Your Loyalty Card Isn't Just a Discount Anymore — It's How an AI Knows It's You

If you have Sephora's Beauty Insider card, since March 24, 2026 you can link it inside ChatGPT: ask "recommend a foundation for dry skin" and the assistant answers using your actual purchase history, not a generic reply. Ulta Beauty did something similar with Google on April 22, 2026: its 46 million loyalty members — 95% of the company's sales — now feed "Ulta AI," a shopping assistant built on Gemini Enterprise, on top of showing up directly inside Google's AI Mode search. If you carry a points card at any major chain, there's a reasonable chance something similar is already happening to you, even if no one explained it this way: your loyalty card has stopped being just a discount and become how an AI knows it's you.

Why loyalty data is worth so much for training and personalizing

A generic model can guess what "someone like you" might want. A loyalty program knows what you, specifically, bought, when, at what price, and how often, sometimes for years on end. That's the edge CVS Media Exchange VP Parbinder Dhariwal describes in PYMNTS: "that relationship, plus the loyalty, plus the transaction data, is what really sets retail media apart from any other medium; not even social media can piece all of those constituents together." CVS builds its ad business on 90 million customer relationships; Mastercard, per senior VP Jill Moser, uses generative AI to design offers from a 360-degree view combining transactional, first-party, and "zero-party" data — what you declare about yourself directly. Fanatics, the licensed sports-merchandise retailer, did the same with Google Cloud: it uses behavior from its loyalty base so an AI assistant can surface the right product exactly when purchase intent peaks. None of these pieces is new on its own. What's new is that they now feed directly into a conversational assistant you might use without noticing you're doing it.

There's a concrete reason this is accelerating right now, and it isn't just that AI is fashionable: old-school ad tracking — the third-party cookie that followed you site to site — works worse every year, thanks to browser changes and privacy regulation itself. Loyalty data is "first-party": the company collected it itself, directly, tied to your actual purchase, which makes it more valuable exactly as the alternative runs dry. It's no coincidence that the same period in which third-party tracking tightens is the period loyalty becomes the "identity layer" an AI assistant needs to recognize you. The tracking method changes; the appetite for knowing who you are and what you'll likely buy next does not.

What you can demand today, and what's still unresolved

Precision matters here, because the most common mistake is assuming your explicit permission is required for any of this to happen. California's Consumer Privacy Act (CCPA) says so plainly: it isn't an "ask first" regime, it's opt-out. By default, a company can collect and use your data; what you have is the right to ask what they're holding on you ("right to know"), the right to have it deleted ("right to delete"), and the right to make them stop "selling or sharing" your information by exercising the "right to opt out" — usually via a visible "Do Not Sell or Share My Personal Information" link. Other U.S. states have similar laws, each with its own wrinkles. Whether linking your loyalty account to an AI assistant legally counts as "sharing" under the statute is a real question still being litigated state by state; we won't pretend it's settled, because it isn't.

What is unambiguous: concern over AI trained on loyalty data has pushed a real wave of legislation. In 2026, more than 40 bills across at least 24 U.S. states have been introduced against "surveillance pricing" — different prices for different people, calculated from exactly this kind of behavioral data. The most detailed, Illinois's Algorithmic Pricing Transparency Act (HB 4248), would require companies to disclose "the categories of personal data used to generate the price" and create a right to demand a "non-personalized baseline price." None of these bills is law yet in most states: they're the in-progress response to a problem that already exists, not a protection you can invoke everywhere today, and treating a pending bill as if it were already enforceable would be its own kind of dishonesty.

What to check in any loyalty program

It doesn't matter which chain, which AI assistant, or what it gets called next year: there are three concrete things you can check in any points program, whether it's a beauty retailer, an airline, or a coffee shop app.

1. Look in the privacy policy for mentions of "AI partners," "personalization," or "conversational assistants." It usually sits in the "who we share your data with" section, not the "how you earn points" one — they're separate sections for a reason. If it doesn't say so plainly, ask customer service directly; the answer counts as information no matter how they phrase it.
2. Exercise the right you already have, even if you didn't know it. In states with privacy laws you can ask what they're holding on you, ask them to delete it, and use the "do not sell/share my information" link if one exists — you don't get to wait for permission to be offered, you have to actively request it, every time you want to exercise it.
3. Be suspicious of different prices for different customers. If you think you're seeing a price calculated just for you, in some states you can already request the non-personalized baseline price; in most, not yet — and it's worth saying that plainly instead of pretending a right exists everywhere before it does.

Applied to the two examples that opened this piece: Sephora's own announcement is explicit that linking your account inside ChatGPT is optional. Ulta's announcement describes "Ulta AI" as built from insights across its loyalty base as a whole, without spelling out, in the press release itself, whether an individual member's data feeding it requires any separate action from them. Neither company is hiding what it does — both published real detail — but "published in a press release" and "explained to the person actually enrolled" are not the same thing, and that gap is exactly where the three questions above earn their keep.

None of this requires distrusting the points card or giving up the discount. It requires treating it for what it's become: a data contract with fine print, not just a frequent-shopper card. Whatever chain announces its own AI assistant next — and one will, probably before the year is out — it rests on exactly the same mechanism, whatever name it gets.

For anyone who wants to go deeper

• Loyalty Data Is Now AI's Favorite Currency (PYMNTS), with the full quotes from CVS Media Exchange and Mastercard.
• The official Ulta Beauty and Google announcement, with the loyalty program figures.
• The official announcement of Sephora's app inside ChatGPT, which confirms linking the account is optional.
• The California Attorney General's official CCPA page, with the five consumer rights explained by the enforcing authority itself.
• The Inside Privacy (Covington) summary of the 2026 wave of surveillance-pricing legislation, including Illinois's HB 4248.