> For the complete documentation index, see [llms.txt](https://docs.thewalletcrew.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.thewalletcrew.io/guides-animation/engage-and-animate/automatisation/push-notifications/consents-and-gdpr-compliance.md).

# Consents & GDPR compliance

Understand transactional and marketing notifications on Apple Wallet and Google Wallet passes, and how GDPR consent applies to each with The Wallet Crew.

Mobile wallets can surface contextual and campaign-driven notifications. Because some messages are marketing, consent must be managed correctly.

This page explains the difference between transactional and marketing notifications and the controls needed for GDPR compliance. For delivery mechanics, see [Push notifications](/guides-animation/engage-and-animate/automatisation/push-notifications.md).

## Transactional vs marketing notifications

{% tabs %}
{% tab title="Transactional" %}
Transactional notifications stem directly from a contract or loyalty-program membership. They must be necessary to deliver the service. Contract performance usually covers them, so marketing opt-in is not required.

<details>

<summary><strong>Real-world examples</strong></summary>

* “You have earned 50 points.”
* “Your concert starts tomorrow at 8 PM.”
* “You have 3 entries remaining.”

</details>
{% endtab %}

{% tab title="Marketing" %}
Marketing notifications promote a product or service without a direct link to an existing contract. They are commercial prospecting and typically require explicit marketing opt-in.

<details>

<summary><strong>Real-world examples</strong></summary>

* Update a promotional pass field to announce an offer.
* Send a Google Wallet message about a new collection.

</details>
{% endtab %}
{% endtabs %}

{% hint style="warning" %}
A prospect who downloads a pass without enrolling is not covered by contract performance. Any proactive notification is marketing outreach.
{% endhint %}

### Legal basis

A lawful basis is required for wallet notifications. Transactional notifications typically rely on contract performance under GDPR Article 6(1)(b). They must remain necessary to deliver the service.

Marketing notifications typically rely on consent under GDPR Articles 6(1)(a) and 7. Consent must be free, specific, informed, and unambiguous. Keep proof of consent and make withdrawal easy.

### Collect consent

Collect marketing consent before sending promotional notifications. Registration is a common collection point. Consent can also be captured on a pass-download landing page, website, or app.

Keep service and marketing choices separate. Store them as independent flags. Do not bundle both purposes into one “Wallet notifications” checkbox.

### Privacy policy and legal notices

Privacy information must explain that a wallet pass can generate notifications. It should state the triggers, distinguish service and promotional messages, describe processing purposes, and explain customer controls.

Mention the main triggers and expected frequency. Keep the information easy to scan.

## Best practices

1. **Classify every notification.** Decide if it is transactional or marketing.
2. **Separate consent flags.** Maintain independent service and marketing choices.
3. **Gate marketing sends.** Send promotions only to opted-in customers.
4. **Make opt-out easy.** Provide a preference-management link.
5. **Test the full journey.** Validate capture, updates, notifications, and opt-out synchronization.

## Wallet notification settings

Customers control notifications globally and per pass. They can disable automatic updates, push notifications, and contextual presentation for an individual pass.

### Apple Wallet

Apple Wallet notifications are triggered by pass updates. Any visible field change can trigger a notification. Typical changes include points, tier, or event reminders.

For promotional content, reserve a dedicated pass field. Update only that field for marketing copy.

### Google Wallet

Google Wallet can notify through pass updates or its notifications API. This supports more flexible messaging, but frequency must remain controlled.

## How The Wallet Crew helps

The Wallet Crew supports consent-aware notification strategies. Store each consent as a flag in the [metadata](/configure/advanced-configuration/wallet/template-configuration/general-tab.md#metadata) of the pass, then filter the audience of an [automation](/guides-animation/engage-and-animate/automatisation.md#audience-who-receives-it) with a **Metadata** condition on that flag, so that promotions only reach opted-in customers.

The Wallet Crew acts as a data processor for wallet notification services. The brand remains responsible for the legal basis, consent collection and storage, privacy notices, and data-subject rights.

{% hint style="warning" icon="scale-balanced" %}
Marketing consent must be collected through the brand's own consent mechanisms. The Wallet Crew does not collect it on the brand's behalf.
{% endhint %}

## FAQ

<details>

<summary><strong>Is marketing opt-in required for points or balance updates?</strong></summary>

Points, balances, tiers, and similar status updates are usually transactional when they are necessary to deliver the service.

</details>

<details>

<summary><strong>Can pure marketing messages be sent through Apple Wallet?</strong></summary>

Yes, but explicit opt-in is required. Apple Wallet has no standalone push API. A pass update, ideally to a dedicated promotional field, triggers the notification.

</details>

<details>

<summary><strong>Does the Apple or Google notification prompt count as marketing consent?</strong></summary>

No. That prompt controls device-level delivery only. Marketing consent must be collected separately through the brand's own flows.

</details>

<details>

<summary><strong>What consent evidence should be stored?</strong></summary>

Store the timestamp, capture channel, wording shown, and applicable privacy-notice version. Store withdrawals with the same rigor.

</details>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.thewalletcrew.io/guides-animation/engage-and-animate/automatisation/push-notifications/consents-and-gdpr-compliance.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.