GDPR
Giveaways and newsletters: why conditioning entry invalidates consent
A draw your entrants can recompute themselves
Seed published before the draw, public drand randomness, shareable video. Free for entrants.
Create an accountVerify an existing drawIt's the most profitable-looking mechanic and the most legally fragile: "to enter, tick the box to join our newsletter." It turns a chance of winning into currency exchanged for consent. The GDPR rejects that trade, and the reason is more interesting than a plain prohibition.
What "freely given" means
Consent must be freely given, specific, informed and unambiguous. All four adjectives matter, but it is the first that fails here.
To assess whether consent is free, regulators look among other things at conditionality: is the processing presented as the condition for something else? When entry is subordinated to ticking a box, the resulting consent is neither free nor specific — the person didn't choose to receive messages, they chose to enter.
The underlying reasoning is this: consent that has a price is not consent, it is a payment. And the GDPR does not recognise payment as a lawful basis for marketing.
Three practices that don't hold up
The pre-ticked box. Consent must result from a positive act. An already-ticked box is not an act, it is the absence of one.
One box for everything. A single box covering the rules, the privacy policy and the newsletter is not specific. The entrant must be able to accept one without the other — the granularity requirement.
Consent buried in the rules. A clause in paragraph 14 of a document nobody opens makes consent neither informed nor unambiguous.
What works, and works better
The right structure is two lines on the form:
- a mandatory box: "I accept the promotion rules." It concerns entry, and it is legitimate because without it there is no promotion.
- an optional, unticked box: "I'd like to receive news from [Organizer]. I can unsubscribe at any time."
An entrant who leaves the second unticked still enters. That is exactly what "free" means.
The common objection is that this reduces sign-ups. True, and it's the weakest argument available: a list built from people who ticked in order to play shows poor open rates, high complaint rates, and eventually damages the deliverability of everything else you send. A shorter, willing list beats a long, coerced one.
Double opt-in, which settles two problems at once
Confirming the address through an emailed link is not required by the GDPR, but it resolves two things simultaneously.
On the data side, it proves consent: you keep the trace of a positive, timestamped act, originating from the address itself.
On the draw side, it excludes invented addresses. On DrawSeal, confirmation is a validity condition of the entry: an unconfirmed sign-up is excluded by anti-fraud filtering, before the list is sealed, under a public rule identical for everyone.
In other words, the measure taken for compliance also improves the fairness of the draw. That is rare, and worth pointing out.
Key takeaways
Conditioning entry on accepting marketing invalidates consent, because it ceases to be free: the person didn't choose to receive messages, they chose to play. You need two separate boxes, the second unticked and without consequence on entry. Double opt-in, while not mandatory, proves consent and excludes invented addresses.
FAQ
Can you offer extra chances in exchange for a newsletter sign-up?
Same problem in another form: consent remains conditioned, simply on an advantage rather than on access. Conditionality is precisely what is examined to judge whether consent is free.
How do you prove consent if audited?
By keeping the trace of the act: date, time, the exact wording displayed, and ideally a double opt-in confirmation. A ticked box with no record of what it said proves nothing.
Must withdrawing consent be as easy as giving it?
Yes. An unsubscribe link in every message, working in one click. A withdrawal requiring a letter or a login is not as easy.
What about addresses previously collected with a conditioned box?
The prudent route is to seek fresh consent, explaining why. Continuing to market on the basis of invalid consent only prolongs the problem and increases the number of people affected.