A loyalty app shares detailed purchase profiles of EU customers with unrelated ad networks for third-party advertising without clear notice or a valid permission model. What is the primary compliance failure?
Select an answer to reveal the explanation.
Short Explanation
A loyalty card is not a blank cheque to sell someone's shopping life to ad networks. If you did not tell people and do not have a solid legal basis, sharing those profiles is the problem. Transparency plus permission (or another real basis) comes first.
Full Explanation
Purchase profiles linked to identifiable customers are personal data. Disclosing them to ad networks for advertising is a distinct purpose that needs an appropriate GDPR lawful basis and meaningful transparency under Arts. 12–14. Hidden or poorly explained sharing undermines fairness and purpose limitation. Contractual checkout language alone rarely cures missing notice or an invalid basis for third-party advertising use.