It seems that loyalty cards are being treated as legit interests, so active consent not required. I ploughed through the Marks & Sparks PP to learn that.
Just in (not a loyalty card):
"As long as you don’t withdraw your consent, you’ll continue to receive marketing communications via email."
It's a madness. Nobody knows what the fúck is going on.