When a supermarket offers lower prices only to customers who download an app, create an account and allow the retailer to build a profile around their shopping behavior, is the app really free?
A German court has now answered part of that question.
The Cologne Higher Regional Court ruled that retailers do not have to treat a customer’s personal data as part of the “total price” of a loyalty program, even where providing that data is effectively part of the bargain for obtaining app-only discounts and rewards.
The May 15, 2026 decision involved the PENNY supermarket app and a lawsuit brought by Germany’s Federation of German Consumer Organisations, known as Verbraucherzentrale Bundesverband or vzbv.
The consumer organization argued that PENNY should explicitly tell users that providing personal data is the consideration they give in return for exclusive app prices, coupons and other benefits.
The court rejected that theory.
Its reasoning was not that personal data lacks economic value.
Instead, the court concluded that the consumer-law concept of a “total price” refers to a monetary payment, or at least something that can be calculated as a price. Personal data does not fit neatly into that category.
The case raises a much larger question about the modern loyalty economy.
Consumers may not pay €5 to join a supermarket rewards program, but they can provide something potentially much more useful to the retailer: a persistent record of who they are, what they buy, when they shop, which promotions they respond to and how their behavior changes over time.
German judges are now being asked to decide how consumer law should describe that exchange.
The Case Was About PENNY’s Loyalty App
PENNY operates a customer app that gives registered users access to special prices, coupons, savings campaigns and other benefits not necessarily available to customers shopping anonymously.
Participation requires creating a customer account.
The company also processes information associated with participation in the program.
According to descriptions of the case, PENNY stores purchase receipts when a customer’s loyalty code is scanned at checkout and analyzes purchasing behavior to measure how its loyalty program performs. Certain information associated with promotional activities, including competitions, can also be used to evaluate marketing effectiveness.
That arrangement prompted the vzbv to challenge how the economic relationship was being described.
The lawsuit was filed May 7, 2025 before the Cologne Higher Regional Court as Case 6 UKl 3/25.
The consumer group did not argue simply that loyalty programs are unlawful.
Its argument was that when consumers have to provide personal information in exchange for discounts, the retailer should make the nature of that exchange clear under consumer-contract disclosure rules.
In other words:
The customer may not be paying with euros, but is the customer paying with data?
The Court Said Data Is Not a “Total Price”
The Higher Regional Court dismissed the claim.
Its formal holding says that when a business requires consumers to provide personal data in return for price advantages available through an app, that information does not have to be disclosed as part of the “Gesamtpreis,” or total price, under Article 246a of Germany’s Introductory Act to the Civil Code.
The court’s reasoning turned largely on what the word “price” means.
A total price is normally something expressed as an amount.
If a service costs €9.99, the business can disclose €9.99.
If taxes or unavoidable fees apply, those can generally be added to determine the total amount the consumer must pay.
Personal data does not operate in the same way.
What is one customer’s purchase history worth?
What is their email address worth?
What is a year of detailed shopping behavior worth?
The answer depends on the retailer, the customer, the data, the intended use, the ability to combine it with other information and potentially many other factors.
The court therefore concluded that the disclosure rule at issue was written for monetary or otherwise calculable prices, not an attempt to assign a financial value to personal data.
That Does Not Mean Personal Data Has No Value
This distinction is easy to lose in the headline.
The Cologne court did not hold that personal data has no economic value.
It did not hold that retailers can collect unlimited customer information merely because a loyalty program is free.
And it did not exempt loyalty programs from the GDPR.
The decision addresses a narrower consumer-law question: whether the provision of personal information itself has to be presented as a “total price” in the same way that a monetary payment would be.
The answer from the Cologne court was no.
That is very different from saying that the underlying data processing is irrelevant.
The GDPR Still Governs What the Retailer Does With the Data
The court specifically distinguished consumer price-disclosure law from data protection law.
The GDPR already requires companies to provide information about processing purposes, legal bases, recipients and other relevant aspects of how personal data will be used.
Where consent is relied upon, that consent must also satisfy GDPR requirements.
The Cologne court noted that the information required by the GDPR provides consumers with the basis for deciding whether they want to agree to the processing.
That creates two separate questions.
Consumer law: Must a company describe personal data as the “price” paid for a loyalty service?
Privacy law: Is the collection and subsequent use of that personal data lawful, transparent and appropriately disclosed?
The court answered the first question.
It did not eliminate the second.
This Is Really a Fight Over “Paying With Data”
The phrase “paying with data” has become common because it captures the economic reality behind many free digital services.
A search engine may not charge the user money.
A social network may not require a subscription.
A retailer may not charge for its loyalty app.
But the company can still derive significant commercial value from the information produced by the relationship.
Loyalty programs are a particularly clear example because the data can connect online identity with offline purchasing behavior.
Without a loyalty account, a supermarket may know that an anonymous transaction included coffee, diapers and laundry detergent.
With a loyalty account, it may be able to associate those purchases with a specific customer and observe how the same person’s behavior develops across hundreds of future transactions.
That information can help retailers understand customer segments, measure campaigns, personalize promotions and determine which discounts actually change purchasing behavior.
Consumers receive cheaper products.
The retailer receives better customer intelligence.
There is unquestionably an exchange.
The legal question is whether that exchange should be described as a “price.”
Germany’s Consumer Groups Say Consumers Should See the Trade More Clearly
The vzbv’s broader position is that loyalty programs themselves are not inherently objectionable.
The concern is transparency.
Consumer advocates argue that if exclusive discounts are only available because a customer creates an account and provides data for commercial processing, consumers should understand that arrangement when deciding whether to join.
The same issue arose in litigation involving Lidl Plus.
Lidl’s program similarly provides app users with benefits while collecting personal information associated with participation.
Germany’s Stuttgart Higher Regional Court rejected a comparable lawsuit in September 2025, finding that the retailer did not have to characterize users’ personal data as part of the total price and could continue describing the app as free.
The Cologne court expressly followed much of that reasoning in the PENNY case.
So there is now more than one appellate-level German decision resisting the argument that data must be turned into a consumer-law price.
But Germany’s Highest Civil Court Has Raised a Complication
The story is not over.
Germany’s Federal Court of Justice, the Bundesgerichtshof or BGH, has already signaled in a separate proceeding that the relationship between personal data and the word “free” may be more complicated.
In September 2025, the BGH referred questions to the Court of Justice of the European Union in another case involving a service advertised as free even though users provided personal information and agreed to commercial processing.
The BGH observed that the concept of consumer “costs” could potentially include burdens associated with providing personal information and consenting to its commercial use.
The Cologne court acknowledged that development.
But it distinguished between whether a service can be advertised as “free” when data is exchanged and the different question before it: whether personal information must be expressed as part of a statutory total-price disclosure.
Those may sound like semantic differences.
Legally, they matter.
A court could ultimately conclude that a service is not truly “free” because consumers provide commercially valuable data while still deciding that the data cannot be expressed as a numerical “total price.”
The PENNY Case Is Already Going to Germany’s Federal Court of Justice
The Cologne ruling is not final.
An appeal is pending before Germany’s Federal Court of Justice under docket number I ZR 260/26.
That means the country’s highest civil court will have an opportunity to address the same “data as payment” issue more directly.
The appeal matters because the legal treatment of these programs could affect far more than supermarket apps.
The same underlying model appears across:
- retail loyalty programs;
- airline rewards accounts;
- hotel programs;
- restaurant apps;
- free digital platforms;
- media subscriptions supported by advertising;
- mobile applications offering free functionality; and
- services that exchange discounts or personalization for customer information.
If the BGH ultimately agrees with Cologne and Stuttgart, the current separation between price disclosure and privacy disclosure will become considerably stronger.
If it disagrees, retailers may need to rethink how they explain the exchange at the heart of loyalty programs.
Loyalty Programs Can Build Extremely Detailed Profiles
From a privacy perspective, the discussion about whether data is a “price” can distract from what loyalty programs actually create.
A typical program can potentially connect:
- name and contact information;
- account identifiers;
- purchase history;
- store locations;
- dates and times of transactions;
- coupon usage;
- promotion responses;
- product preferences;
- payment-related information;
- app behavior; and
- marketing interactions.
Over time, that dataset becomes much more valuable than any single transaction.
It can show that one customer buys vegetarian products every week.
Another regularly buys infant products.
Another frequently buys medications or health-related items.
Another consistently shops at one store at a particular time of day.
Some of those observations can lead to inferences the customer never explicitly provided.
That is why loyalty programs remain a privacy issue even if courts conclude that the data is not a statutory price.
The Legal Basis Still Matters
Retailers also cannot solve the GDPR question simply by inserting a sentence saying, “You pay with your data.”
The company still needs an appropriate legal basis for each processing activity.
Some information may be necessary to operate the rewards program itself.
Other information may be used for analytics.
Another category may be used to personalize advertising.
Data may also be disclosed to or processed by outside service providers.
Those activities should not automatically be treated as one indivisible processing purpose simply because they occur inside the same loyalty application.
The GDPR requires organizations to understand and document what they are actually doing with the information.
Consent Is Not Necessarily the Only Issue
The initial summary of the case can make it sound as though the lawsuit demanded “more explicit consent.”
That is not quite what the dispute was about.
The consumer organization was pursuing additional consumer-contract transparency around the idea that data functions as consideration for the discounts.
The court responded that GDPR rules already govern transparency around the underlying data processing, while the consumer-law price rule at issue does not require a separate valuation of the data.
This distinction is important because not every processing operation inside a loyalty program necessarily relies on consent.
A company may rely on different GDPR legal bases for different activities depending on the circumstances.
Whether those bases are appropriate is a separate legal analysis from the consumer-price question decided in Cologne.
“Free” May Eventually Become the More Difficult Word
The larger legal battle could ultimately focus less on the word “price” and more on the word “free.”
There is an intuitive tension in telling consumers:
“This service costs nothing.”
while simultaneously requiring them to provide commercially useful data and allow certain uses of that information.
The Cologne court essentially said existing total-price disclosure rules are not designed to resolve that philosophical problem.
The BGH’s separate referral to the CJEU suggests other parts of EU consumer law might.
That distinction could eventually create an unusual result:
A loyalty program might legally have a monetary price of €0 while still not being considered “free” in every consumer-law context.
The Ruling Is Good News for Loyalty Programs, but It Is Not a Blank Check
Retailers operating data-driven rewards programs can take some comfort from the Cologne decision.
The court did not require them to invent a euro value for the personal data customers provide.
Nor did it require app-based discounts to include some theoretical data value in the displayed price.
That would have been difficult to implement in practice.
How would a supermarket calculate the “price” of a customer’s future transaction history before the customer has even used the program?
Would every consumer’s data have the same value?
Would the price change depending on how frequently someone shops?
The Cologne court avoided those questions by concluding that the total-price provision simply was not written to cover this kind of exchange.
But retailers still need to comply with privacy law.
They still need to explain what information is being collected.
They still need to establish valid legal bases.
They still need to respect rights under the GDPR.
And they still need to ensure their advertising about the program is not misleading under other consumer-protection rules.
The Bigger Question Is Whether Data Has Become a Second Currency
The PENNY case is another example of traditional law struggling with an economy where consumers routinely exchange something other than money.
For much of consumer law, price is simple.
A product costs €4.99.
The consumer pays €4.99.
The transaction is complete.
Data-driven services work differently.
A customer receives a €1 discount today.
The retailer receives information from that transaction.
The next purchase adds more information.
Over time, a customer profile develops.
That profile can influence offers, advertising and business decisions long after the original discount has been used.
Economically, there is little doubt that the information can have value.
The Cologne Higher Regional Court’s ruling says that economic value does not automatically turn the data into a legally calculable “total price.”
For now, German law continues to deal with the two sides of the transaction separately.
Consumer price rules govern the money.
Privacy law governs the data.
The pending appeal to Germany’s Federal Court of Justice will determine whether that separation survives.