A loyalty app shares detailed purchase profiles of EU customers with unrelated ad networks for third-party advertising without clear notice or a valid permission model. What is the primary compliance failure?

A loyalty app that shares detailed purchase profiles of EU customers with unrelated ad networks for third-party advertising without clear notice or a valid permission model primarily fails because sharing personal data for advertising requires a valid lawful basis and transparency; undisclosed profile sharing with ad networks typically fails both. A loyalty card is not a blank cheque to sell someone’s shopping life. Claiming loyalty programmes are categorically outside GDPR because rewards are contractual fails—contractual rewards do not erase further advertising disclosures. Saying purchase histories are never personal data once stored in a loyalty ID fails identifiability. Asserting ad-network sharing is always covered by checkout terms without further analysis fails fairness when notice and basis are missing or buried. Exam caveat: further processing for third-party advertising is a distinct purpose needing its own lawful basis and clear information under Articles 12–14—not silent secondary use. Operational check: stop undisclosed sharing, update notices with recipient categories and purposes, obtain consent where required, minimise fields shared, and honour opt-outs across ad partners.