The recent Privacy Act review threatened loyalty program viability with a proposal to eliminate targeting using customer data - a proposal that won't be implemented. However, customers can still withdraw consent for direct marketing of loyalty offers by email or text undermining the investment in loyalty.