Scenario: Ms. L. spent five years accumulating 180,000 miles, planning round-trip tickets to Europe for her family. Logging in, she finds the carrier has “updated its terms”: old miles expire after 24 months of inactivity, and award prices nearly doubled. She calls it a unilateral rule change; the carrier points to its reserved right to amend. Who is right? The answer lies between business freedom of contract and consumer-protection guardrails.
The legal nature: standard-form terms
Frequent flyer terms are standard-form contracts drafted by the airline on a take-it-or-leave-it basis. Law 19/2023/QH15 on Consumer Rights Protection (effective 1 July 2024) regulates them strictly: businesses must publish terms transparently, and unfair terms — causing significant consumer disadvantage without legitimate reason — may be declared void in part or in whole (Articles 27, 28). Miles are, in substance, a property benefit passengers “paid for” with fares and loyalty; carriers cannot use pre-drafted terms to confiscate them arbitrarily.
The three most disputed clauses
First, mile expiry. Carriers may set validity periods to manage accounting liabilities, but the period must be reasonable, clearly disclosed from the start, with reminders and extension mechanisms (e.g., extension on new flight activity). “Expiry without notice” or unreasonably short periods risk being deemed unfair. Second, unilateral devaluation. Carriers may adjust programs, but retroactive application — raising award prices for already-earned miles — is a global flashpoint. The widely accepted approach: advance notice of a reasonable period, applying new rates only to miles earned after the notice. Third, termination of membership and confiscation. Allowed only for legitimate cause (fraud, illicit mile trading), through a verification process giving the member a right to respond — never an automated lockout email.
Personal data in loyalty programs
Loyalty programs are personal-data goldmines: flight history, spending habits, passport and payment-card details. From 1 January 2026, Decree 356/2025/ND-CP (replacing Decree 13/2023/ND-CP) is Vietnam’s current personal-data protection framework. Carriers need the data subject’s consent for each processing purpose, may not reuse program data to cross-sell insurance or credit without separate consent, must secure the data and notify breaches. A clause deeming enrollment as consent to “all processing purposes” is an invalid bundled consent.
What passengers can do when the rules change
Step one: read the terms on mile validity, program changes and termination — screenshot the version in force at dispute time, as websites get updated. Step two: file a formal complaint citing the 2023 Consumer Rights Protection Law on unfair terms. Step three: if unresolved, complain to the competition and consumer-protection authority or sue civilly. For high-value balances (international business-class awards), litigation costs can be well below the confiscated benefit’s value.
Conclusion
A loyalty program is a contract, not a carrier’s favor. Airlines may manage their programs but may not use pre-drafted terms to unilaterally strip lawfully earned benefits. For carriers, the more transparent the terms and the more notice given for changes, the fewer the disputes — and the better preserved the very thing the program exists to keep: customer loyalty.
Frequently asked questions
1. Can airline miles expire?
Yes, if the period is reasonable, clearly disclosed from the start, with reminders and extensions. Unexplained expiry or unreasonably short periods may be deemed unfair under the 2023 Consumer Rights Protection Law.
2. Can a carrier raise award prices for already-earned miles?
Retroactive devaluation is a dispute flashpoint. The safe approach: reasonable advance notice, applying new rates only to miles earned after the notice.
3. Can a carrier lock an account over suspected fraud?
Only for legitimate cause (fraud, illicit trading), through verification giving the member a right to respond — never an unexplained automated lockout.
4. How is personal data in loyalty programs protected?
Under Decree 356/2025/ND-CP (effective 1 January 2026): separate consent per purpose, no bundled “enrollment means consent to everything”, and data-security duties.
This article has been quality-reviewed by the FLAW AI Legal Council