Structuring Online Sweepstakes and Contests: New Challenges for Marketers

Date: Aug 19, 2009

Online sweepstakes and contests are an effective way to create excitement about your brands and products and increase traffic and sales. The number of sweepstakes and contests conducted over the Internet has grown exponentially over the last decade. Internet marketing enables companies to conduct sweepstakes and contests in a timely, relevant, personal, and cost-effective manner.

Even when conducted in a purely traditional manner, contests and sweepstakes subject marketers to a host of U.S. state and federal laws and regulations, to say nothing of the foreign requirements. In general, the requirements offline are well-understood. Sweepstakes and contests conducted online, in particular those that are open to children under age 13, create even more obligations for marketers. With a growing array of laws surrounding personal privacy, including the Children's Online Privacy Protection Act (COPPA) and Federal Trade Commission's (FTC's) implementing rules, and self-regulatory programs, such as the Children's Advertising Review Unit (CARU) Self-Regulatory Program for Children's Advertising, companies should be sure that contests and sweepstakes directed to children in particular meet applicable requirements. The landscape has become even more problematic as a result of the recent adoption of a privacy law in the State of Maine that purports to limit the ability to collect personal information from minors under 18. The design and formulation of an Internet sweepstakes or contest therefore requires care and specialized knowledge of all the regulatory challenges to limit legal exposure and develop proactive legal and compliance strategies.

With the emergence of personal privacy as a seminal issue, partly in response to the explosion of online activities and growing concern about the ease with which enormous databases of information can be consolidated, marketers who conduct contests and sweepstakes must be informed as to how and under what circumstances they can collect personal data, what they can do with personal data when they collect it, and what they must tell consumers about their data collection, handling, and storage procedures. Posting a privacy policy, developing website terms and conditions, and implementing appropriate security to protect personal information collected online is a must in today's online environment.

While a complete review of all of the applicable requirements governing sweepstakes, contests and promotions is beyond the scope of this article, we summarize below some of the relevant laws that should be considered in any online contest or sweepstakes, and offer some practical tips to minimize legal liability, promote consumer confidence, and ultimately, protect your brands.


All fifty states have statutes that prohibit illegal lotteries. An illegal lottery is characterized by three elements, all of which must be present: (1) a prize; (2) chance; and (3) consideration. Eliminating the element of chance creates a game of skill or a contest, and eliminating consideration (anything of value to participate) is commonly employed to avoid conducting illegal lotteries and create a legal sweepstakes. Traditionally, marketers have eliminated consideration by simply stating "no purchase necessary," and offering a free method of alternative entry, such as mailing in a postcard. However, eliminating the element of consideration in the Internet environment poses new challenges to marketers. That is because consideration can be anything of value, even the increased time it takes a person to enter the sweepstakes, if the difference is found to be significant. Consideration may be found if a marketer requires an entrant to provide too much personal information, possess specialized software to access the sweepstakes, test drive a car or travel to a store location, subscribe to a marketer's website, or license a marketer's (or anyone else's) software to participate.

Another issue is whether the fact that a consumer must access the Internet in order to participate in a sweepstakes constitutes consideration, since Internet access is not universally available, and access to the Internet generally requires a fee to the user. Consequently, as a precaution, some marketers continue to routinely allow for an alternate means of entry, and this appears to be a prudent precaution for sweepstakes and contests sponsored by subscription-based sites, and for sites that promote the contest or sweepstakes both online and offline.

In addition, states may regulate sweepstakes depending on the value of the prizes. Some states require marketers to post bonds (such as New York and Florida, when the total value of prizes exceeds $5,000), and some require pre-registration (for example, New York and Florida require registration when the total value of prizes exceeds $5,000, and Rhode Island requires registration of retail promotions when total value of prizes exceeds $500). Many states also require specific disclosures in specified font types in immediate proximity to a sweepstakes headline, and some require disclosures on the envelope. Nor does liability end at the U.S. borders; because the Internet is global, promoters also are required to comply with the laws of foreign countries.

If navigating all of these legal minefields is not complicated enough, a host of privacy issues abound to plague an unwary marketer, particularly privacy issues that relate to sweepstakes in which children participate. Under COPPA, web operators are required to post a privacy policy at their sites, and the FTC's Final Rule outlines the specific requirements of web notices and notices to parents when a child enters a sweepstakes online. A growing number of companies, including those that market only to adults, post web privacy policies and allow consumers to at least opt-out of further sharing or sale of their personal information.


If direct mail is used to promote a sweepstakes or contest, then sponsors must ensure compliance with the federal Deceptive Mail Prevention and Enforcement Act (DMPEA), in addition to state laws. The DMPEA applies to sweepstakes mailings, skill contests, facsimile checks, and mailings made to resemble government documents, and requires some specific disclaimers and statements on entry forms, rules and the like. For example, under the DMPEA, sweepstakes mailings must: disclose that no purchase is necessary to enter and will not improve the chances of winning; include the sponsor's name and contact information; provide the estimated odds of winning each prize; include the quantity, estimated retail value, and nature of every prize; and clearly state the payment schedule for any prize. In addition, such mailings may not state or imply that a person may not receive future mailings if he/she fails to make a purchase, require that an entry be accompanied by an order or payment, state that an individual has won a prize if she/she has not, or contradict or limit the sweepstakes rules. Mailings for skill contests or promotions must state all terms and conditions, including rules and entry procedures in language that is easy to find, read and understand, and include the sponsor's name and contact information. Such mailings must also disclose the number of rounds or levels of the contest and the cost to enter each level, whether subsequent rounds will be more difficult, the maximum cost to enter all rounds, the estimated number or percentage of entrants who may win, or have won the sponsor's last three contests, qualifications of the judges, the method used in judging, the date and number of prizes that will be awarded, the nature and estimated value of each prize, and payment schedule. For many marketers, administrative convenience will dictate adherence to these requirements in online activities to assure corporate consistency. Moreover, for certain promotions where both direct mail and online targeting is used, confusion would exist if differing standards apply.


The heart of any sweepstakes promotion is the "Official Rules." These rules constitute the contract between the marketer and the consumer, and must be drafted with great care and precision. By accepting the Official Rules and agreeing to be bound by them, a participant enters into a binding contract with the marketer. While it is not possible to discuss here all issues that relate to Official Rules, as rules differ among states and foreign jurisdictions, the items listed below should always be included:


  • Eligibility requirements, such as age and residence (marketers may want to limit eligibility to U.S. residents, residents of certain states, and adults only, and should be aware of foreign language requirements that may apply depending on the geographic reach of the promotion);
  • Duration and deadlines;
  • Instructions on playing (if applicable);
  • Entry procedures (both online and direct mail procedures, if applicable);
  • Prize description(s);
  • Odds of winning;
  • General disclaimers for lost/delayed mail or e-mail, printing or posting typographical errors, technical failures, etc.;
  • How and when winners are selected;
  • Right to obtain winners' names and how to do so;
  • Right to publicize winners' names and likenesses;
  • Method of distributing prizes not claimed;
  • Liability release;
  • Sponsor's name and contact information; and

If entrants will be required to submit photos or written materials, then the sponsor should include rules that restrict the content of such photos and materials. For example, the rules should prohibit language that is defamatory, obscene, lewd, or inappropriate, any material owned by a third party, or the use of any trademarks, service marks, logos, brands, or products other than those owned by the sponsor. The sponsor should reserve the right to disqualify entries that do not adhere to the established rules. If photos are submitted, then the sponsor should also obtain a liability and publicity release from every individual who appears in the photo. Thus, sponsors might consider prohibiting photos that depict minors (since minors are presumed to lack the capacity to consent) or requiring a parent or guardian submitting the photo to certify that only his/her child(ren) appear(s) in the photo, and he/she consents to use of the minor's image or likeness. Sponsors should also pay special attention promotions with a "social" component. The ability to post and upload photos or content also may offer the opportunity to include personal information, making consideration of COPPA a must.


Marketers must exercise care in advertising a sweepstakes. As noted above, the issue of alternate means of entry may depend to some degree on how the sweepstakes is promoted. Moreover, it is not sufficient to merely refer participants to the Official Rules; marketers should include a brief summary of the Official Rules in advertising that includes the following information:

  • No purchase necessary;
  • Eligibility requirements (most importantly, the jurisdiction and age limits for entrants);
  • Sweepstakes deadlines;
  • How to obtain Official Rules; and
  • Void where prohibited.

Marketers should assess whether it makes sense to advertise a promotion that only allows for online entry in traditional media, such as print and television, given the risk that regulatory authorities will raise the consideration issue.


The growth of Internet marketing has caused concern about consumers' right to privacy, in particular children's privacy. Because entry in a sweepstakes is free, frequently, the quid pro quo may be for the consumer to provide some personal information in exchange for entering. Concerns about the capture of personal information – even just a name and address - and marketers' use of it has translated into an array of privacy self-regulatory programs, as well as the FTC's Final Rule implementing COPPA, which affects online promotions directed to children under 13.

All Internet marketers should adopt a privacy policy describing the marketer's practices regarding the collection, use, and disclosure of personal information online, and include a link to that policy on their home page and at the site of any entry or registration form.

The following privacy recommendations are for promotions directed at adults:

    1. Always identify who is collecting the information;
    1. Divulge to whom information will be provided;
    1. Identify the information being collected, including means of collection, such as cookies; and
    1. Make disclosure of sensitive information optional.

An emerging issue is the question of online behavioral advertising (OBA), or using personally identifiable or even anonymous data to target advertising as visitors cross the Internet. For marketers and consumers alike, the ability to tailor messages in a medium like the Internet is a major part of the appeal, and many consumers enjoy the time savings and other benefits associated with seeing advertising for products and services more likely to be of direct interest to them. The fact remains, however, that there is growing recognition that when collection of even anonymous information for purposes of offering targeted advertising is done without disclosure, it may make consumers suspicious and uncomfortable. Industry and government bodies have thus tackled the subject. The FTC has issued suggested Self-Regulatory Principles for Online Behavioral Advertising, the Network Advertising Initiative (NAI) recently revised its 2000 Self-Regulatory Code of Conduct to govern the conduct of its members, and a coalition of industry organizations, including the Council of Better Business Bureaus, the American Association of Advertising Agencies, Association of National Advertisers, Direct Marketing Association, and Interactive Advertising Bureau, have also announced a self-regulatory approach to OBA. The World Federation of Advertisers has also endorsed the joint industry principles, and over the coming months there will be additional efforts to implement processes to meet the objectives of the program.

The industry program is based on seven principles:

· Education: Digital media industry members should educate consumers about OBA.

· Transparency: Consumers should be able to access clear information about data collection and use practices related to OBA.

· Consumer control: Consumers should have the ability to choose whether or not data is collected and used for OBA, including by Internet service providers and providers of desktop software.

· Data security: Organizations should provide reasonable security for, and limited retention of, data used for OBA.

· Material changes: Organizations should obtain consent for material changes to OBA data collection and use practices as to data collected prior to the change.

· Sensitive data: Parental consent is needed before collecting and using data collected from children for OBA, and heightened protection is needed for certain health and financial data attributable to a specific individual.

· Accountability: Industry should work on programs to advance these principles, including programs to monitor and report on non-compliance.

In addition, more and more marketers are adopting other practices to respond to consumer concerns and adhere to general guidelines on the handling and use of data:

    1. Collect only information that is necessary;
    1. Allow consumers the option of restricting the further use of their information beyond the purpose for which it was collected;
    1. Allow consumers to review the information collected;
    1. Allow consumer to delete personally-identifiable information collected (subject to maintaining adequate data to handle claims or disputes, etc.); and
    2. Store information securely, and in accordance with relevant data security laws, to prevent misuse, particularly by unauthorized parties.

Having a formal, risk-based data security plan that includes appropriate assessments of risks to the privacy and security of data collected and stored is important to comply with the many data breach notification laws around the country. In addition, the Massachusetts Office of Consumer Affairs and Business Regulation (OCABR) has adopted regulations for the security and confidentiality of personal information, which require entities that store or maintain personal information about a resident to implement a comprehensive written information security program. On August 17, 2009, OCABR announced that it revised the regulations to emphasize a risk-based approach to security that takes into account an entity's size, scope, and type, available resources, the amount of stored data, and the need for security and confidentiality of consumer and employee information. The revisions also eliminate certain requirements, and clarify that the computer system security requirements, including encryption of personal information stored on laptops and other portable devices, need only be incorporated "to the extent technically feasible." The intent of the revisions is help small businesses that do not handle large amounts of personal information to comply with the regulations. The effective date of the regulations was extended to March 1, 2010 (the effective date was previously extended from May 1, 2009 to January 1, 2010).

In the commercial e-mail context, the FTC has clarified that offering consumers extra chances to enter a sweepstakes in exchange for an providing an e-mail address for a friend constitutes consideration that brings an e-mail message that might not otherwise be deemed a "commercial e-mail message" within the confines of the CAN SPAM Act . Under the CAN SPAM Act, marketers must include in all commercial e-mail messages, among other things, a valid opt-out mechanism, and the sender of the e-mail must scrub the recipient(s) of a commercial e-mail message against its opt-out lists.


As noted at the outset, Internet sweepstakes that target children under 13 present unique issues. Sponsors of sweepstakes and contests that are open to children should be mindful of self-regulatory guidelines developed by CARU. The CARU guidelines provide that advertisers should recognize that children may have unrealistic expectations about the chances of winning a sweepstakes or contest or inflated expectations of the prize(s) to be won. Thus, all prizes should be clearly depicted, the free means of entry and likelihood of winning should be clearly disclosed (CARU provides that the phrase "many will enter, a few will win" should be used, where appropriate), all prizes should be appropriate to the child audience, and online sweepstakes and contests should not require the child to provide more information than is reasonably necessary.

COPPA also places severe restrictions on the collection of personal information from children without express parental consent. Among other thing, operators must:

    1. Post a clear and comprehensive privacy policy on their website describing their information practices for children's personal information;
    1. Provide clear and understandable notice of what information is being collected from children, how the information obtained will be used, and what other entities will be given access to it;
    1. Provide direct notice to parents and obtain verifiable parental consent, with limited exceptions, before collecting personal information from children;
    1. Offer parents the choice of consenting to the operator's collection and internal use of a child's information, but prohibiting the operator from disclosing that information to third parties; and
    1. Provide a properly-identified parent with access to the data collected about a child.

Consumer groups continue to link privacy and advertising to children in an effort to promote new restrictions, and recent enactment of a law in Maine establishing that verifiable parental consent is required to collect information from minors under age 18 potentially illustrates an effort to adopt new state laws that mandate a higher age than established under U.S. federal law. However, COPPA includes a provision barring states from enacting inconsistent laws. It is hoped that legislators will recognize that they may face a legal challenge if they adopt children's privacy laws that are inconsistent with COPPA.


Given jurisdictional questions, privacy debates, and special rules for kids, how do marketers who aren't yet totally scared by the prospect of Internet promotions structure them? A few basic rules provide a logical starting point.

    1. Consider putting some of the essential eligibility requirements in a place where the web visitor will see them before entering the sweepstakes or contest - e.g., "Must be over 18 and a U.S. citizen to enter. Other restrictions apply."
    1. As an alternative, or in addition, consider ways of requiring the visitor to review and even acknowledge the Official Rules before entering the sweepstakes. This can be done by including a statement such as "by submitting this entry form you certify that you are eligible to enter and agree to be bound by these rules" above the "submit" button, or by placing the rules before the entry form so the visitor must scroll through them before filling out the online form. The rules should be both legible and printable.
    1. When collecting personally identifiable information from adults or children, include a reminder of your privacy policies. Make sure that the rules do not contradict your privacy policy. For example, don't include statements that "information will be used only for prize fulfillment" in the rules if your policy and practice is to use the data - including aggregate data - for some other purpose.
    1. A mechanism to at least notify parents that a child under 13 has entered is needed under COPPA. As a practical matter, this may mean that many marketers simply limit promotions to those over 13. For contests where younger children are eligible, however, particularly promotions targeting "tweeners," the marketer must have an age-screening mechanism to determine when a child under 13 enters. Mechanisms that appear to entice children to lie about their age are prohibited. In addition, use of technology, like a session or timed cookie, to prevent underage entrants from hitting a back button and changing their age, are recommended. As noted above, it is hoped that questions raised by the Maine privacy law will be quickly resolved to avoid burdensome state screens added to age screens.
    1. Last, but not least, make sure that you pay attention to using proper trademark indicia in your entry areas, rules, and the like.


Federal and state laws affecting sweepstakes, contests, and promotions are complex and often contradictory. When the laws of foreign countries and privacy concerns are thrown into the mix, it creates new challenges for responsible marketers. As more and more companies go online, and as online sweepstakes and contests proliferate, the potential exists for this to be viewed as a new area of potential abuse that requires still more rules and regulations. Marketers must keep informed of the regulatory developments and challenges to avoid conducting an illegal lottery, offending the laws of our international neighbors, or improperly collecting personal information from adults or children.