of a child, from progression. Nappy sizes climb in a known order at a known pace, and the switch to lunchbox items carries a rough age with it. No birthday is ever entered.

A health event, from repetition. One purchase in a category means nothing at all. The same purchase every four weeks beginning in March is a prescription cadence, and the retailer does not need to know the drug to read the shape.

Financial direction, from substitution. Branded razors to own brand razors in the same month as branded coffee to own brand coffee, across a dozen lines at once, describes a household cutting back. Reverse it and you have a pay rise. Salary is never mentioned by anybody.

Alcohol, which surprises people most, because it moves under stress in both directions and it moves quickly.

And the failures. Declined payments sit in the record alongside returns and refunds, so a card that starts getting declined in the last week of the month is a legible signal about the whole household.

Pregnancy is the case everyone has heard a story about, and the story is usually told as though a system uncovered a secret. The real thing is duller. A small set of category shifts landing together inside a short window, none of which carry meaning alone.

Why this beats a survey: people answer surveys as the person they intend to be. A trolley gets filled by the person they are.

Three joins wider than the shop

The card is the same identity online. Scan it in store, order delivery on the same account, and the two halves stop being separate. Most people hold them apart mentally. The retailer never did.

The payment card is the second join. Where the scheme keeps a token for the card you pay with, baskets attach even on trips where nothing was scanned. Which is why leaving the card at home helps less than people hope.

The third is ownership. Plenty of programmes belong to a specialist operator running the same scheme for a fuel chain, a pharmacy, an electronics retailer and a few restaurant groups. The record then spans several industries under one membership number, and that is a materially different arrangement from the one most members believe they joined. It is also written in the terms.

The discount is calculated

This gets the least attention and deserves the most.

An offer does not have to be identical for everybody. Once the history exists, a retailer can estimate the smallest incentive that will change your behaviour and send exactly that much.

Buy the same coffee every week and no coupon for it ever arrives. You already buy it, so the coupon would be a donation. Buy a competitor’s coffee and the coupon turns up. Offers chase uncertainty, because uncertainty is where they earn.

That is a sensible way to run a shop and I would run it the same way. The consequence is what matters. The member price is the price calculated to move you, and the lowest price available is a separate number.

Which makes the two price label misleading in a specific way. Comparing the member price to the non member price beside it tells you nothing, since both were set by the same person on the same afternoon. The only comparison carrying information is against a different retailer’s shelf.

After it leaves the retailer

Short section, because the broker market is a subject of its own.

Some retailers sell purchase data onward and some do not. Where it does move, it usually goes through an intermediary who cleans it and matches it against other sources. Aggregate counts are harmless. A transaction level trail carrying a stable identifier is not, because a handful of purchases with times and amounts attached will isolate one person out of a large population.

Item level history under a real name is among the most valuable material in that market, for the same reason it is valuable inside the shop.

What I had backwards

For years I treated this as an export problem. The risk was the data leaving, reaching a broker, and arriving back at me from somewhere unexpected. So I declined the cards and paid the higher price.

The export is real. My weighting was wrong. The larger effect happens with nothing leaving the building: the pricing, the offer selection, the order products get put in front of you, and which lines get promoted to you at all. That runs on the retailer’s own data inside the retailer’s own systems, with no third party anywhere near it.

I was guarding a transfer and ignoring a use.

The refusal also achieved less than I assumed. Same payment card for years, same delivery address throughout, so the identity was sitting there regardless. I had declined the discount and kept the record.

Cancelling and deleting are different actions

Cancelling stops new rows arriving. It does not remove the rows already written, and the retailer will have a retention period it can point at.

Deletion is a separate request, and the two get confused constantly. If you want the history gone you have to ask for that specifically, and the request belongs to whoever operates the scheme, which may not be the shop whose name is on the card.

Keeping the money and narrowing the record

Join with a commerce only email address and a phone number your friends do not have. Those two fields are what allow this record to be matched against every other record about you.

Keep one category off the card entirely. Whatever you would rather nobody inferred, buy it elsewhere, or without scanning, or in cash. You make that call basket by basket, which is finer control than almost any other privacy decision gives you.

Decline the payment card link wherever declining is offered. It gets sold as convenience and it is the strongest join in the whole arrangement.

Find the marketing and personalisation toggles in the account settings. They sit separately from cancelling, they are buried, and switching them off usually leaves the discount untouched. Best ratio available anywhere in this subject.

One card per household instead of one each, which blurs the inference down to a household.

And look at the back of the card. Other companies’ logos there mean your record is wider than the shop you are standing in.

The only trade here that pays you

Every other topic I write about runs one way. The browser extension reads your pages and gives back nothing. The car reports every journey and might get you a slightly cheaper policy. The data broker never asked.

The card pays. Openly, in money, at a rate you can measure by adding up a year of receipts. That is what makes yes a defensible answer here, and it is also why the trade so rarely registers as one. Getting paid makes it feel like a saving instead of an agreement, and it gets filed under the wrong heading for years. The rest of what I test is here.

from the team
Want a real mobile IP, not a datacenter VPN endpoint?

Shared VPN exit nodes get flagged and blocked. Singapore Mobile Proxy runs real 4G/5G mobile IPs that give you a residential-grade address carriers still trust.

see how it works →
read on
More from The Privacy Wire

VPN and tool reviews, realistic opsec guides, and privacy news for people who want to protect their data.

browse all articles →