Contests and referrals: building a viral mechanic that stays compliant without turning your participants into spammers

A viral referral mechanic can work without legal risk

Contests with referrals ("invite 3 friends, boost your chances of winning") generate participation rates 2 to 3 times higher than simple contests, but they raise major risks: consent from invited people, traceability of invitations, management of intermediate rewards and GDPR compliance. Building a compliant mechanic requires clarifying four points before launch: who can be invited and how, which consents to collect, how to track each invitation without creating spam, and how to structure rewards to stay legal.

Why referral mechanics create legal risks

A simple referral mechanic — "share this link with your friends, get 1 extra entry for each friend who signs up" — pushes participants to send unsolicited messages to their contacts. Three risks emerge:

Involuntary spam: If your interface makes mass messaging too easy (an "invite all my contacts" button), participants spam, including people who never asked for commercial communications. This can expose both you and the participant, as the sender, to legal liability.

Lack of consent from referred friends: Invited people did not choose to receive your marketing communication. The GDPR requires prior consent for any commercial communication by email or SMS. If the invitee does not clearly confirm that they agree to participate, you are violating Article 6 of the GDPR (no legal basis) and the French Data Protection Act.

Undeclared intermediate rewards: If a participant wins a reward (discount, product, credit) as soon as a friend signs up, without having won the main contest, that reward is a prize that must be declared to the Advertising Regulatory Authority (ARPP) or the national equivalent. Many advertisers forget this declaration.

Implicit exclusion clauses: If the mechanic does not clearly state that referred participants remain eligible for the contest (or are excluded from it), you risk unintentional discrimination or a contentious claim.

How to structure the consent step for referred friends

The first step is to make sure that each invited person explicitly consents before you register them as a participant. Here is how to proceed:

Separate the invitation from the registration: Do not automatically register invitees in your database. Send them a message (email or SMS, depending on your channel) that explicitly says: "[Referrer's first name] invites you to take part in our contest. By clicking below, you accept the terms of use and our data processing terms." Clicking the link = explicit consent and registration in the database.

Show the referrer, not in a hidden way: If the invitation message includes the referrer's name ("Alice invites you to play"), the invitee knows where the invitation comes from. This is more transparent and legally legitimate. It also reduces the "weird anonymous email" effect that creates perceived spam.

Set an invitation limit per participant: Do not allow a single participant to invite 500 people in 5 minutes. Setting a cap (5, 10, 20 invitations max depending on your mechanic) reduces voluntary and involuntary spam, and slows down bot or abuse behavior.

Provide an easy opt-out: On every invitation message, include a link saying "I do not wish to participate" or "I no longer wish to receive messages related to this contest." This is a legal obligation, and it reduces CNIL complaints.

Traceability: how to record invitations without creating a GDPR risk

You must be able to prove who invited whom, and that consent was given. Here are the steps:

Time-stamped invitation logs: For each invitation sent, record: the referrer's ID, the invitee's email address or phone number, the time sent, the status (sent, undeliverable, clicked, registered). These logs are your legal proof if the CNIL asks for justification.

Separate consents: Keep a record of when the invitee accepted the terms (clicking the invitation link = time-stamped consent). This distinguishes "message sent" from "consent obtained." An invitee may receive the message but not consent: that is normal.

No sensitive data in invitations: Do not store the referrer's complete contact lists (all their emails and phone numbers). Record only the invitations that were actually sent and their outcome. This limits your GDPR exposure.

Limited retention period: Set a retention policy: for example, delete refused invitations after 3 months, and non-participants' data after the contest ends. Communicate this period in your GDPR information notice.

Intermediate rewards and regulatory declaration

If the mechanic offers a reward as soon as the friend signs up (e.g., "each invited friend gives you 1 immediate winning ticket"), this reward must be declared.

Distinguish successful invitations from draw entries: A successful invitation = the friend clicked and accepted. This can generate an intermediate reward (e.g., an immediate €5 discount). But do not confuse this reward with the entries for the main prize draw. Two distinct logics = two distinct compliance requirements.

Declare intermediate rewards: If you offer discounts, credits or low-value gifts (under €50) as soon as an invitation succeeds, contact the ARPP or your local regulator to check whether a declaration is required. Generally, low-value rewards do not need a declaration, but this depends on your country and your sector. Documenting this check protects you.

Display the real cost of the mechanic: If a participant who invites 10 friends receives 10 discounts of €5, that is a cost of €50 for you. Your declaration must state this total cost and how it is split (immediate reward + draw reward). This is legal transparency.

Exclusion clauses: how to treat referred friends

A critical point is defining whether referred participants can win the main prize.

Option 1: Referred friends remain eligible: If a friend accepts the invitation and signs up, they can win the main prize. This is the most transparent and fairest option. Notify them clearly: "You can be selected as a winner, even if you were invited by a friend." This eliminates legal frustration.

Option 2: Referred friends win less: You can provide for two prize tiers (e.g., a €1,000 prize for direct sign-ups, €500 for referred friends). This must be clearly stated before registration. Be careful: this approach creates friction. People find it unfair to win less because they clicked on a link.

Option 3: Complete exclusion: Referred friends cannot win the main prize, only the intermediate rewards (the discount on sign-up). This is legal, but state it very clearly from the invitation message: "You are invited to participate. By signing up, you receive a €5 discount but you will not be eligible for the main prize draw." Otherwise, it is a breach of the right to information.

Whichever option you choose, display it in the legal terms AND in the invitation message. No legal surprises afterwards.

Anti-spam and anti-abuse mechanics

To prevent your contest from becoming a spam machine, put safeguards in place.

Rate limiting: Block a participant who sends 20 invitations in 10 minutes. Wait 1 hour before allowing 20 new invitations. This discourages abusers without blocking legitimate users.

Email/SMS validation: Check that invited addresses are valid (correct format) before sending. This reduces undeliverable messages and involuntary spam to deleted accounts.

Blocking common lists: If someone tries to invite thousands of emails from a public list (e.g., all the emails published on a website), detect it and block it. Use anomaly detection tools (pattern matching, IP reputation).

Transparency for referrers: Show the participant how many friends received the invitation, how many accepted and how many remain eligible. This builds trust and prevents feelings of being scammed.

Iterative consent for multiple channels

If you offer several invitation channels (email, SMS, social media), consent must be iterative.

Inviting by email = requires email consent: The invitee must agree to receive marketing emails. This is Article 82 of the French Data Protection Act.

Inviting by SMS = requires SMS consent: The invitee must specifically consent to SMS. Email consent does not transfer to SMS.

Inviting via social media: If the participant shares on Facebook or LinkedIn, the people who see the post have not received a direct communication from you. No GDPR consent is required as such, but check the platform's policy (spam, visibility, etc.).

Host a page that makes all of this readable: "How to invite your friends," with the three options and the associated consent criteria.

GDPR information notice and terms and conditions

Before launch, finalize your legal documents.

Compliant information notice: Create a GDPR notice that covers:

• Who processes the data (your company).
• What data (email/SMS addresses, names, points in the mechanic).
• Why (performance of the contest contract, marketing subject to consent).
• Retention period.
• Invitees' rights (access, rectification, objection).
• Contact details of the Data Protection Officer (DPO) if applicable.

Contest terms and conditions: Include:

• Terms of the referral mechanic (invitation limit, rewards, process).
• Exclusion or eligibility clauses (can referred friends win?).
• Anti-abuse rules (blocking participants who spam).
• Contest duration and registration deadline.
• Confidentiality of referred friends' data.

Have these documents validated by a lawyer specializing in contests or personal data. It is a cost, but it is your legal insurance.

Example of a compliant architecture

Here is how to assemble all of this into a user flow:

Step 1 – Referrer registration: The user signs up for the contest in the usual way (email, name, accepted terms). At this stage, they receive 1 entry for the prize draw.

Step 2 – Access to the referral mechanic: A screen says "Invite 3 friends, earn 3 bonus entries." Display of the terms: "Each friend who accepts your invitation receives a €5 discount. You will earn 1 bonus entry. You can invite up to 10 friends. Invited friends remain eligible for the main prize draw."

Step 3 – Invitation: The referrer enters an email (format validation). They click "Send." You record the invitation in the logs.

Step 4 – Message received: The invitee receives an email: "[Referrer] invites you to take part in our contest. You will receive a €5 discount if you sign up, and you can win our main prize. By clicking here, you accept our terms." Link to the registration page + legal terms.

Step 5 – Invitee registration: The invitee clicks, reads the terms, signs up. Time-stamped consent recorded. They receive their discount code and 1 entry for the draw.

Step 6 – Referrer confirmation: The referrer sees "1 invited friend has accepted. You have 1 bonus entry. (2 friends remaining to reach 3.)"

Step 7 – Prize draw: At the end of the contest, all participants (referrers and referred friends) are eligible for the draw, with their total number of entries visible. Transmission of logs and consents to the contest organizer.

This architecture is simple, transparent and compliant.

Critical points to check before launch

Before validating your platform:

• Check that each invitation sends a clear message (referrer named, reward specified, invitee's eligibility conditions stated).
• Test the complete flow: invite a friend, receive the email, sign up, check that data is logged and consents are recorded.
• Check that mass invitations (1,000 addresses in 1 second) are blocked.
• Check that your legal terms page is readable, with retention periods and GDPR rights clearly visible.
• Ask a lawyer to validate the terms before launch (an investment of €500–2,000 depending on your region and complexity).
• Plan post-launch monitoring: how many refused invitations, how many spam complaints, how many clicks on opt-out. Adjust the mechanic in real time if a problem emerges.

A viral and compliant referral mechanic is possible. It requires administrative rigor, but it translates into higher participation rates, fewer legal risks, and a better perception of your brand among participants.