"Likes" and "Tweets" for a Chance to Win: Conducting Sweepstakes and Contests in a Digital World

The Internet and social media provide opportunities for companies to generate excitement about their brands, products, and services and conduct sweepstakes, contests, and other promotions in a timely, personal, and cost-effective manner. Like promotions conducted offline, online promotions are subject to a host of U.S. federal and state (not to mention international) laws, rules, and regulations, but online promotions create even more obligations and considerations for companies. With a growing array of laws surrounding personal privacy and an increase in privacy related lawsuits (see our website article, Emerging Trends in Privacy and Data Security Litigation), companies must ensure that their promotions meet applicable requirements for all media where the promotion will be marketed and conducted.

While a complete review of all of applicable laws, rules, regulations, and guidelines governing sweepstakes, contests and other promotions is beyond the scope of this article, we provide below an overview of the U.S. legal landscape and some practical tips for conducting online promotions to minimize legal liability, promote consumer confidence, and ultimately, protect your brands. For more background, see our previous article, Structuring Online Sweepstakes and Contests: New Challenges for Marketers.

OVERVIEW OF THE LEGAL LANDSCAPE

The legal landscape applicable to sweepstakes, contests, and other promotions has become increasingly complex with the expansion of digital media. There are many issues to consider when structuring a promotion, and they affect what form the promotion will take, who can participate, and where and how it will be promoted and conducted. For example:

• A variety of general and specific laws relating to the conduct of sweepstakes, contests, and other promotions prohibit certain unfair and deceptive practices, such as unfairly representing that a person has won a prize or requiring a purchase to enter. Some laws require that specific disclosures be made in marketing materials (as described in the Official Rules section below), and some require sweepstakes sponsors to post bonds (such as New York and Florida, when the total value of prizes exceeds $5,000), or pre-register (e.g., New York and Florida require registration when the total value of prizes exceeds $5,000, and Rhode Island requires registration of retail promotions when the total value of prizes exceeds $500). Additional laws apply when promotions involve regulated industries, such as alcohol, dairy, gasoline, and tobacco. Of course, general laws prohibiting unfair and deceptive practices also apply.
• The landscape gets even more complex when promotions are directed to children. A significant recent development in this area is the Federal Trade Commission's ("FTC's") final amended rule implementing the Children's Online Privacy Protection Act ("COPPA"), which was issued on December 19, 2012. The final amended COPPA rule is discussed in more detail below.
• Some social networking platforms, such as Facebook and Twitter, have their own guidelines for promotions that must be considered, along with general terms of use for the sites. Features of these platforms can make it difficult for companies to comply with all applicable requirements, such as age screening for promotions that are open to children, requiring acceptance of the complete Official Rules for the promotion prior to entry, and disclosure of all material terms in advertising.
• Companies must ensure that all commercial e-mail messages relating to a promotion comply with the Controlling the Assault of Non-Solicited Pornography And Marketing Act of 2003 ("CAN-SPAM Act"). As explained further below, the application of the CAN-SPAM Act to messages and posts generated through social networking sites is an evolving area that can impact how promotions are conducted. In addition, if a promotion will use text messaging as a means of entry, then additional considerations apply depending on the technology that is used, such as the CAN-SPAM Act, Telephone Consumer Protection Act, and mobile marketing industry guidelines.
• If contests involve the creation and promotion of user-generated content as a condition to entry, then companies must secure required assignments of or permissions to use content created by the entrants, and consider necessary and appropriate disclaimers for content that amounts to an endorsement or testimonial subject to FTC regulation.
• It is also important to pay attention to proper trademark use in entry areas, rules, marketing materials, and the like.

These types of issues will impact how a promotion is structured and communicated. The next section describes some different types of promotions.

IS IT A SWEEPSTAKES, A CONTEST, OR SOMETHING ELSE?

The starting point for any promotion is determining whether it is a sweepstakes, contest, or another type. A sweepstakes, or game of chance, is a promotion in which participants submit entries (typically a name and contact information) and the winner(s) is/are selected randomly from among eligible entries in one or more drawings. A contest, or game of skill, is a promotion in which participants create and submit entries to be judged and the winner(s) is/are selected from among eligible entries by independent judges based on objective criteria. Both are distinguishable from instant win games, where the winner(s) is/are randomly predetermined, and giveaways, where everyone wins (subject to a disclosed overall limit). It is important to determine which category a promotion falls into, as that will determine what laws apply.

To avoid being classified as an illegal lottery under applicable laws, a promotion must eliminate one of the following three criteria: prize; chance; or consideration. Eliminating the element of chance creates a legal contest (since winners are selected based on skill), and eliminating consideration is commonly employed to create a legal sweepstakes. Consideration can include not only payment of money, but anything of value, such as the increased time it takes a person to enter a sweepstakes (if the difference is found to be significant), requiring entrants to subscribe to a newsletter or send an e-mail to friends, or requiring entrants to travel to a store location to participate.

While many promotions can be clearly characterized as either a sweepstakes or a contest, digital media create opportunities for structuring promotions that do not fall squarely into either category. Eliminating the element of consideration in such an environment can pose challenges. For example, conducting an online photo contest where all entries are displayed on a website and winners are selected solely based on public votes could be deemed to involve more chance than skill, thereby calling into question whether it is a lawful contest or a sweepstakes. Conducting a sweepstakes through Facebook where participants must do something more than simply "liking" a company's page and submitting an entry form to enter could be deemed to involve impermissible consideration. The distinctions are important because different states have different requirements for games of chance (sweepstakes) and games of skill (contests), such as registration and bonding requirements for games of chance, but some states still bar any payment as a condition of entry, even in a skill game.

As a precaution, some marketers continue to routinely provide an alternate, free means of entry, such as a mail-in entry method, that does not involve consideration. Traditional mail-in entry methods can create administrative burdens for marketers, however, as the increasing presence and use of automated sweepstakes entry services and/or a company's failure to limit the number of entries can lead to multiple entries from the same person or household. Companies should keep this in mind when structuring promotions, and implement appropriate restrictions in the Official Rules for the promotion.

All the requirements and limits must be reflected in clear language for prospective entrants. We turn then to a discussion of the Official Rules for a promotion.

OFFICIAL RULES: THE HEART OF THE PROMOTION

The written Official Rules are the heart of any promotion. By accepting the Official Rules and agreeing to be bound by them, a participant enters into a binding contract with the sponsor. Thus, the Official Rules must be drafted with great care and precision. This, of course, requires that consideration be given to the structure of the promotion, how participants acknowledge and agree to the Official Rules, what geographic and age restrictions are in place (and if minors can participate, how parental consent is obtained), and how a participant's eligibility will be verified. As with any contract, it is important to describe the elements of the promotion with particularity, and carve out limitations on the sponsor's liability to ensure that the sponsor is adequately protected. Some companies limit eligibility to U.S. residents and/or exclude residents of certain states depending on the requirements of a particular state's or country's laws. In that regard, companies should be aware of foreign language requirements that may apply depending on the geographic reach of the promotion.

While it is not possible to address all of the issues relating to the Official Rules, as they differ among states and foreign jurisdictions, the following should always be addressed in the Official Rules:

• NO PURCHASE NECESSARY
• Eligibility requirements, such as age and place of residence
• Duration and deadlines
• Instructions for entering or playing (if applicable)
• Entry methods (including alternate, free means of entry, if applicable)
• Prize description(s)
• Odds of winning
• General disclaimers
• How and when winners are selected
• Right to obtain winners' names and how to do so
• Right to publicize winners' names and likenesses
• Method of distributing prizes not claimed
• Liability release
• Sponsor's name and contact information
• VOID WHERE PROHIBITED

For promotions conducted online, consider putting some of the essential eligibility requirements, along with a link to the Official Rules, in a place where entrants will see them before entering the sweepstakes or contest - e.g., "Must be over 18 and a U.S. citizen resident in continental U.S. to enter. Other restrictions apply." Alternatively, or in addition, consider ways to require entrants to review and acknowledge or agree to the Official Rules before entering. This can be done by including a statement such as "By submitting this entry form you certify that you are eligible to enter and agree to be bound by these Official Rules" above the "submit" button, or by placing the rules before the entry form so that entrants must scroll through them before filling out the online form. The rules should be both legible and printable.

Many state laws require that all promotional materials for a sweepstakes or contest, which could include e-mail messages, web pages, banner ads, and Facebook or Twitter posts that mention prizes or winning, incorporate either the complete Official Rules or abbreviated Official Rules that highlight the material terms and identify where consumers can obtain the complete Official Rules. It is not sufficient to merely refer participants to the Official Rules; sponsors should include a brief summary of the Official Rules in all advertising. This can pose a challenge in digital media where features- such as Twitter's 140 character limit or banner ad character/space restrictions- limit how required disclosures can be communicated. Thus, companies must consider how to incorporate the material terms for a promotion into posts about the promotion on social networking sites, given the limitations posed.

At a minimum, the abbreviated rules should include the following:

• NO PURCHASE NECESSARY
• Eligibility requirements
• Entry deadlines
• Odds of winning
• How to obtain complete Official Rules
• Sponsor's name and contact information
• VOID WHERE PROHIBITED

PROTECTING PERSONAL INFORMATION

Collection of some personal information is essential to structuring any type of promotion. Personal privacy has emerged as a seminal issue, partly in response to the explosion of online activities and growing concern about the ways that personal information is collected and ease with which databases of information can be consolidated. As a result, companies that conduct sweepstakes and contests must be informed as to how and under what circumstances they can collect personal information from entrants, what they can do with the information they collect, and what they must tell consumers about their data collection, handling, and storage procedures. Posting a website privacy policy and terms of use and implementing appropriate security to protect personal information collected online is a must in today's online environment.

The growth of Internet marketing has generated concern about consumers' right to privacy, in particular children's privacy. Because entry in many promotions is free, frequently, the quid pro quo is for the consumer to provide some personal information in exchange for entering. Concerns about the capture of personal information – even just a name and address - and marketers' use of it has translated into an array of privacy self-regulatory programs, as well as the FTC's final amended COPPA rule, which affects online promotions directed to children under 13.

Companies that conduct promotions online that involve the collection of personal information from entrants should adopt a privacy policy that describes the company's practices regarding the collection, use, disclosure, and security of personal information online, and include a link to the privacy policy on their website home page and at all places where consumers submit personal information online.

In general, companies should adopt the following practices when collecting information from entrants, and incorporate these concepts into their privacy policies:

• Identify which entity is collecting the information.
• Identify the types of information being collected, as well as means of collection (whether voluntarily or automatically).
• Limit collection to information necessary to process entries and contact potential winners.
• Where information that is collected will be used for purposes unrelated to the promotion, such as advertising purposes, consider requiring consumers to opt-in to such use and/or permit them to opt-out.
• Identify with whom information will be shared.
• Identify how information will be used by the sponsor and any third parties.
• Allow consumers to review the information collected about them.
• Allow consumers to delete personally-identifiable information collected (subject to maintaining adequate information to handle claims or disputes, etc.).
• Store information securely and in accordance with relevant data security laws to prevent misuse, particularly by unauthorized parties.

When collecting personal information from adults or children, it is important to include a reminder of your privacy policy, and make sure that the Official Rules for a promotion do not contradict it. For example, avoid statements like "information will be used only for prize fulfillment" in the rules if your policy and practice is to use the data - including aggregate data - for some other purpose, or statements like "personal information is never shared with third parties," which hamper your ability to share with third parties for limited purposes, such as prize fulfillment.

Having a formal, risk-based data security plan that includes appropriate assessments of risks to the privacy and security of data collected and stored is important to comply with the many data breach notification laws around the country. In addition, several states have adopted regulations governing the security and confidentiality of personal information that require entities that store or maintain personal information about a resident to implement a comprehensive written information security program. For more information on data security and applicable laws, see our Guide to Data Breach Preparedness and Response.

CHILDREN AND THE INTERNET

As noted above, online sweepstakes and contests that target children under 13 present unique issues under COPPA, and sponsors of promotions that are open to children should also be mindful of self-regulatory guidelines developed by the Children's Advertising Review Unit ("CARU").

COPPA imposes severe restrictions on the collection of personal information from children without express parental consent. Among other thing, operators must:

1. Post a clear and comprehensive privacy policy on their website describing their information practices for children's personal information;

2. Provide clear and understandable notice of what information is being collected from children, how the information obtained will be used, and what other entities will be given access to it;

3. Provide direct notice to parents and obtain verifiable parental consent, with limited exceptions, before collecting personal information from children;

4. Offer parents the choice of consenting to the operator's collection and internal use of a child's information, but prohibiting the operator from disclosing that information to third parties; and

5. Provide a properly-identified parent with access to the data collected about a child.

The FTC issued final COPPA rule amendments on December 19, 2012, and operators will be required to comply with the final COPPA rule beginning July 1, 2013. The FTC made some significant changes to the COPPA rule, including revisions to the definitions of personal information, operator, and website directed to children. The FTC also made important substantive changes to the COPPA rule in response to industry comments and concerns about the compliance burden, which include:

• Maintaining the "e-mail plus" mechanism as a method of parental consent.
• Replacing the "100% deletion standard" under the definition of collects or collection with a "reasonable measures" standard to allow filtered chat.
• Defining screen or user names in the definition of "personal information" only when it functions as "online contact information."
• Retaining the requirement that the notice include only the contact information for one operator.

However, the final rule defines photos, videos and audio files to be personal information, which has significant implications for user-generated promotions directed to kids. The final rule also imposes COPPA obligations related to third-party plug-ins and actions. Updated privacy policies and new procedures for compliance will be required. Many new players with little experience in this area will now be covered by the COPPA rule. 

A mechanism to at least notify parents that a child under 13 has entered may be needed under COPPA, depending on what type of personal information may be collected. As a practical matter, this may mean that many marketers simply limit promotions to those over 13. Neutral age-screening may be a necessary component of the sweepstakes entry process in such instances, especially for promotions targeting "tweeners." This provides a mechanism to determine when a child under 13 enters. Mechanisms that appear to entice children to lie about their ages be avoided. In addition, use of technologies, like a session or timed cookie, to prevent underage entrants from hitting a back button and changing their age, are recommended.

The CARU guidelines also address privacy aspects, and provide that advertisers should recognize that children may have unrealistic expectations about the chances of winning a sweepstakes or contest or inflated expectations of the prize(s) to be won. Thus, all prizes should be clearly depicted, the free means of entry and likelihood of winning should be clearly disclosed (CARU provides that the phrase "many will enter, a few will win" should be used, where appropriate), all prizes should be appropriate to the child audience, and online promotions should not require the child to provide more information than is reasonably necessary.

COMPLYING WITH THE CAN-SPAM ACT

In the commercial e-mail context, the FTC has clarified that offering consumers extra chances to enter a sweepstakes in exchange for an providing an e-mail address for a friend constitutes consideration that brings an e-mail message that might not otherwise be deemed a "commercial e-mail message" within the confines of the CAN-SPAM Act. Under the CAN-SPAM Act, all commercial e-mail messages must include, among other things, a valid opt-out mechanism, and the sender of the e-mail must scrub the recipient(s) against its opt-out lists.

The application of the CAN-SPAM Act to social media is an evolving area. In three recent California district court cases – MySpace, Inc. v. Wallace, MySpace, Inc. v. TheGlobe.com, Inc., and Facebook, Inc. v. MaxBounty, Inc. – the courts held that certain commercial messages sent through a social networking website were subject to the CAN-SPAM Act. In the MySpace cases, advertisers sent commercial messages to users' inboxes, and in the Facebook case, messages were sent to other users' walls, news fees, and inboxes, as well as external email addresses associated with users' accounts. While a general posting from a brand Facebook page or Twitter account to all fans or followers might not be deemed to be sent to a unique e-mail address, and therefore not subject to the CAN-SPAM Act, these cases suggest that direct commercial messages to individual Facebook users or individual Twitter users are subject to, and should comply with, the CAN-SPAM Act. In addition, a promotion that encourages entrants to post on individual Facebook pages or re-tweet specified content could violate the CAN-SPAM Act, as well as an individual social networking site's own terms of use and guidelines.

COLLECTING AND USING USER-GENERATED CONTENT

Contests that require participants to submit original content to be judged provide a means for companies to acquire photographs, videos, recipes, comments, and the like that can be used for advertising purposes. Digital media offers a means for companies to generate excitement and "spread the word" about their brands, products, and services using user-generated content. However, in order to ensure that companies have the right to use original content created by entrants, including future use for purposes unrelated to the contest, companies should obtain appropriate assignments or rights from the content owners. The Official Rules should address the ownership and use of such content and related information, such as an entrant's name, image, likeness, or biographical information. There are different ways to obtain an assignment or license to use user-generated content depending on how content is submitted and how it will be used.

It is also prudent to incorporate content guidelines in the Official Rules, and consider posting separate guidelines at every place where content is collected from consumers. Among other things, the guidelines should address the type of material that can and cannot be submitted, and companies should consider restricting the use of or reference to brands, products, and/or trademarks that they do not own. Special consideration should also be given to individual privacy rights, namely, restrictions on the use of or references to the names and/or images of individuals other than the entrant (minors in particular) in user-generated content. The ability to upload photos, videos, or other content may offer the opportunity to include personal information, making consideration of COPPA a must.

The collection and use of user-generated content in connection with promotions can also trigger application of the FTC Act, namely claims of unfair or deceptive advertising practices, if any content is deemed an endorsement or testimonial. In 2009, the FTC revised and updated its Guides Concerning the Use of Endorsements and Testimonials in Advertising. The FTC defined an "endorsement" as "any advertising message . . . that consumers are likely to believe reflects the opinions, beliefs, findings, or experiences of a party other than the sponsoring advertiser, even if the views expressed by that party are identical to those of the sponsoring advertiser." While the Guides are administrative interpretations of Section 5 of the FTC Act, and as such are advisory in nature, practices that are inconsistent with the Guides can subject advertisers to liability under the FTC Act. It is therefore important to incorporate appropriate protections into the content guidelines for entries, such as requiring that the connection between the advertiser and endorser be disclosed in every context where it would not likely be understood by consumers and requiring that all claims be truthful and substantiated.

CONCLUSION

Federal and state laws affecting sweepstakes, contests, and other promotions are complex. When the laws of foreign countries, privacy concerns, and new media are thrown into the mix, it creates new challenges for responsible marketers. As online sweepstakes and contests proliferate, companies must be mindful of the new media in which they operate and keep informed about the existing laws, regulations, and guidelines that apply. Marketers must keep informed of the regulatory developments and challenges to avoid conducting an illegal lottery, violating applicable requirements, or improperly collecting, using, or securing personal information from adults or children.

For more information, please contact:

Sheila Millar (202.434.4143, millar@khlaw.com)

Tracy Marshall (202.434.4234, marshall@khlaw.com)

Richard Mann (202.434.4229, mann@khlaw.com)