Your supermarket loyalty card can reveal far more than points earned. Australian regulators have documented extensive personalisation and profiling practices — but there is no single national "AI profile" access button.
Loyalty Data Can Create a Detailed Consumer Profile
Australian competition regulators have documented how supermarket loyalty data can be used to segment consumers and tailor offers. The ACCC's supermarkets inquiry found that Coles and Woolworths use loyalty-program data to target member cohorts based on factors such as spending behaviour, engagement, likelihood of switching and product preferences.
The ACCC's earlier customer-loyalty report also raised concerns that some programs automatically linked payment cards to member profiles even where customers stopped scanning their loyalty cards.
Do Not State That Supermarkets Sell All Loyalty Data to Banks or Insurers
The consumer-risk question is real, but the legal and factual position is company-specific. Loyalty-program terms and privacy policies can allow different forms of sharing, aggregation, analytics or personalised advertising.
For example, Woolworths has publicly told the ACCC that it does not enrich its Everyday Rewards member profiles with personal information obtained from data brokers and does not sell customer data to third parties, while other public submissions have raised concerns about cross-business and partner data uses.
What Privacy Controls Should You Check?
- Open the current loyalty-program privacy policy.
- Check how purchase data is used for direct marketing and personalisation.
- Check partner-sharing and data-platform disclosures.
- Review available marketing opt-outs.
- Ask whether the program links payment-card transactions to your member profile without scanning.
- Request access to your personal information where the Privacy Act applies.
APP 7 Can Give You a Direct-Marketing Opt-Out
Where APP 7 applies, individuals can generally ask an organisation to stop using or disclosing their personal information for direct marketing, subject to the specific statutory conditions and exceptions. That is different from demanding deletion of the entire loyalty profile.
Can You Demand the "AI Profile" the Supermarket Built About You?
You can exercise applicable access rights to personal information held about you, but the law does not guarantee a person a technical export of every inferred segment, model weight, score or internal analytic produced by a business. Whether an inference is personal information depends on whether it is about, and identifies or reasonably identifies, the individual in the relevant circumstances.
Build a Profiling Audit
- Save the privacy policy version and date.
- Record the member number and participating brands.
- Save personalised offers and promotions that reveal segmentation.
- Record marketing opt-out choices.
- Submit an access request where appropriate.
- Keep the response and any explanation of data sharing.
What This Means Practically
- Loyalty data is capable of detailed profiling.
- There is no universal right to a downloadable "AI profile".
- Check APP 7 marketing controls and applicable access rights.
- Do not assume every partner-sharing allegation is factually true for every supermarket.
- Use the privacy policy and actual account response as evidence.
Sources
- ACCC — Supermarkets inquiry final report. accc.gov.au
- ACCC — Customer Loyalty Schemes final report, December 2019. accc.gov.au
- OAIC — APP 7 Direct marketing guidance. oaic.gov.au
- OAIC — Access your personal information. oaic.gov.au