Retail
The loyalty card turns every basket into a named record, merged with data bought from outside firms and sorted into groups by income and lifestyle. The discount is the payment for it, and the record is kept for as long as you keep shopping there.
The read at a glance
A loyalty card turns an anonymous shop into a named purchase history.
A leak exposes what you buy and, where face recognition is used, your face in the store.
Loyalty and purchase history is kept for years; the loyalty profile stays until you object.
Buying needs payment; loyalty ties purchases to your identity.
Industry profile reviewed 23 August 2026. Also machine-readable via the free API.
If it leaks
A purchase history reads like a diary: pregnancy, medication, who you buy for. It has leaked at that scale before, with dates of birth attached.
What repeats in the policies
The card turns every basket into a named record
Scanning the card or app at the checkout ties each purchase to you: the products, the price, the time, the store and how you paid, all on your named profile. The lower price applies only once you have identified yourself. One card links years of shopping into a single file the shop can read back.
Your receipts become advertising
The shop compares what you buy against other households, merges it with data bought from outside firms, and sorts you into groups by income and lifestyle. Those groups go to ad platforms and to the chain's own advertising arm, both to target you and to find shoppers like you.
The building watches too
Cameras run for what policies call operational purposes, measuring foot traffic and stock levels, not just security. A few chains now name facial recognition in the policy itself, one of them as a live in-store trial. In-store wifi can pick up your phone's identifier and tie it to your loyalty account.
What a company here typically holds
Worked out from the industry, not from any one company. What you actually handed over is yours to record.
What this can reveal about you
Built only from what this kind of service actually collects. A dimension that the data does not support is not listed.
Money and net worth Likely
What you buy estimates your spending power.
Health Possible
Purchases can imply pregnancy, conditions, or medication.
What lawfully stays after you leave
Two kinds of hold. Law sets it: a statute makes them keep it. They set it: a ground the company grants itself.
Identity and age-check records They set it as long as they choose
To prove they checked your age or identity and to block known fraud, sometimes held by a separate verification company.
Tax and accounting records Law sets it about 6 years
Tax and company law makes them keep billing and payment records.
Records tied to a live or potential dispute They set it the limitation period of the claim
They can keep records to defend a live or possible legal claim.
Who wants this data
Groups built from what you buy are matched back to your named account and rented to brands and ad platforms. When a retailer is breached, that ledger is what spills: one breach exposed 56.9 million shopper accounts with purchase histories, dates of birth and partial card details.
Sold or shared Highly likely
Loyalty and purchase data is prime targeting and resale data.
AI training Moderate
Purchase patterns train recommendation and pricing models.
Even anonymised, this can still be you
Loyalty purchase histories are highly distinctive: four transactions identify 90% of people (de Montjoye et al., Science, 2015).
Name, date of birth, postcode Typical
Fifteen demographic attributes re-identify 99.98% of Americans in a released dataset (Rocher, Hendrickx and de Montjoye, Nature Communications, 2019); date of birth, postcode, and sex alone did it for most people in the first study of the problem (Sweeney, 2000).
Location traces Sometimes
Four time-and-place points single out 95% of people in mobility data (de Montjoye et al., Scientific Reports, 2013).
Payment patterns Typical
Four card transactions identify 90% of people in payment data (de Montjoye et al., Science, 2015).
How you write Sometimes
Language models infer where a person lives, their income, and their sex from their writing alone, at near-human accuracy and at scale (Staab et al., ICLR 2024).
Face and voice Sometimes
A face, voice, or fingerprint template identifies a person directly; there is nothing left to anonymise, and it cannot be reissued like a password.
Browsing fingerprint Typical
Browser and device fingerprints were unique for 84% of visitors in the first large study (Eckersley, 2010), and sparse histories of what people viewed re-identified them against public reviews (Narayanan and Shmatikov, 2008).
The studies Estimating the success of re-identifications in incomplete datasets using generative models (Nature Communications 10, 3069, 2019)·Simple Demographics Often Identify People Uniquely (Carnegie Mellon University, Data Privacy Working Paper 3, 2000)·Unique in the Crowd: The privacy bounds of human mobility (Scientific Reports 3, 1376, 2013)·Unique in the shopping mall: On the reidentifiability of credit card metadata (Science 347 (6221), 2015)·Beyond Memorization: Violating Privacy via Inference with Large Language Models (ICLR 2024, 2024)·How Unique Is Your Web Browser? (Privacy Enhancing Technologies Symposium (PETS 2010), 2010)·Robust De-anonymization of Large Sparse Datasets (IEEE Symposium on Security and Privacy, 2008)
The wording that does the work
Clauses that recur across this industry, and what each one actually permits.
“to provide and improve our services”
The catch-all purpose. Analytics, profiling, personalisation and AI training all fit under it. When they want to do something new with your data, this sentence usually already allows it.
The move An objection tells them to use your data to run the service and nothing more.
“we do not sell your personal information”
Usually this means no cash changes hands. Your data can still go to ad networks, analytics firms and partners, because they count that as sharing rather than selling.
The move Use the do-not-sell switch where there is one, and put an objection in writing as well.
“service providers, partners, and affiliates”
This is how your data leaves with no name attached. Recipients are described by what they do rather than named, and you cannot send a request to a company you cannot name.
The move An access request can ask for recipients by name rather than by category, and UK and EU law put that choice with you.
“aggregated or de-identified information”
Taking your name off does not take away the pattern, and the pattern often still points at you. Policies give themselves free use of this data with no end date, on the basis that it is no longer about you.
The move If a deletion comes back as 'anonymised', keep the reply. It usually means de-identified, and it is their claim, not a fact you can check.
“retained as long as necessary, or as required by law”
They can keep it for legal duties, tax rules, fraud prevention, possible lawsuits and their own business reasons. None of those has a firm end date, so deletion turns into something you have to argue for.
The move Which reasons apply to you, and how long each runs, is a request of its own.
“you grant us a licence to use your content”
This is a contract term rather than a data setting, so a privacy request cannot undo it. A careful version ends when your account does. A broad one can be passed on, never expires and survives deletion.
The move Their terms say whether the licence ends when the account does. Close the account and log the date here.
“we keep your data for as long as you continue to shop with us”
The purchase ledger has no fixed end, because being a customer never formally finishes. A rare few schemes cancel the account after a long stretch of not shopping; most name no horizon at all, so the record can sit for years after your last visit.
The move A deletion or access request makes them act on a record they would otherwise hold with no end in sight.
“these financial incentives are reasonably related to the value of the data you provide”
In the US, the loyalty scheme is written up as a formal data-for-discounts trade, so the lower prices are the payment for your data. The policy lets the chain put a figure on what you are worth: one chain's own estimate is about $4.13 per member.
The move Whether your account is run as a US financial-incentive scheme, and what they value your data at, is theirs to state.
“your prices are personalised to you based on your shopping habits”
The discounts you are shown are shaped by your own purchase history, so two shoppers can be offered different prices for the same item. The more you scan, the further your prices drift from what other members see.
The move What data sets your prices, and how, is theirs to explain.
Their own policy is the one that binds them. Pin it down with a request, and keep the reply.