Bounty app on grandparents' phone: whose marketing consent?

What does Bounty tell people without a compatible phone?

Bounty's app FAQ (checked 10 September 2026) has two relevant answers. Under No Smart Phone and Compatibility, it says that if you cannot install the app, you may ask a family member or friend to download it onto a compatible device and collect the Mum-to-be pack in store. Under Older Phone OS, it says the app needs iPhone OS 11 or Android 6 (Marshmallow) or above for features such as collecting that pack.

The same FAQ says that without the app you can still receive a Pregnancy Information folder and a Newborn pack in hospital. So a grandparents' phone is Bounty's published workaround for the shop pack, not the only way to get Bounty paper in hospital. It does not say whose email to type, or whose marketing boxes to tick, once that family phone is in play.

Whose marketing consent sits on that handset?

PECR looks at the recipient, not at who is pregnant. The ICO's electronic mail marketing page says marketing emails and texts to individuals need that person's specific consent (or a narrow soft opt-in that does not cover a new club sign-up). It also advises organisations against taking friends' and family contact details for electronic mail, because they cannot be sure those people agreed.

The ICO's valid-consent page says a third party may indicate consent only with authority, and the individual must have been informed. A shop-queue tap on nan's phone is the hard case that page describes.

How do I put the pack on a family phone without mixing consents?

1. 1
   Prefer hospital paper if the app will not install Bounty's FAQ already says the Pregnancy Information folder and Newborn pack can still be handed over in hospital without the app. That avoids a second adult's phone.
2. 2
   If you need the shop pack, install with mum's email Use the inbox the joining parent reads. The FAQ's voucher-reset route asks you to email from the address the app is synced to — that inbox is the marketing address.
3. 3
   Let mum tap every marketing box on that screen Do not leave nan to accept defaults. ICO valid-consent wording requires a clear affirmative action from the informed individual. Pre-ticked or 'just next' taps are the examples the ICO says do not work.
4. 4
   Sign out and delete the app after the scan A family phone that keeps the login will keep notifications and a saved session. Collection needed the barcode; it did not need a permanent install on nan's home screen.

What did the 2019 ICO action say about poorly informed sharing?

It is history, not a live 2026 penalty. In April 2019 the ICO fined Bounty (UK) Ltd under the Data Protection Act 1998. The Guardian's report at the time said the company had shared tens of millions of records with other organisations without valid consent, including data gathered through its website, app and maternity-ward activity. An ICO data-broking investigation paper later listed that April 2019 Bounty penalty as £400,000, and noted the fines were issued under the 1998 Act, which has since been replaced by UK GDPR and the Data Protection Act 2018.

The lesson that still matches today's ICO pages is about being informed: people need to understand who will use their data and for what. Putting a pregnancy profile onto a relative's phone, then leaving partner ticks untouched, is the same class of 'someone else handled the wording' problem. It is not a finding that Bounty is doing 2019 again.

In shortIn short: Bounty publishes a family-phone workaround for one shop pack. PECR still follows the inbox and the lock screen that receive the messages. Use mum's email, let mum tap the boxes, and take the app off nan's phone after the scan. Treat 2019 as background, not as this year's fine.