Notifications via mobile wallets: Transactional, Marketing, and GDPR Consent

Mobile Wallets are native applications developed and maintained by Apple and Google. They provide a global environment on the smartphone that centralizes the management of passes.
Apple Wallet is installed by default on all iPhones and Apple Watches.
Google Wallet, on Android, depends on the device manufacturer: it may come preinstalled or be downloaded from the Play Store. During initial setup, the user is required to accept or decline notifications.

Inside these applications, each pass issued by a retailer, brand, or partner is a distinct object. Users manage each pass independently: display, deletion, and enabling or disabling notifications.

👉 This system combines a global framework (the Wallet app managed by Apple or Google) with individual pass-level settings, which directly impact customer communication and compliance obligations (GDPR, consent).

How Wallet Notifications Work

Apple Wallet

Notifications are sent exclusively through pass updates.
When a field is modified (e.g., points balance, loyalty status, event reminder), a “change message” can be attached to trigger a notification to the user.

Some brands use a dedicated promotional field: updating it—combined with a change message—allows marketing content to be delivered within this framework.

Unlike a native app, which can send free-form push notifications at any time, Apple Wallet enforces a specific, controlled mechanism.

👉 As a partner platform, it is essential to respect Apple’s framework while leveraging it to maintain relevant and consistent communication with users.

User Settings

Each pass operates independently.
Users can enable or disable :

• automatic updates,
• push notifications,
• contextual pre-opening (e.g., automatically displaying a card when entering a store).

Example of iOS configuration :
Settings per pass in Wallet :

‍

• Global iOS notification settings :

Google Wallet

Like Apple, Google automatically sends notifications when a pass is updated.
But Google also offers a Notification API, allowing you to send a direct push message linked to a pass without updating a field.

Example: “-20% this weekend at your favorite store.”

⚠️ Technical limitations:

• maximum of 3 push notifications per pass per day,
• possible suspension in case of abuse (Google Wallet Developer Docs).

Transactional vs Marketing Notifications

Transactional notifications (service-related)

These stem directly from the execution of a contract, such as joining a loyalty program or completing a purchase.

Examples:

• a loyalty member receives “You’ve earned 50 points”,
• a ticket buyer receives “Your concert starts tomorrow”,
• a gym member receives a reminder that they have only 3 entries left.

Legally, these notifications fall under contract performance (T&Cs).
No marketing consent is required, as they are necessary to deliver the service.

⚠️ Important:
A prospect who downloads a pass without subscribing to a service is not covered by this legal basis.
Any notification in this context is considered direct marketing.

Marketing notifications (prospecting)

Their purpose is to promote a product or service without a direct link to an ongoing contract.

Examples:

• updating a promotional field to display an offer,
• sending a “-20% on the new collection” push through the Google API.

These usages require explicit marketing opt-in, separate from service consent.
Some national exceptions may apply (e.g., sending commercial messages about “similar products/services” to existing customers), but must be assessed case by case.

Consent and GDPR Compliance

Legal basis

• Transactional → allowed with prior information, as part of contract performance.
• Marketing → considered commercial prospecting → generally requires free, specific, and informed opt-in.

Collecting consent

Consent may be collected:

• during registration (website, app, in-store),
• via The Wallet Crew registration forms,
• on the pass download landing page.

A clear distinction is required between:

• service notifications (no consent needed),
• marketing notifications (consent required).

Privacy policy

It must be updated to clarify:

• the difference between transactional and promotional notifications via Wallet passes,
• how users can manage or disable them.

Best Practices for Brands

• Map use cases and clearly separate transactional from marketing.
• Update legal documentation (privacy policy, notices, T&Cs).
• Provide a specific marketing opt-in for promotional notifications.
• Inform users about how to manage notification preferences.
• Log and keep proof of consent for any marketing communication.

Offer an additional opt-out option directly in the Wallet pass:

• Add a link to a preference management form.
• Allow users to unsubscribe from marketing only, while keeping transactional notifications.
• Make withdrawal of consent easy, without forcing users to delete their pass.

Conclusion

• Apple Wallet → notifications limited to pass updates; possible to use a promotional field, but no free-form push API.
• Google Wallet → notifications via updates or via API; more flexible, but any marketing use requires explicit opt-in.

👉 Implementing mobile Wallets is not just a technical project.
It is also a legal and organizational project requiring you to:

• adjust contractual and privacy documents,
• define a clear consent and opt-out strategy,
• ensure the user retains full control over preferences.

When implemented correctly, Wallet becomes a powerful tool, combining marketing efficiency with GDPR compliance.

‍

‍

‍