Competition GDPR: Consent, Newsletters and Data

Under the GDPR, running a competition and sending marketing afterwards are two different purposes, and each needs its own lawful basis. Consent to marketing must be freely given, and Article 7(4) says that when you assess this, utmost account must be taken of whether a service is made conditional on consent that isn't necessary for it. That is why many brands use a separate, unticked newsletter checkbox and let people enter whether or not they tick it.

Competitions are one of the best ways to collect sign-ups and marketing consent. They also mean you collect personal data, often from thousands of people in a few days. This guide goes through the GDPR questions to work through before you launch: lawful basis, the coupling question, how to ask for consent, what to tell participants, how long to keep data, winners' data and processors, with notes for Denmark and Germany.

This article is general information, not legal advice. Read it as a list of topics to go through with your legal adviser.

Two Purposes, Two Questions

Most competitions process personal data for at least two things:

Running the competition. Registering the entry, checking that people follow the rules, drawing a winner, contacting them and delivering the prize.
Marketing. Sending newsletters, SMS or offers after the competition.

The GDPR lists the lawful bases in Article 6(1), including consent (a), processing necessary for a contract the person is party to (b) and legitimate interests (f). The European Data Protection Board (EDPB) explains in its guidelines 05/2020 on consent that if processing is in fact necessary to perform a contract, consent is not the appropriate basis, and that consent and contract "cannot be merged and blurred".

Which basis fits the entry data for your competition is a question for your legal adviser. The important point is to keep the two purposes apart in your form, your texts and your records.

Marketing by email and SMS is also covered by national marketing rules. In Denmark and Germany, these rules require the recipient's prior consent before you send marketing by email (see the country notes below).

What "Freely Given" Means

The GDPR defines consent as freely given, specific, informed and unambiguous. The EDPB guidelines say that "free" implies real choice and control, and that consent is not valid if people feel compelled to consent or suffer negative consequences if they say no.

Article 7(4) is the provision often called the coupling or tying rule:

"When assessing whether consent is freely given, utmost account shall be taken of whether, inter alia, the performance of a contract, including the provision of a service, is conditional on consent to the processing of personal data that is not necessary for the performance of that contract."

Recital 43 adds that consent is presumed not to be freely given if the performance of a contract, including a service, depends on consent that isn't necessary for it. The EDPB says the burden of proof is on the organiser, and that cases where such conditionality would not make consent invalid will be "highly exceptional".

At the same time, the EDPB says the GDPR "does not preclude all incentives", but the organiser must be able to show that consent was still freely given. A prize is an incentive. Whether making entry depend on newsletter consent goes too far is the question below.

This is one of the most common questions, and the honest answer is that it depends on the country and on how the competition is set up, and that authorities don't all agree.

The EDPB's general view on conditionality is strict, as quoted above.
In Germany, the data protection authority of North Rhine-Westphalia wrote in its 2021 annual report that making a competition depend on newsletter consent usually breaches the coupling rule, but that it can be possible to base the link on a contract instead, if the exchange is transparent and the competition isn't presented as "free". A German court of appeal (OLG Frankfurt, 6 U 6/19, 27 June 2019) found that consent to advertising given to take part in a prize draw can be voluntary, as summarised by the Federation of German Consumer Organisations (in German).
In Denmark, the Consumer Ombudsman's guidance on competitions and consent (in Danish) says, under the marketing rules, that you may reward a consumer for giving consent to marketing with entry into a competition, as long as it is clear that consent is being collected. The same guidance says it does not cover the data protection rules and refers to the Danish Data Protection Agency (Datatilsynet) for those.

Because the answer isn't settled, many brands choose the option that raises the fewest questions: people can enter without signing up, and the newsletter is a separate choice. You may get fewer sign-ups per entry, but each consent is easier to defend. If you want to make entry depend on a sign-up, get legal advice for each market first.

Practical points, based on the GDPR and the EDPB guidelines:

Use a separate checkbox that is not pre-ticked. The EDPB says pre-ticked opt-in boxes are invalid under the GDPR, and silence or inactivity is not consent.
One purpose per consent. The EDPB calls this granularity: if you want consent for both your newsletter and sharing data with a partner, ask for each separately.
Say who, what and how. Make clear who will contact people, about what and through which channels (email, SMS).
Make withdrawal easy. Article 7(3) says people can withdraw consent at any time, must be told this before they consent, and that withdrawing must be as easy as giving consent.
Be able to show it. Under Article 7(1), you must be able to demonstrate that the person consented. The EDPB suggests keeping a record of how and when consent was given and what information the person saw. The Danish Consumer Ombudsman goes further and says screenshots or a recording of the whole flow, from the ad or post to the consent, can document what the participant saw.

Double opt-in, where people confirm their email address by clicking a link, helps you show that the person who entered owns the address. Whether you need it depends on your market; ask your adviser.

The free consent text generator writes the checkbox text, the double opt-in email and a line for your privacy notice.

What to Tell Participants (Article 13)

When you collect data directly from people, Article 13 lists what you must tell them at the time of collection. For a competition, that typically means:

Who you are and how to contact you (and your data protection officer, if you have one)
The purposes and the lawful basis for each: the competition and, separately, marketing
Your legitimate interests, if you rely on them
Who receives the data, such as your email tool or prize courier
Any transfer outside the EU
How long you keep the data, or the criteria for deciding
People's rights: access, rectification, erasure, restriction, objection, portability
The right to withdraw consent at any time
The right to complain to a supervisory authority

A short text next to the form, with a link to your privacy policy and terms, is the usual way. Our competition terms and conditions checklist covers the competition side.

How Long to Keep the Data

Article 5(1)(e) says personal data must not be kept in identifiable form longer than necessary for the purpose. In practice:

Entry data for the competition: decide when you will delete it after the competition ends and any complaints period is over.
Marketing consent: keep it while you use it, along with proof of how it was given. The Danish Consumer Ombudsman's guidance says a business should keep documentation of consent for as long as it wants to contact the person and until two years after the last contact.
Winners: keep what you need to deliver the prize and handle any questions, then delete it. Check bookkeeping and tax rules with your accountant.

Set the deletion dates before launch, and write them in your privacy information.

Winners' Data

Ask winners only for what you need to deliver the prize, such as a delivery address. If you want to publish the winner's name, say so in your terms and keep it to a minimum, such as first name and city. See how to pick a giveaway winner for announcing winners with privacy in mind.

Processors and the DPA

If a tool handles participant data on your behalf, such as a competition platform, an email tool or a CRM, it acts as your processor. Article 28(3) requires a contract or other legal act that sets out the subject matter, duration, nature and purpose of the processing, the types of data and the obligations and rights of the controller. Make sure you have a data processing agreement (DPA) with every tool in the chain.

Country Notes

Denmark

Section 10 of the Danish Marketing Practices Act (markedsføringsloven) says a business may not contact anyone by electronic mail for direct marketing without their prior consent, that people must be told they can withdraw it, and that withdrawal must be easy and free of charge. It is quoted in the Consumer Ombudsman's guidance on competitions and consent, which also lists what the consent text should include. Datatilsynet's guidance on consent (in Danish) covers the data protection side. Read more in running online competitions in Denmark and the EU.

Germany

Under section 7(2) no. 2 of the German Act Against Unfair Competition (UWG), advertising by email without the recipient's prior express consent is always an unreasonable nuisance. Section 7(3) has a narrow exception for addresses a business received in connection with the sale of goods or services; whether it could ever apply to a competition entry is a question for your lawyer. On the coupling question, see the regulator and court positions above, and get German legal advice.

How Scratcher Supports It

No tool can make a campaign compliant for you: you decide the set-up, texts and terms. Scratcher gives you the settings to run it the way you have decided:

Consent checkboxes with your own texts, and you choose which fields are required, so the newsletter can be optional
Double opt-in emails (Email module: included on Professional, or as an add-on)
Your own terms and privacy links in the sign-up form
Deletion settings, so you decide when player data is deleted, plus export of entries and winners
Sign-ups sent to your email tool or CRM through native integrations, Zapier, the API or webhooks

Scratcher acts as your processor under a data processing agreement, is certified to ISO/IEC 27001:2022 and hosts data in the EU. Read more on our security and GDPR page. For the competition itself, see online competitions and giveaways and our guide on how to run an online competition.

FAQ

It depends on the country and the set-up, and authorities don't all agree. The GDPR's Article 7(4) and the EDPB guidelines are strict on making a service depend on consent that isn't needed for it. The option with the fewest questions is to let people enter without signing up and offer the newsletter as a separate, unticked checkbox.

No. The EDPB guidelines say pre-ticked opt-in boxes are invalid under the GDPR.

Yes, if you collect or use personal data, such as usernames, email addresses or delivery addresses for winners. See our article on Instagram and Facebook giveaway rules.

How long can I keep competition entries?

Only as long as you need them for the purpose. Set a deletion date for entry data after the competition, and keep proof of marketing consent for as long as you rely on it.

Try Scratcher free for 14 days, no credit card needed, or book a meeting and we'll show you how to set up consent, double opt-in and deletion.

This article is general information, not legal advice. Rules differ between countries and change over time, so check the current rules and get legal advice before you launch a campaign.