The retailer already has the data in most cases, since cards are the way people pay today. There is nothing illegal about keeping a hashed record of someone's card and tracking all their purchases that way.

Loyalty programs at supermarkets don't make money from selling data (clickbait implication suggested in the story but not explained because it isn't happening). The program is a way to opt-in to the advertising and discounts, not a way to opt-out of tracking.

I've never had one for exactly this reason, but find that in the supermarkets, the person behind me is generally more than happy to lend their card to me: I get the discount, they get the points, win-win!