Key International Loyalty Regulations for Global Brands to Know

November 16, 2022 | 4 minute read
Carly Mathews
Senior Strategist, Oracle CrowdTwist
Text Size 100%:

Laws affecting loyalty program management vary from country to country around the world. Key elements, which are meant to protect consumers, impact the expiration of loyalty points, define restrictions for redemption, and require permission and consent of data collection and use.

Some of the laws that our Oracle CrowdTwist customers have to account for are from Canada, South Africa, and Europe. You’ll want to consult an attorney to determine which laws you need to comply with and how, but here’s a quick look at the laws in those countries and how they impact loyalty programs.


Ontario and Quebec have implemented several requirements for loyalty programs. Because they are the two most populous provinces, any loyalty program that operates in Canada should adhere to the terms.

Under Ontario’s Consumer Protection Act, regulations went into effect on Jan. 1, 2018 that prohibit rewards points from expiring based on passage of time alone. However, points can still expire if:

  • The loyalty program closes the member’s account because the person has become inactive in the program, as defined in the membership agreement
  • The program issues rewards such as gift cards (which can’t legally expire) or vouchers for discounts or other benefits (which can have their own expiration rules)
  • The loyalty points can’t be redeemed for any single items with a value of more than 50 CAD

Under Quebec’s Consumer Protection Act, which went into effect on Aug. 1, 2018, as well as its amendments, which went into effect on Aug. 1, 2019, similar restrictions around the expiration of points are imposed, plus some additional demands. For instance, it stipulates that:

  • Loyalty points can’t expire due to member inactivity of less than one year unless the retail value of each reward is less than 50 CAD, with rewards being determined at the time of entering the program agreement
  • If a member’s loyalty points are set to expire, the program must notify the member 30 to 60 days in advance, with that notification focused solely on that expiry

And when a loyalty program offers rewards exceeding 50 CAD in value, it must:

  • Clarify expiry, point receiving/exchanging, conversion factor, and terms information 
  • Limit redemption price increases unless justified by changes in rewards’ market values
  • Notify consumers of changes to terms and conditions 60 to 90 days prior to effective date unless consumer consent is obtained otherwise 
  • Notices must outline both the former and new terms alone for comparison
  • Limit negatively changing existing point balances and/or point conversion ratios

Because of these two laws, we usually recommend that clients who choose to have their loyalty program points expire use a 12-month rolling expiration period based on inactivity, which Quebec’s CPA defines as a lack of point earning or burning activity. 

An example of a loyalty program in Canada that has a shorter points expiration period is 7-11, which is able to expire points in less than a year because of the low prices of all rewards, which include snacks and fountain drinks.

South Africa

In South Africa, the Consumer Protection Act 68 of 2008 places a number of restrictions on loyalty programs, mostly around redemptions. For instance, loyalty programs:

  • Can’t require their members to purchase any other goods or services, pay any fee or surcharge, or do anything else in order to redeem points for rewards
  • Have a legal responsibility to maintain a sufficient supply of rewards based on “reasonably anticipated demands for those goods or services”
  • Must refund and compensate members who redeem points for goods or services that the brand is then not able to deliver at the committed to time

Indirectly applicable to loyalty programs, South Africa’s CPA also protects consumers from products that arrive damaged and against misleading product descriptions, especially in cases where only a description is provided. Consumers have the right to reject products that don’t meet their expectations if sold from open stock, too. 

Our CrowdTwist customers operating in South Africa must make reward redemption as easy as possible for their members. 


Loyalty programs operating in the European Union need to adhere to the General Data Protection Regulation (GDPR), which went into effect on May 25, 2018. Among a range of data privacy and consent mandates, it requires that brands:

  • Have strong permission practices with explicit consent for loyalty programs
  • Be transparent about the consumer data they collect and how they’ll use it, and then discard that data once that purpose has been met
  • Secure the consumer data they collect, recommending encryption and the anonymization of identifying information
  • Give consumers access to the data that’s been collected about them, as well as a way to have that information deleted

CrowdTwist supports strong permission practices, the anonymization of loyalty member data, and more to ensure compliance. The platform and services are continually adapting to meet evolving domestic and international privacy needs and to streamline clients’ abilities to fulfill anonymization requests. 

With most privacy laws, it’s not so much where your business is located as it is where your customers are located. In this instance, loyalty programs need to be ever mindful of where their members are, as that will determine the laws to which you need to adhere. Consult your legal counsel to ensure that you understand your legal responsibilities.


Need help with your loyalty program? Oracle Digital Experience Agency has hundreds of marketing and communication experts ready to help Oracle customers create stronger connections with their customers and employees, even if they’re not using an Oracle platform as the foundation of that experience. Our award-winning specialists can handle everything from creative and strategy to content planning and project management.

For help overcoming your challenges or seizing your opportunities, talk to your Oracle account manager, visit us online, or email us at

Carly Mathews

Senior Strategist, Oracle CrowdTwist

Carly Mathews is a Senior Strategist for Oracle CrowdTwist, joining Oracle with the acquisition of CrowdTwist in 2019. Her background includes 8 years of consultative experience, including 3 years dedicated to marketing strategy and execution. Her experience advising clients on strategic business transformations enables her to bring an analytical, data-driven mindset to loyalty marketing initiatives.

Previous Post

Loyalty: KPIs that Go Beyond the Transaction

Kris Shahinian | 3 min read

Next Post

Good Data Leads to Great Mobile App Marketing Insights

Rohit Sah | 10 min read