Can supermarkets profile everything I buy with a loyalty card?

Loyalty schemes are lawful — you joined, that is the basis (contract/consent). The interesting questions are the edges. What they build: purchase-level profiles powering personalised offers and, increasingly, “retail media” — selling advertisers access to segments like you. The scheme’s privacy policy must spell this out; “partners” doing targeting off your basket data usually rides on consent you can refuse while keeping the discounts — look for the separate marketing tick-box, and use the absolute marketing objection any time. The sensitive-purchase line: baskets betray health (pharmacy items, pregnancy tests), religion (dietary patterns), and more. Deriving special-category insights from shopping data slams into Art. 9 — regulators have warned schemes precisely here, and “pregnancy detected by the till” is the canonical cautionary tale. A scheme personalising around such categories without explicit consent is a complaint, not a feature. Your toolkit: Art. 15 gets you the profile (ask for “all purchase history and derived segments/scores”); Art. 17 kills the account and the history when you quit; paying cash without the card remains the zero-data option, and price discrimination against non-members is a consumer-law question the EU’s Digital Fairness agenda is circling — follow it on What’s changing. Kids’ data (family accounts) and app tracking bundled into loyalty apps deserve their own “no thanks” — the discount never requires your location history.