The Notices You Owe a Shopper Who Trades Data for a Discount

The moment you offer a discount in exchange for an email address, you have done something with a specific legal shape. It is not complicated, but it has requirements, and the common popup pattern gets several of them wrong by default.

This is a practical summary, not legal advice. Check your own market with someone qualified.

Unbundled consent: the discount cannot be the price of the marketing

Under GDPR, consent must be freely given, and there is a specific rule — often called the coupling ban — that consent is not freely given if getting a service is conditional on agreeing to processing that is not necessary for that service.

Applied here: if the only way to get your discount is to accept marketing email, the consent you collected is on shaky ground, because the shopper had no real choice.

India’s DPDP framework takes a similar line on unbundling, and the practical design that satisfies both is the same.

What this means in practice. Marketing opt-in has to be separable from the thing the shopper came for. If your discount mechanic works fully without an email address — because they can earn it another way, or negotiate for it — then asking for an email as one optional route is clean. The shopper who declines still gets to participate; they just do not get that particular reward.

The version that fails is the one where the widget will not proceed until an email is entered and a marketing box is ticked.

No pre-ticked boxes, and equal weight for “no”

Two related requirements, both about whether the shopper actually chose.

Consent must be a positive action. A pre-ticked checkbox is not consent under GDPR, and this has been settled for years. If there is a box, it starts empty.

The stronger version, which is worth adopting even where it is not strictly required: make the decline option visually equal to the accept option. A grey four-point “no thanks” under a large coloured “YES GIVE ME MY DISCOUNT” is a dark pattern, and regulators in several markets have started saying so explicitly. If your accept is a button, your decline is a button of the same size.

Store the disclosure, not just the consent

Here is the operational bit most implementations miss.

Recording that someone consented is necessary but not sufficient. What you actually need, if the consent is ever questioned, is evidence of what they consented to — the words that were on screen at the moment they agreed.

That wording changes. You edit the campaign, you reword the offer, you run a different promotion next month. A consent record that says “consented: true, at 2026-09-17” tells you nothing about which version of the text they saw.

So store the disclosure string alongside the consent record, at capture time. It is a few dozen bytes and it is the difference between having evidence and having an assertion.

CCPA: the financial-incentive notice

California treats “discount in exchange for personal information” as a financial incentive programme, and it carries its own notice requirements. If you have California shoppers, this applies to you.

A compliant notice has to include:

• A description of the programme. What you are offering and what you are asking for.
• The material terms. The value of the incentive, and what data you collect.
• A good-faith estimate of the value of the data, and the method you used to calculate it. This is the requirement people find strangest, but it is straightforward: you can reasonably estimate the value of an email address from what you would otherwise pay to acquire a subscriber.
• How to opt out, and a statement that the shopper may withdraw at any time.

The practical consequence for a discount widget is that the notice needs somewhere to live — a link from the point of capture, reaching text that covers those four things. Not buried in a general privacy policy paragraph.

Retention: have a period, and enforce it

The last one, because it is where good intentions quietly fail.

“We delete data when asked” is not a retention policy. A retention policy is a period, after which data is deleted whether or not anyone asked.

Pick periods that match what the data is actually for. Negotiation logs are operational — a few months after the deal expires is plenty. Consent records need to outlive the marketing they authorise, because they are the evidence for it; two years is a common and defensible figure. Order attribution is the merchant’s own reporting and reasonably lives as long as the account does.

Then enforce them with a scheduled job, not a calendar reminder. An automated daily sweep that deletes what has aged out is the only version of this that is still true in eighteen months.

The short version

Make the marketing opt-in genuinely optional. Start every box empty and give “no” the same weight as “yes”. Store the exact words they agreed to. Publish a financial-incentive notice if you have California shoppers. Set retention periods and have a job enforce them.

None of it is expensive to build if you build it in at the start. All of it is awkward to retrofit.