Can I use a pre-checked box for marketing consent in my contest?

No. Under GDPR, valid consent requires a positive, explicit action from the user. A pre-checked box, even a visible one, is considered an unfair practice. The box must be empty by default. Only users who explicitly check it enter your marketing flow. This reduces the immediate volume of leads, but the contacts captured are qualified and voluntary, and therefore more engaged and less likely to unsubscribe.

Do I need to offer two separate contest sign-up paths, one with marketing and one without?

Not two entirely separate forms, but yes, a clear alternative. Your single entry form must include an optional box (empty by default) for marketing consent. The informational text must state explicitly: "Entering the contest does not require your consent to marketing." This clause fulfills the legal obligation to offer a non-marketing alternative for participating.

Why do I get so many unsubscribes after my contest?

Because you probably captured participants without their explicit marketing consent (pre-checked or implicit case). These contacts didn't choose to receive your emails; entering the draw was their only goal. Once the contest is over, they discover your marketing campaign and unsubscribe en masse. It's a symptom of a flawed acquisition strategy. The solution: only market to those who explicitly checked the option.

How should I segment contest participants in my CRM?

Create at least two tags: "Contest-[campaign-year]" for all participants, and "Marketing Opt-in" for those who consented to marketing. Participants without the "Marketing Opt-in" tag should only receive transactional emails (participation confirmation, draw results, prize management). Make sure your email workflows respect this segmentation to avoid sending marketing to a non-consenting contact.

How long should I keep proof of participants' consent?

Keep consent logs (timestamps, IP addresses, form screenshots) for a minimum of 3 years. That's the legal statute of limitations in France. In the event of a CNIL audit, you'll need to prove that consent was explicit, datable, and traced. Archive this data securely and make sure your CRM or contest platform can easily export this information on request.

Contests and Mailing Lists: Capturing Leads Without Violating GDPR

Contests and Mailing Lists: The Line Between Lead Magnet and GDPR Trap

A contest is a powerful marketing tool for capturing contacts quickly, but many brands confuse "entering the contest" with "consenting to receive our emails." This confusion creates two problems at once: a CRM filled with unqualified, hostile leads, and legal exposure to CNIL fines. The real tension lies here: you want to maximize your contact base, but every participant who didn't consciously choose to receive your emails will become an inactive record, a mass unsubscriber after the draw, or worse, a spam report. The solution isn't to abandon contests as a lead generation channel, but to structure the experience so that the act of participating is clearly separated from the act of accepting marketing.

Why Pre-Checked Boxes Fool Everyone

The most common trap: a pre-checked box reading "I'd like to receive news from the brand" in the contest sign-up form. This approach violates the spirit of GDPR, even if technically the user sees the box (which makes the problem subtler than a fully hidden consent). Why is it a problem? Because consent to marketing is not an implicit condition of entering the contest. A user who unchecks that box before submitting their entry reasonably expects not to be contacted for marketing, even if they win the prize.

The legal approach: the box must be empty by default, not pre-checked. This means only participants who explicitly checked the box after seeing it (double opt-in recommended) enter your marketing flow. Yes, this reduces the initial conversion rate, but the contacts that remain are intentional leads, not involuntary captures. A conscious opt-in contact has an engagement rate 3 to 5 times higher than a pre-checked contact, because they genuinely chose to hear from you.

The Legal Obligation: Offering a Non-Marketing Alternative for Participating

GDPR imposes a clear requirement: entering the contest must not be conditional on accepting marketing communications. In practice, this means you must offer at least two sign-up paths:

Path 1 (active marketing): The user checks "I'd like to receive your emails and special offers" when entering the contest. They consciously agree to be contacted for marketing and enter your normal engagement flow.

Path 2 (no marketing): The user enters the contest without checking the marketing box. They receive a participation confirmation email and, if they win, communications strictly related to the prize (delivery, terms, etc.). No promotional emails until they voluntarily re-subscribe to your newsletter.

This separation is mandatory, not optional. A CNIL will specifically verify that you offered a no-marketing option. The absence of this alternative can result in a fine of up to 10 million euros or 2% of annual revenue.

Explicit Opt-In Consent: What It Really Means

Explicit opt-in, in digital marketing law, means:

A voluntary and positive action: the user must check a box, click a button, or type "Yes," never by default or inaction.
Clear and accessible information: before clicking, the user knows exactly what they're consenting to ("promotional emails, exclusive offers, etc."). If your wording is vague, it isn't valid consent.
Provable record-keeping: you must keep proof that the user clicked (timestamp, IP, logged event). If the CNIL asks for proof, you have it.
Easy withdrawal: every marketing email must contain a working one-click unsubscribe link. No prior "confirmation," no frustrating multi-click.

Implicit consent ("no reply = agreement") is never valid under GDPR. A pre-checked box, even a visible one, is a gray area: technically visible, but psychologically insidious. Always prefer the empty box.

How to Handle Scoring and Qualification of Contest Leads

Not all contest participants are prospects of equal value. A user who just gave their email to try for a prize has nothing in common with someone who checked "I'm interested in your products." You must segment your leads by intent from the start.

Segment 1: Marketing participants (newsletter opt-in): These users explicitly checked the marketing box. They start with a higher qualification score and enter your onboarding workflow immediately (welcome sequence, educational content, etc.).

Segment 2: Plain participants (no opt-in): These users entered the contest, period. They receive only transactional emails (participation confirmation, draw results, prize shipping). Don't try to convert them to the newsletter after a delay: that would be spam. They must be the source of a voluntary re-subscription in the future.

Additional segmentation: If your contest form captures useful information (industry, product category of interest, budget), use it to refine scoring. A participant who indicated "I'm interested in your corporate services" has a different profile from someone who just gave their email with no further detail.

Practical tool: in your CRM (HubSpot, Salesforce, Pipedrive), create a "Contest-[campaign-year]" tag and a second tag, "Marketing Opt-in" or "Plain Opt-in." This ensures your teams never confuse a participant contact with a qualified prospect contact.

Why You Get Mass Unsubscribes After the Draw

After the contest, many brands see a wave of unsubscribes or SPAM complaints. This is a direct symptom of a flawed acquisition strategy. Here's why it happens:

Classic (bad) scenario: You launch a contest for a free phone. You promise "Enter and win!" and include a pre-checked box reading "I want to receive special offers." 10,000 people sign up. 9,900 didn't really read it, or saw it as an obligation. You send the draw results. Then you start your marketing campaigns: "Discover our new products!", "-30% this weekend!" Boom: 70% of your new subscribers unsubscribe or report spam. Your sender reputation plummets, and on your next campaign, your emails go straight to spam folders.

Correct (good) scenario: Same contest, but no pre-checked box. 10,000 people enter. 2,000 voluntarily check "I'd also like to receive your offers." You draw the winner. You send the results to the first prize. Then you start your marketing campaigns, but only to your 2,000 opt-in participants. These 2,000 people genuinely want to hear about your products. The unsubscribe rate drops to 2-3%. Your sender reputation stays healthy. The 8,000 non-opt-in participants can still re-subscribe to the newsletter later, voluntarily, if your organic content (website, social media, partnerships) wins them over.

Mass unsubscribing is a signal that you captured leads without genuine consent. This signal, if repeated or large-scale, also draws the attention of email providers (Gmail, Outlook), who degrade your deliverability, and potentially that of the authorities.

Setting Up a Non-Marketing Alternative in Your Contest

To comply with the legal obligation, here's how to structure your entry form:

Field 1: Basic identity (always required to participate)

First name
Email
Phone number (if required for the prize)

Field 2: Marketing consent (always optional, box empty by default)

☐ "I'd like to receive news and special offers from [Brand]. I can unsubscribe at any time via the link at the bottom of the email."

Informational text (mandatory):

"Entering this contest does not require your consent to marketing. You can participate without checking the box above."

Important: Don't bundle other consents (personal data, cookies, terms of use) with marketing consent. Each must be separate and explicit.

Managing Unsubscribes and Post-Contest Follow-Up

After the draw, adopt a two-pronged follow-up strategy:

For marketing opt-in participants:

Email 1 (D+0): Draw results + thanks for participating and for your interest.
Email 2 (D+3): Official welcome to the newsletter with onboarding content (welcome discounts, product guide, etc.).
Email 3+ (D+7+): Entry into your normal marketing flow (promotions, news, etc.).

Immediate stop if they unsubscribe. Comply with GDPR: a clear unsubscribe link at the bottom of the email, effective action within 48 hours at most.

For non-marketing opt-in participants:

Email 1 (D+0): Draw results + information about the prize (terms, shipping, tracking).
No email 2. These contacts didn't ask for marketing. Respect that choice.
No marketing follow-up, unless they voluntarily re-subscribe to your newsletter later.

This approach avoids mass unsubscribes and maintains a healthy sender reputation. The 2,000 opt-in leads will be worth more to your business than 10,000 hostile leads.

Documenting Your GDPR Compliance

In the event of a CNIL audit, you'll need to prove:

Recorded consents: Each marketing opt-in is dated, time-stamped, and traced (IP, browser). Your CRM or contest platform must be able to export this data on request.
Form transparency: A screenshot of the form showing the marketing box empty by default and the explicit informational text.
Proof of alternative: Documentation that participation does not require marketing opt-in.
Unsubscribe history: Logs of contact deletions, with dates and reasons (if collected).
Up-to-date legal notices: Privacy policy, contest terms of use, brand legal notices — all must be aligned and linked in the form.

Keep these documents for a minimum of 3 years. A CNIL audit will rarely go beyond that, but it's the legal statute of limitations in France.

Compliance Checklist Before Launching Your Contest

☐ Entry form with a marketing box empty by default.
☐ Visible informational text: "Entering does not require marketing consent."
☐ Link to your privacy policy and contest terms of use in the form.
☐ Segmented CRM: tags separating "Participants" and "Marketing Opt-in."
☐ Distinct email workflows for the two segments.
☐ One-click unsubscribe link in all marketing emails.
☐ Opt-in database kept with timestamps and proof (screenshot, CRM logs).
☐ Formalized internal process: who sends marketing emails? Through which CRM? Which segmentation filters?
☐ Annual internal audit: verify that your workflows still comply with the rules (drift is common).

Failure to comply with these points carries a risk of fines (10% of revenue or a minimum of €500k for serious GDPR violations), a decline in your sender reputation, and a long-term loss of customer trust.