A participant won but asked to unsubscribe before receiving the notification — am I still required to send it to them?

Yes. You must send them the prize notification once, as it is a legal obligation (the organizer must inform winners). The right to be forgotten does not apply to necessary contractual communications. However, this notification email must contain no marketing content: only the prize, the claiming terms, and the deadlines.

How should I structure my entry form to be GDPR-compliant?

Create two separate checkboxes: a first box (mandatory, cannot be unchecked) for "authorize the organizer to contact me in the event of a win," and a second box (optional, unchecked by default) for "receive the newsletter and marketing offers." This separation protects you legally and allows participants to play without being forced to accept marketing.

What is a contest blacklist and when should it be used?

A blacklist is an internal register of contacts excluded from future draws. Use it only after a resolved conflict, an explicit request for non-participation in the future, or repeated refusals of a prize. A simple marketing opt-out does not justify blacklisting — the participant can still play if they wish.

If I unsubscribe someone before the draw, can they still become a winner?

It depends on your technical implementation. If the unsubscription deletes their entry BEFORE the draw, they cannot be drawn at random. If the unsubscription occurs AFTER the draw (even a few hours later), and the draw has already been made, they can legally be a winner, but you will notify them of their win while respecting their marketing opt-out.

I need to send a prize notification — how do I make sure it is not considered marketing spam?

Use a clear and distinct subject line (e.g., "[CONTEST] You have won..."), content strictly limited to the prize and its terms (zero cross-promotion), and document this communication as mandatory and exceptional in your privacy policy. This email is authorized even for marketing opt-outs because it falls under the performance of contract, not marketing.

Contests and GDPR Unsubscription: How to Manage Opt-Outs Without Losing Your Legal Winnings

A winner asks to unsubscribe: what can you really do?

When a participant wins your contest and then asks to unsubscribe from your mailing list, you are caught between two legal obligations: respecting their right to be forgotten (GDPR) and honoring the prize notification, which is a necessary contractual communication. The good news: these two requirements can coexist if you structure your process correctly from the contest's design stage. The participant has the right to stop receiving your marketing emails, but you retain the right — and often the obligation — to inform them of their win and the terms for claiming the prize.

Why the GDPR creates a paradoxical tension in contests

The General Data Protection Regulation requires explicit consent to receive marketing communications. At the same time, most national laws (particularly in France, under articles of the Consumer Code) require that the organizer of a contest inform the winner of their prize within a set timeframe. These two obligations collide when a participant consents to play but refuses to continue receiving your newsletter.

The GDPR never overrides your legal obligations to communicate about the prize. This is why case law on the matter establishes a crucial distinction: communications relating to the contest itself (participation confirmations, results announcements, prize collection terms) fall under a different legal basis (performance of contract or legitimate interest of the organizer), while general promotional emails depend on marketing consent in the strict sense. Ignoring this distinction exposes your organization to dual compliance risks: GDPR complaints from the participant AND legal action for failing to respect the winner's right to information.

The key: separate mandatory communication from optional marketing from the start

The first line of defense is to never mix consent to the contest with marketing consent. On the entry form, the checkboxes must be clearly separated:

Box 1 (mandatory): "I am entering the contest and authorize the organizer to contact me if I win." This box cannot be unchecked — it is a condition of entry.
Box 2 (optional): "I wish to receive the newsletter and exclusive offers from [Your brand]." This box is unchecked by default and depends on explicit consent.

This simple legal architecture resolves 80% of operational tensions. When a winner asks to unsubscribe after their win, you can immediately confirm: "Your unsubscribe request has been processed. You will no longer receive marketing emails. However, we are required to send you the information relating to the claiming of your prize."

How to notify a win while respecting the opt-out

A participant checked only the first box, won, and then asked to unsubscribe. You now have a time window (generally 30 to 90 days depending on your rules) to inform them of their win.

The recommended procedure is as follows:

Immediately flag this contact as "marketing opt-out" in your database. Use a specific flag, never a complete deletion of the profile.
Create a communication segment reserved for prize notifications. These emails must be sent via an automated journey separate from your regular newsletter, with an explicit subject line: "[IMPORTANT] You have won the [Name] contest — How to claim your prize."
Strictly limit the content. The message must contain: draw date, exact prize, claiming terms (deadlines, documents to provide), terms and conditions applicable to the prize. No advertising inserts, no recommended products, no cross-promotion.
Include a unique unsubscribe link for subsequent communications related to the contest only. Example: "If you decline this prize, click here to stop receiving communications relating to this contest."
Document every send. Keep a record (logs, compliance logs) of the notification email, as it is your legal proof that you fulfilled your obligation.

This approach protects you on two fronts: it honors the participant's right to be forgotten (no marketing emails) AND your obligation to inform them of their win (authorized notification email).

Handling unsubscribe requests before the draw: a preventive strategy

Many organizers overlook the opposite scenario: a participant asks to unsubscribe before the draw. This is a strong signal that their trust has been shaken.

The best practice is to implement a progressive preference list, tiered across two levels:

Level 1: opt-out of the general newsletter (before or after the draw)

The participant remains entered in the draw and may receive contest execution communications (results, prize notification if applicable), but is removed from promotional emails. No legal risk here — they actively asked not to receive marketing.

Level 2: complete withdrawal from the contest (before the draw only)

The participant asks to be removed from the contest itself. You must then:

Delete or anonymize their entry before the draw if it has not yet taken place.
Send them a written confirmation (email): "You have been removed from participation in the [Name] contest. You will not be included in the draw on [date]."
If the draw has already taken place, it is too late: the draw is irrevocable. You must honor the prize if one results, but you can inform them that their withdrawal request could not be processed in time.

This distinction between "marketing opt-out" and "contest withdrawal" prevents legal complications. Many participants do not distinguish between the two and expect you to do so for them.

Building a contest blacklist: when and how to maintain it

A contest blacklist (or exclusion list) is an internal register listing contacts who must never be included in future draws, even if they re-enter. It protects your organization against fraudulent circumvention (the same individual entering multiple times under different identities) and against repeated legal requests from the same frustrated participant.

When to add someone to the blacklist:

After a resolved dispute (e.g., a winner contests the legitimacy of the draw and threatens legal action, but a settlement is reached).
If a participant makes an explicit request: "I no longer want to participate in any of your future contests."
After three successive refusals of the same prize (a sign that this person is participating only for malicious reasons).

When NOT to add someone to the blacklist:

A simple marketing opt-out is not a reason. A participant can still play but refuse the newsletter.
A request for rectification or deletion of personal data within 30 days (this falls under the exercise of the right to be forgotten, not a voluntary exclusion from the contest).

Technical maintenance:

Store the blacklist separately from your main customer database. Use a dedicated field or a separate table.
Test your integration before each draw. Make sure the system automatically excludes any blacklisted contact during the random selection of participants.
Document the reasons. For each blacklist entry, note the date, the reason (with legal references if applicable), and the name of the person responsible. This protects you in the event of a CNIL audit.
Set a retention period. A person blacklisted for 5 years may request removal. Implement an annual review process.

Legally notifying winners: communication template

Here is a prize notification email template that complies with both the GDPR and contractual obligations:

Subject: [CONTEST] Congratulations! You have won [Prize name]

Body:

Dear Sir or Madam,

Congratulations! You have been drawn at random among the participants of the [Contest name] contest, organized by [Your company] from [start date] to [end date].

Your prize: [Precise description of the prize and its commercial value].

How to claim your prize:

You have 30 days from the date of this email to claim your prize.
Reply to this email or click on [prize confirmation link] to validate your identity.
We will then send you the delivery or prize handover instructions.

Your rights:

In accordance with the contest's terms and conditions, if you decline the prize, it will be awarded to the next winner. Your previous request to unsubscribe from our newsletter has been processed: you will not receive any further marketing emails from us.

Need help? Contact us: [support email].

Sincerely, [Your team]

This template: clearly confirms the win, explains the steps, reminds of the deadlines, and explicitly acknowledges the prior opt-out (showing that you listened and that this email is an exception, not a circumvention).

Common conflicts: scenarios to anticipate

Scenario 1: A winner says "I asked to unsubscribe, so I received nothing. You stole my prize."

Your defense: Show your logs. If your unsubscribe request was processed AFTER the draw but BEFORE the notification was sent, it is unfortunate timing but not a violation. If it was before the draw, the person could not have been a winner. Always document the exact chronological order of these actions.

Scenario 2: A participant submits a data access request (GDPR Article 15) right after winning.

Your approach: Process their access request within 30 days (legal obligation), but simultaneously continue the prize notification with a note: "Your data access request is being processed. In parallel, you have won the following prize..." The two processes are not mutually exclusive.

Scenario 3: A winner categorically refuses to receive the notification email because they asked to unsubscribe.

Your response: Explain firmly but politely: "We respect your right not to receive marketing emails. However, the notification of your prize is a legal obligation toward you. We will send it once, to the email address registered at the time of your participation. You may decline the prize if you wish." Stay professional: they cannot compel the organizer to ignore a legal obligation.

Best GDPR compliance practices in contests

Separate consents from the registration form. Participation = mandatory to play. Marketing = optional and uncheckable.
Publish a privacy policy specific to contests. Clearly explain how you use participants' data, who processes it, and how long it is retained.
Implement a compliance logging system. Every action (draw, notification, unsubscription) is recorded with a timestamp, proof that a human can reconstruct the full flow in the event of an audit.
Automate the "marketing opt-out" flag immediately after an unsubscribe request. No newsletter from this contact should be sent, except for prize notifications or other mandatory communications.
Test your journeys before each contest. Simulate a participant who unsubscribes before the draw, after the draw, and between the two. Verify that the right email is sent at each stage.
Keep written consents and proof of opt-out. In the event of a complaint to the CNIL, you must prove that the participant explicitly consented or that they unsubscribed. Screenshots or database exports are your insurance.
Offer multiple unsubscribe channels. Unsubscribe email, link at the bottom of each email, form on your website. The easier it is, the fewer complaints or disputes there will be.

Conclusion: a matter of architecture, not exception

Managing unsubscribe requests in contests is not an exception problem to be patched up case by case. It is a normal operational aspect that your contest platform must handle from its design stage. Good architecture (separate consents, technical blacklist, isolated notification journey, exhaustive logging) turns this apparent dilemma into a transparent process. Not only will you comply with the GDPR, but you will also earn your participants' trust — because they will see that you take their right to be forgotten seriously while remaining honest about your legal obligations toward them.