Only 29% of people say they trust that retailers won’t use their email address for purposes other than sending an e-receipt, new Which? research has revealed.
The majority of people we surveyed (70%) were concerned about how retailers might misuse their data.
An e-receipt is a digital version of a till receipt which includes information about a store-bought purchase. Retailers usually send an e-receipt to customers in the form of an email.
We found that customers had faced mixed experiences with e-receipts across a range of high street shops, so we undertook a snapshot mystery shop to investigate whether this high level of distrust was fair or misplaced.
We sent mystery shoppers to investigate 11 big-name retailers who we knew offered e-receipts, including Gap, Mothercare, Topshop and Halfords.
Our shoppers visited each retail group a minimum of three times with a total of 34 visits.
If you want companies to stop using your data, make a request to an organisation to stop processing your data for the purposes of direct marketing.
E-receipts: the concerns
A quarter (23%) of people we surveyed said they would prefer a digital receipt over a paper receipt. A similar proportion (24%) didn’t state a preference, suggesting that they didn’t mind either way.
But four in 10 (39%) felt that there weren’t any benefits to them receiving a digital receipt, and 79% of people had at least one concern about e-receipts.
E-receipts: analysis of snapshot mystery shop
Our shoppers visited Gap (including Gap Outlet), Topshop, Clarks, New Look, Dorothy Perkins, Arcadia Group (Miss Selfridge, Outfit, Burton), Schuh, Mothercare, Halfords, Currys PC World and Nike.
After interacting with staff and explaining in clear terms that they wanted no marketing, our mystery shoppers gave an email address for the e-receipt.
Except for one instance, all of the retailers sent our mystery shoppers an e-receipt and did not send them any subsequent direct marketing emails. And Topshop, Arcadia Group, Dorothy Perkins, New Look, Clarks, Nike and Currys PC World sent e-receipts with no marketing in them.
But we also saw several instances of some retailers including promotional marketing of other products and services in the e-receipt.
Generally, retailers can only send electronic direct marketing where the individual has consented to receiving it (although there are some exemptions). This also covers any messages which include some marketing elements, even if that is not their main purpose – like an e-receipt.
Which? managing director of home products and services Alex Neill said: ‘More and more shops are offering e-receipts, which can be convenient for shoppers, but our investigation suggests not all shops are aware of the law.
‘Retailers must do everything possible to ensure shoppers can have confidence that they won’t be bombarded with unwanted marketing emails and that their personal details are safe.’
Examples of e-receipts with marketing apps and newsletters
One of the emails received after a visit to Mothercare had a promotional marketing message encouraging people to download the retailer’s app. The actual e-receipt was attached to this email.
In all three Schuh e-receipts our mystery shoppers received, there was a promotional banner at the bottom of the email with a prompt to sign up to Schuh’s newsletter to hear about ‘new styles, hot trends, exclusive product and exciting collaborations’.
A Schuh spokesperson said: ‘To ensure we fully comply with GDPR we are taking ongoing advice from third parties.
‘Following your feedback we have now updated the communications you highlighted. We are committed to achieving full compliance in all our marketing communications.’
Examples of e-receipts promoting other products and services
We received two e-receipts from Halfords that contained promotional marketing information on other products and services it offers.
We also saw job hire adverts for the retailer. One of our mystery shoppers was even told by a staff member in store that Halfords isn’t allowed to send marketing information if a consumer doesn’t want it.
A Halfords spokesperson said: ‘We take the privacy of our customers very seriously and would like to assure them that our e-receipts are compliant with the UK’s data protection law and conform to GDPR regulations.
‘Our e-receipts do not contain any active promotion of products or services. In addition the Data Protection Commissioner, which is the statutory authority for Ireland and works to the same EU legislation, has also reviewed our e-receipts process without raising any concerns.
‘Since this review, we now include a recruitment banner on our e-receipts, but we do not believe that this constitutes the direct marketing of products or services.’
All of the three Gap e-receipts we received included a sales-y push to complete a survey with ‘Enjoy 20% off your next purchase!’.
Example of an additional marketing email and no e-receipt
At one Gap Outlet our mystery shopper gave an email address, but never received the e-receipt. Instead, the retailer sent a large 20% off promotional thank you offer email for ‘signing up’, and four days later sent another email titled ‘Open to find your exclusive coupon inside.’
A Gap spokesperson said: ‘Thank you for bringing this issue to our attention. After investigating further, we are providing our store employees with additional guidance on our policies for e-receipts and email marketing and adding additional signage to our stores to inform customers of how their personal information is used and a website where then can learn more on the topic.’
E-receipts and marketing consent
From the snapshot we’ve done, we suspect some retailers are not aware that having a marketing message in the e-receipt template they send to a consumer counts as marketing.
The Information Commissioner’s Office (ICO) also considers e-receipts that include marketing to be a direct marketing email, and its Direct Marketing Guidance is clear on this when discussing the definition of direct marketing.
An ICO spokesperson said: ‘Retailers must understand it’s not enough to assume that because a customer has given their email address to receive an e-receipt that they are happy for it to be used for other purposes.
‘Being transparent about the collection and use of data and giving customers informed choices over how their data will be used is key to ensuring compliance with the law and building trust.
‘Anyone who has received an e-receipt email that includes direct marketing when they have specifically objected can complain to the organisation that sent it in the first instance, and if they remain unsatisfied they can complain to the ICO.’
What retailers need to do by law
In order to send direct marketing communications by email, the Privacy and Electronic Communications Regulations 2003 (PECR) sets out that organisations must have consent to do so.
This consent must meet the standard set out in the General Data Protection Regulation (GDPR), which are enshrined in UK law under the Data Protection Act 2018.
Alternatively, if a retailer is relying on an exemption known as the ‘soft opt-in’, you must have been given a simple way of refusing the use of your contact details for the purposes of direct marketing, at the time the retailer collected your details.
This means that if the retailer asks for your email address at the point of sale to send an e-receipt, and plans to rely on the “soft opt-in” to send you marketing as well, they must have:
- Told you that giving your email address would also include you getting marketing
- Given you the option to opt-out of marketing
If they don’t do this, and you receive an e-receipt with marketing or start receiving other marketing communications, the retailer is breaking data protection law.
Additionally, if you were proactive at the point of sale and made it clear to the retailer you didn’t want any marketing, they aren’t allowed to send any unwanted marketing to you.
What counts as personal data may include more than you initially realise – our personal data guide explains what it is according to UK data protection law.
The rise of e-receipts
Nearly half (47%) of people we spoke to said that they’ve been offered a digital receipt in the last three months, showing the popularity of retailers issuing e-receipts has risen in recent years.
The list of stores and retailers from which people have been offered receipts is now extensive at over 100 retailers and includes well known high street shops and big names including Nike, B&Q, Topshop, Body Shop, John Lewis and Boots.
But our survey also revealed smaller outlets and independent shops are offering e-receipts, including a local hairdresser, local locksmith, local pub and local restaurant.
Experience with staff
Most of the staff mystery shoppers spoke to on their visits appeared to be knowledgeable about e-receipts and marketing preferences. But some staff didn’t impress them.
Two of our mystery shoppers found Nike staff to be very knowledgeable when they visited. However, another said that one wasn’t knowledgeable at all when asked about e-receipts. ‘The member of staff I spoke to did not know anything about e-receipts when asked – they had never heard of them,’ they said.
In all three visits to Gap, our shoppers found staff to be only slightly knowledgeable. One of our mystery shopper said: ‘The assistant seemed a bit baffled and stared at me blankly when I asked what else the email address might be used for apart from sending the receipt, so I had to ask whether it would be used for marketing. She said “not if you don’t want” so I said “no, I don’t want any marketing emails, please”.’
Which? would like to see retailers who issue e-receipts ensuring their staff are trained and knowledgeable in data protection and marketing preferences to avoid any accidental misuses of personal data.
Data protection signage in store
Our mystery shoppers observed signage at the tills of each of the three Topshop stores visited in the UK. The signs included detail on how Topshop would use customer information, with a prompt to find out more on its website.
This was also the case for the three visits our mystery shoppers made to other Arcadia Group brands including Burton, Miss Selfridge and Outfit.
Our mystery shoppers didn’t see any signage in the stores of the other retail brands visited.
While retailers aren’t obligated to have signage in store, Which? would like to see more information on the data protection policies of retailers readily available for consumers to read and consider before sharing their personal data.
What’s your attitude towards how online data is collected and used?
Which? has undertaken the ‘Control, Alt or Delete’ policy project to explore the consumer data landscape and help improve understanding of how online data is being collected and used.
As part of this, we have identified 12 groups that reflect the different attitudes and behaviours people have when it comes to consumer data collection and use by organisations, businesses and web services. We call these groups ‘the Data Dozen’.
Find out which of the Data Dozen is most like you by taking our online quiz (it’s anonymous, so we won’t store any data about you!).
Populus, on behalf of Which?, surveyed 2074 UK adults online between 19 and 21 October 2018. Data were weighted to be representative of the UK population.