Glossary
What is double opt-in?
Double opt-in is confirming a customer's agreement to be contacted a second time, through the channel itself, so that the business holds evidence the person who gave the number is the person who owns it.
In a loyalty programme the practical value of double opt-in is evidential rather than technical. A number typed at a counter can be mistyped or given by someone who is not its owner, and the business carries the burden of proving consent if it is ever questioned. A confirmation step (a reply, or a tap on the enrolment link) establishes that the phone receiving the messages belongs to someone who agreed to receive them. It also filters out the mistyped numbers that would otherwise sit on the list being messaged indefinitely.
Is double opt-in required by the GDPR?
It is not named in the regulation, but the obligation it satisfies is: consent must be demonstrable, and the business has to be able to show when and how it was given. Double opt-in is the most common way of meeting that standard for a phone number or an email address.
Requirements vary by country and by channel, so this is worth confirming locally rather than assuming a single rule covers every market a business trades in.
Does it reduce enrolment?
A confirmation step always loses some people, which is why it should be the act the customer was going to perform anyway. Adding the card to a wallet is itself a deliberate action taken on the customer's own phone, and treating that as the confirmation costs nothing extra.
What does reduce enrolment is a separate confirmation demanded at the counter, in front of a queue. Let the confirmation happen after the customer has walked away.
What about marketing consent specifically?
Keep it separate from enrolment, and ask for it as its own question. Agreement to receive a loyalty card is not agreement to receive promotions, and treating one as the other is the most common compliance mistake in small-business loyalty.
A message about the card itself (a reward ready to claim, a stamp added) is a service message and sits inside what the customer already agreed to. Anything promotional needs its own recorded consent.
See also
- GDPR consent: GDPR consent is the freely given, specific and recorded permission a business must obtain before processing an EU customer's personal data for a loyalty programme.
- SMS enrolment: SMS enrolment is signing a customer up to a loyalty programme by taking their phone number and texting them the card link, so the customer does nothing at the counter but receive a message.
- Enrolment rate: Enrolment rate is the percentage of customers who join a loyalty programme when offered it, and it is the number that determines whether the programme is worth running.
Further reading
23 loyalty programme ideas that work for small businesses
Specific, costed loyalty mechanics for independent shops, cafés and service businesses, with the ones that reliably fail and why.
Stamps or points: which loyalty mechanic should you use?
How to pick the right loyalty mechanic for your business based on ticket variance, visit frequency and what you want customers to do more of.