A Cool Sweepstakes Can Get You in Hot Water

Nov 2, 2022 by Rashida Gordon, Attorney, Children’s Advertising Review Unit, BBB National Programs

When marketing to younger consumers, contests and sweepstakes can be effective vehicles for increasing brand engagement. Though these types of promotions are similar, there are distinctions between a sweepstakes and a contest.

In general, a sweepstakes presents a child with a “luck-based” opportunity, such as winning a prize through a random drawing, while a contest presents more of a challenge, where a prize is rewarded after a demonstration of skill, such as a drawing contest based on a set of judging criteria.  

From the outside, these types of promotions may seem straightforward, but a company can quickly get into hot water if their contest or sweepstakes is directed to or could reach children under the age of 13. 

The Children’s Advertising Review Unit (CARU) through its pre-screening services has seen first-hand how well-intentioned companies can make some common mistakes when rolling out a contest or sweepstakes. For example, the risks of collecting too much Personally Identifiable Information (PII), collecting certain information without first obtaining Verifiable Parental Consent (VPC), and potentially violating the Children’s Online Privacy Protection Act (COPPA) are all common mistakes for both types of promotions. 

So, how do you avoid falling into those traps when designing and planning an online sweepstakes or contest? Here are some things to keep in mind. 


Consider the intended audience as well as how you will collect submissions and award prizes. 

If your online sweepstakes or contest is directed to children under 13 or to a “child-directed mixed audience,” (where an online service is child directed, but does not target children as the primary audience), be aware you will have to comply with CARU’s Advertising and Privacy Guidelines as well as with COPPA. 

COPPA applies to the online collection of personal information from children under 13. Personal information can include any of the following: full name, email, street address, phone numbers, photos, videos, audio recordings, persistent identifiers for tracking, and precise geolocation data. If your participants are under the age of 13 and you need to collect personal information as part of the contest or sweepstakes submission process, make sure you understand whether COPPA requires you to obtain VPC. 

For example, if you wish to collect any information from children beyond basic online contact information (first name and email address only), such as collecting a winner’s home address to mail a prize, you must first provide parents with direct notice and obtain VPC. Direct notice is the process in which parents are directly notified in clear and easy-to-read language about your information practices before collecting the information from their child. 

Under COPPA’s “one-time use” exception you can collect a child’s email address without first obtaining VPC if the data collection is not combined with any other personally identifiable information, such as full name or mailing address. While the contest is ongoing you must secure or hash the information and then you can contact the child one time after the contest ends to notify them if they have won or lost. When the promotion concludes, you must delete that child’s information. 

If your online sweepstakes or contest is directed to children under 13 or to a “child-directed mixed audience,” consider your ask of your participants. 

Is it a contest where participants will create user-generated content (UGC) as part of their entry? If your contest requires children under the age of 13 to submit UGC, such as a photo or video, consider if you can structure the contest in such a way that participants do not have to submit any personal information such as their full name, address, or a picture of themselves, and are clearly told not to submit such PII. If the submission includes a child’s photo or image, this is considered PII under COPPA and you will need to obtain VPC before the collection of such information.


Make sure your under-13 audience knows that the contest or sweepstakes is advertising.

If your primary or secondary audience is children under 13, remember to take care to design your contest with the child audience in mind. For example, from a design and user experience perspective, is it clear to children that the promotion is advertising? Does your promotional content for the contest clearly and conspicuously state, in language that is easy for children to understand, that your sweepstakes or contest is advertising or contains advertising? Is there inappropriate language, such as legalese, featured throughout the promotion? 

This mock ad includes a fictional brand disclosing that the promotion is advertising for illustrative purposes only.

Clear and Conspicuous Disclosures


Consider segmenting your audience. 

If you are running a child-directed mixed-audience promotion, where it is directed to children under 13 but does not target children under 13 as the primary audience, you are permitted under COPPA to age screen to provide COPPA protections for those under 13, but not to exclude them. If you age screen your participants, you can segment your audience and provide COPPA protections to kids under 13 while creating a different experience for participants not subject to COPPA requirements, allowing children of all age groups to participate and engage with your brand.   

For example, if your contest requires a participant to submit UGC and you would like to encourage them to share their creation on social media, take that element out of the under-13 promotion. Under COPPA, social sharing and collecting personal information without VPC is prohibited.

This mock ad includes a fictional brand executing an age screen for illustrative purposes only.

Successful Age Gates


Here are some of the common mistakes you should try to avoid in your promotion. 

Over the course of our routine monitoring of advertising and marketing directed to children, CARU often finds errors at various stages of the sweepstakes and contest process, such as with the entry procedure, checkboxes, and age screens, to name a few. 

  • Collection of too much PII at the entry point to the promotion. Do you need to collect more than the child’s first name and email address to execute your promotion? To limit your company’s requirements under COPPA, consider data minimization and only collect the information you need to execute your promotion.
  • Poorly executed age gates. If you implement an age gate for your promotion, it must be neutral. A neutral age screen is an age screen that asks a child for his/her birthdate or age without any tip-off language informing participants that they must be at least 13 years of age to participate, suggests that their experience in the promotion or prizes awarded will be different if they indicate that they are under the age of 13, or uses any other mechanism that may prompt a participant under the age of 13 to misrepresent their age in order to gain entry. Additionally, when age gates are present, available technology should be used to ensure that children are not able to use the back button to change their age after they receive a notification telling them, for example, that they are not eligible to participate or do not meet the minimum age requirement.     
  • Use of legalese for a child audience. A child may not fully understand Privacy Policies and Terms of Use content that contains complex language. Use language that is clear and simple to ensure that children can understand what they are reading. And because children, as minors, cannot legally consent to these contracts, CARU recommends you consider the utility of asking children to consent to your Privacy Policy and Terms of Use.
  • Offering “opt-in” for marketing email checkboxes. COPPA prohibits children under the age of 13 from receiving marketing or promotional material without first obtaining VPC. Although it may be a common practice to use an opportunity like this to get subscriptions to marketing materials from individuals over the age of 13, checkboxes or other language asking children under the age of 13 to consent to receive this type of information, without VPC, is a violation of COPPA.


Putting it All Together 

There is a lot to consider when putting together contests and sweepstakes with a child audience or a child-directed mixed audience. At every step of the way it is important to consider the special vulnerabilities of children by implementing truth in advertising principles and privacy by design. It is also important to consider the platform you are using and be sure you comply with its specific rules and guidelines for sweepstakes and contests. 

If you are considering a contest or sweepstakes in the future and have any questions regarding compliance with CARU’s Advertising and Privacy Guidelines or COPPA, CARU’s prescreen service can help. Reach out to caruprescreen@bbbnp.org for more information.  

Suggested Articles


Fifty Shades of Consumer Health Data: Unclear Expectations for Digital Privacy

While momentum continues to build around what a regulated consumer health privacy landscape looks like, the environment remains shrouded in shades of gray. To date, a risk-based approach to consumer health data does not exist, but we believe a sliding scale for the risks carried by consumer health data should.
Read more

California Privacy Enforcement: Whose Job Is It Anyway?

The California Privacy Rights Act of 2020 went into effect bringing new privacy rights to California consumers and created the California Privacy Protection Agency. CCPA will continue to be enforced by the California Office of the Attorney Genera. Which begs the question: Whose enforcement is it anyway?
Read more

Unsubstantiated Claims May Lead to Civil Penalties

The U.S. economy is built on a fair and transparent product marketplace. It is the responsibility of companies to have adequate substantiation for health and safety claims and to hold their competitors to the same standard.
Read more

Data Privacy Advances, Despite Lack Of Federal Privacy Law

An appropriate federal privacy law would level the playing field for all companies and create much-needed uniformity in the digital marketplace to enable enhanced trust in the marketplace for businesses and consumers.
Read more