Contests and geolocation: targeting by area without violating the GDPR

How can you geographically restrict a contest without violating the GDPR?

Regional companies, franchisees, or businesses subject to legal restrictions (alcohol, gambling, pharmaceutical products) need to target participants by geographic area. However, real-time geolocation constitutes a collection of location data, classified as sensitive data under the GDPR. To stay compliant, you must obtain explicit and specific consent before any collection, document your legal basis (legitimate interest or legal obligation), and minimize the amount of data collected by favoring lightweight solutions that identify an area without continuously tracking the user.

What is location data under the GDPR?

Location data is defined by the GDPR as any information that can determine a person's physical position. It appears in Article 4 of the regulation, which makes it a key element of personal data protection. Contrary to common myths, geolocation is not explicitly classified as "sensitive data" in the same way as biometrics or racial origin. However, it can indirectly reveal sensitive data: a location at a doctor's office, a mosque, a bar, or a casino exposes information about health, religious beliefs, or habits. This is why data protection authorities (including the French CNIL) recommend heightened vigilance.

In a contest context, you are therefore collecting personal data that deserves rigorous legal treatment: prior consent, full transparency in the privacy policy, and the user's right of access and deletion.

Area verification techniques without continuous tracking

Rather than using active GPS geolocation or continuous position tracking (highly invasive), several legitimate methods can validate that a user is located in an eligible area:

Verification via IP address (progressive reveal)

The user's IP address can be used to estimate their region, without specific GDPR consent if it is already collected as log data (server log). Databases such as MaxMind GeoIP2 or similar map IP ranges to geographic areas with an accuracy of 50 to 100 km depending on the ISP. Advantage: no additional consent pop-up, since the IP is a standard technical element. Limitation: insufficient accuracy for a specific neighborhood or commercial location, and not robust against VPNs.

HTML5 geolocation (with explicit consent)

If you use the browser's Geolocation API (W3C), it requires a native consent pop-up before any first use. The user sees "This site wants to access your location" and can refuse. Technically, this consent is not linked to GDPR cookie consent, but to platform permission (OS or browser). However, the CNIL recommends coupling this consent with your GDPR request: in your cookie/consent banner, explicitly state that you will use browser geolocation to validate contest eligibility.

Declarative data (user self-service)

Some contests simply ask the user to indicate their postal code or city at registration, without automatic collection. This remains personal data, but it is less invasive because it is voluntary and clear. The user knows exactly what is being collected and can refuse or lie. This is a good GDPR/UX compromise for non-critical contests. For strictly regulated activities (casinos, PMU), a subsequent address verification (when paying out the prize, for example) strengthens reliability.

Combination of IP + declared address

A sound hybrid approach: collect the IP (technical, minimally invasive), then ask the user to confirm their postal code. Compare the two: if the IP indicates the Île-de-France region and the user declares 75001, that is consistent. If the IP indicates Switzerland and the postal code is 75001, a doubt remains (VPN or lie), and you can request additional verification before declaring the prize.

Handling false positives: VPNs, roaming, and tourism

Why do VPNs distort geographic restrictions?

A user can mask their true location by using a VPN (virtual private network), which makes the IP appear as that of a server located in another region or country. For a contest restricted to France, a person in Belgium can connect via a French VPN and bypass the restriction. Your system must anticipate this case without violating the GDPR or blocking legitimate users who are traveling.

Detection strategies without GDPR overload

Method 1: Browser time zone + IP If the IP indicates France (GMT+1) but the browser time zone is set to UTC-5 (North America), that is an indication of a VPN or travel. You can decide to issue an alert, but not to block automatically (the user may be traveling legitimately).

Method 2: Delayed verification via SMS or email At the time of prize validation, you send an SMS or confirmation email to the address provided. If the IP address used at registration differs significantly from the actual location (determined by subsequent business data), you can request documentary proof (bank statement, utility bill) before payment.

Method 3: No continuous tracking, snapshot at registration Limit collection to a single moment: when the user clicks "Participate." After this snapshot, you do not refresh the location. Thus, a user who connects from a VPN once and wins the prize is not tracked continuously. This drastically reduces GDPR invasiveness.

Method 4: Trust bonus/penalty for borderline cases If an IP corresponds to a known commercial VPN (which can be detected via public VPN databases), you can classify this user in a "To verify" category and strengthen identity verification before payment, without instantly blocking them.

Alternatives to real-time geolocation

Local partners and promotional codes

Instead of collecting location data, provide promotional codes distributed locally: a unique code valid only for physical points of sale (stores, restaurants) or shared in emails targeted at customers registered in an area. This creates an access barrier that does not involve tracking.

Existing customer database (CRM)

If you are a franchise or a chain, you already have a customer database with known addresses. Restrict the contest to customers registered in your CRM, rather than extending it to the entire web. This method assumes prior consent for the CRM (already obtained at purchase) and minimizes the collection of new data.

Restriction by mobile device or app

If you have a mobile app, the contest can be accessible only via the app, where permission access rights are stricter and better understood by the user. An app also allows you to verify subscription, last purchase location, etc., via business data already in your possession.

Restrictions by language, email domain, or payment

A contest reserved for residents of Switzerland can be limited to:

• .ch email domains or Swiss bank addresses
• Payment only via Swiss bank cards (verifiable via the BIC code)
• A form with mandatory canton selection (self-declaration)

These methods bypass technical geolocation by identifying the user through other, less invasive signals.

Legal framework: legal bases and consent

Legal basis: legitimate interest vs. consent

Under Article 6 of the GDPR, data collection requires a legal basis. For a contest with geographic restriction, the possible bases are:

Consent (Article 6.1.a): the user explicitly agrees that you collect their location to verify eligibility. This is the simplest basis to justify and is recommended by the CNIL for contests. Consent must be given before collection, via an explicit choice (checkbox), not a pre-checked box.

Legitimate interest (Article 6.1.f): you can argue that geographic restriction is necessary to comply with a legal obligation (for example, gambling prohibited under 18 in certain areas) or to protect your rights. However, this must be balanced by a CNIL impact assessment. An isolated legitimate interest ("protecting our brand") is rarely sufficient for geolocation.

Legal obligation (Article 6.1.c): if you are legally subject to a restriction (for example, PMU can only operate legally in certain departments), this basis protects you legally. Document this obligation in your privacy policy.

For most commercial contests, consent is the safest.

Drafting a geo-specific consent clause

Here is a compliant clause template:

"Geolocation for contest eligibility

To participate in this contest, we collect your location (via the IP address of your connection and/or your declared postal code) in order to verify that you reside in [ELIGIBLE AREA: metropolitan France / Île-de-France / Switzerland / etc.].

This data:

• Is collected only at the time of your registration
• Is kept for [DURATION: 6 months / until the prize is paid out]
• Is processed in accordance with our [PRIVACY POLICY LINK]
• Can be deleted upon request via [EMAIL/FORM]
• Is not shared with commercial third parties

[CHECKBOX] I agree to the collection of my location to verify my eligibility."

This clause must appear before the "Participate" button, and the user cannot proceed without checking it. It must also be repeated in the full privacy policy.

Sector-specific use cases

PMU and gambling

Online gambling operators (PMU, FDJ, casinos) are subject to strict regulations: minors are prohibited, and operating areas are limited by license. A PMU contest must verify that no minor participates and that the user resides in a legal operating area.

Recommended approach:

1. Collection of age (via declared date of birth) - legal basis: legal obligation
2. IP + postal code restriction - legal basis: legal obligation + consent for location
3. Enhanced KYC (Know Your Customer) verification before prize payment (identity, address, identity document) - legal basis: legal obligation

The CNIL and ARJEL (Online Gambling Regulatory Authority) accept this multi-layered approach because it reconciles minor protection and GDPR compliance.

Alcohol and tobacco brands

Like gambling, these sectors are regulated: age restriction, geographic limitation in certain countries (for example, tobacco in Australia). A rum brand contest must verify age AND area.

Approach:

• Mandatory age request (parental consent possible for minors, depending on the context)
• Restriction by area if applicable (sometimes only certain countries, not regions)
• No continuous tracking after registration, since age and area do not change

Regional brands and franchises

A franchise bakery in Greater Lyon launching a regional contest must ensure that participants are within the delivery area. A pharmacy in Alsace offers a voucher to the winner, valid only in its department.

Approach:

• Simple collection: postal code + declared address
• Legal basis: legitimate interest (ensuring prize feasibility) + consent
• Subsequent verification: before sending the prize, confirm the address via email/SMS

These cases are less regulated than alcohol/gambling, so clear consent is sufficient.

E-commerce with limited shipping

An online sales site organizes a contest in France but only ships to metropolitan France and Corsica. It restricts participants to these areas.

Approach:

• Request for postal code or full delivery address
• Legal basis: legitimate interest (delivery validity) + optional consent
• No need for active geolocation; the declared address is sufficient

Practical compliance: checklist

1. Audit your legal basis: legal obligation, legitimate interest, or consent? Document it.
2. Choose the minimal technology: IP + declared postal code is often sufficient. Avoid continuous GPS/Bluetooth.
3. Draft a clear clause: before the "Participate" button, explain why and how you collect the location.
4. Integrate into cookie consent: indicate geolocation in your initial cookie banner or in a separate consent.
5. Document retention: specify the duration (e.g., 6 months, or until the prize is paid out).
6. Prepare access rights: the user must be able to request their data and have it deleted.
7. Handle false positives: anticipate VPNs and travel, and do not block automatically; instead, request additional verification.
8. Test your form: ensure that consent is actually requested and recorded.
9. Train your team: customer service, moderation, and payment staff must be able to justify geographic rejections.
10. Consult a DPO if necessary: for regulated sectors (alcohol, gambling, pharma), an internal or external opinion strengthens legitimacy.

Mistakes to avoid

Collecting the IP without saying so: even if the IP is a technical log, indicating it in the privacy policy in a contest context is transparent.

Permanent geolocation: after registration, do not refresh the user's location. A snapshot is enough.

VPN Ban: systematically blocking VPNs distorts results (legitimate users traveling) and creates complaints. Tolerate them, then verify before payment.

Undisclosed sharing: if you share location data with a partner (external API server), declare it explicitly in the consent.

Absence of a privacy policy: a contest without a privacy policy violates the GDPR, regardless of the technology.

Pre-checked consent: a box that is already checked is not valid consent according to the CNIL.

Conclusion: a balance between targeting and respect

The GDPR does not prohibit geolocation, but it requires rigorous oversight. For a geographically restricted contest, combine a clear legal basis (consent or legal obligation), a minimal technology (IP + postal code > continuous GPS), and full transparency (explicit consent clause). This approach allows you to effectively target participants while respecting privacy and compliance. For regulated sectors (alcohol, gambling, pharma), strengthen verification at the time of prize payment. Document everything to justify your compliance in the event of a CNIL inspection.