Contests and prize draws: proving fairness without revealing your algorithm

Why brands must prove the fairness of their prize draws

When a brand runs a contest with a prize draw, it exposes itself to disputes: participants doubt the impartiality, authorities (DGCCRF, CNIL) ask for supporting documents, and social media amplifies accusations of "rigging." Proving fairness is not a marketing option, it is a legal obligation. A contested prize draw can lead to prosecution, a demand for reimbursement of the prizes, or even damages. But the brand must also protect its trade secrets and its anti-fraud system. The balance rests on transparent documentation, verifiable by a third party, without revealing the technical details of the algorithm or the security controls.

What does French law require regarding the transparency of a prize draw?

The DGCCRF (Directorate General for Competition, Consumer Affairs and Fraud Control) requires that any contest be regular, transparent and honest. The official rules must clearly describe the draw mechanism: the eligibility criteria, the date and time of the draw, the number of winners, and above all how the winner is designated. You must explain that the draw is random and impartial.

However, the law does not require you to publish every line of code or every technical parameter. It requires traceability: documented proof that a random process actually took place. This can take the form of a draw certificate issued by an independent third party (auctioneer, bailiff or certified third-party provider), an audit report, or a time-stamped record of the process.

The CNIL, for its part, ensures that the personal data collected for the contest (email, phone number) is processed in accordance with the GDPR: explicit consent, limited retention period, and the right to be forgotten after the draw.

How does a draw certificate work?

A draw certificate is an official document established by an independent third party (generally a bailiff, an auctioneer or a certified platform) attesting that the prize draw took place according to the declared rules, and that the result is random.

Concretely, here is the process:

1. Before the draw: the brand sends the contest rules to the independent third party, who validates them. The third party also receives the list of eligible participants (anonymously numbered, for example).
2. During the draw: the third party observes or supervises the process. If it is a digital draw, it can validate the technical architecture (presence of a certified random generator, for example). If it is manual, it attends the physical drawing of the balls.
3. After the draw: the third party drafts a signed and time-stamped official report, confirming that the draw took place, what the number of participants was, and who the winners are.

This certificate remains discreet about the technical details — it does not say "we used the Mersenne Twister algorithm with seed 12345" — but it proves that a controlled random process actually took place.

Third-party audit: how to document without revealing your system?

A third-party audit is an alternative or a complement to the draw certificate, especially if your draw is fully automated. An independent auditor (audit firm, cybersecurity expert) examines your system to validate:

• The presence of a random generator: does the system use a reliable and non-predictable source of randomness?
• Data integrity: is the list of participants secured and unmodifiable after the deadline?
• The absence of bias: does the draw favor certain participants over others?
• Traceability: is each step of the draw recorded and time-stamped?

The auditor drafts a report that validates these elements without revealing proprietary details. For example, the report can say: "We verified that the system uses a source of randomness compliant with industrial cryptography standards" without giving the exact URL of the source or the cryptographic keys.

This audit creates a chain of trust: participants and the DGCCRF know that an external expert has validated the system, without you exposing your anti-fraud secrets.

Traceability and time-stamping: the digital evidence of fairness

Traceability is the foundation of digital evidence. It means that each event of the draw is recorded with the exact time, in an irrefutable manner.

Concretely, your logs must document:

• When the list of participants was finalized and locked.
• When the draw started (exact time in UTC, preferably).
• The number of participants and winners.
• The result: identifiers of the winners (without revealing personal data in the log itself).
• The source of randomness used ("certified RNG", "external timestamp", etc., without technical details).

These logs must be immutable: stored on a system where no log can be modified retroactively. Blockchain technologies or third-party timestamping (such as RFC 3161) guarantee this.

A concrete example: if you organize a draw on December 15, 2024 at 2:30 PM UTC, an external observer receives a digital certificate signed at that time, confirming that the draw took place and who the result is. This certificate is mathematically impossible to falsify after the fact.

Real cases: how disputes emerge and are resolved

Several brands and organizers have had to face prize draw disputes:

Case 1: Lack of documentation. A cosmetics brand organizes an Instagram draw for a gift voucher. No certificate, no audit — just a screenshot of the winner's Instagram account. Participants react on Twitter: "How do you know it wasn't pre-decided?" The brand cannot prove anything. The DGCCRF asks for a file. Without documentation, the brand must reimburse the participation fees and apologize publicly.

Case 2: Transparent audit. A major sports brand organizes a prize draw for 100 marathon places. It hires an audit firm, which supervises the draw and publishes a signed report (non-technical, but with verifiable figures: "50,000 eligible participants, 100 winners drawn at random"). When participants contest, the brand can point to the audit report. The authorities validate. No further complaints.

Case 3: Involuntary revelation of a bias. An e-commerce site launches an automated draw for a gift card. A savvy participant notices that the winners are all accounts created on the day of the draw. He publishes his analysis on GitHub. Even with an audit, the bias is proven: the system favored new accounts. The brand acknowledges a bug and redoes the draw publicly, with an audit.

These cases show that documentation is your best defense. It reduces legitimate disputes and gives credibility to your contest.

Protecting your trade secret while being transparent

Legal transparency does not mean revealing your secret formula. Here is how to compartmentalize the information:

What you publish in the contest rules:

• General mechanism (random prize draw, no sorting or voting).
• Eligibility criteria (age, location, registration).
• Date and time of the draw.
• Number of winners.
• Identity of the third party who will certify the draw (if applicable).

What you put in the audit report (accessible to the authorities, not to the public):

• Technical architecture of the system (server A, database B).
• Specifications of the random generator (standards respected, initialization frequency).
• Security measures and anti-fraud controls.
• Detailed results of the draw (for verification of the random distribution).

What you keep secret (intellectual property):

• Exact source code.
• Cryptographic keys or internal seeds.
• Specific details of fraud detection (so they cannot be circumvented).
• Exact infrastructure or third-party providers.

The DGCCRF accepts this separation: it has access to the full report; the public sees a compliant summary and a third-party certificate. You are never required to reveal your trade secrets.

How to set up fairness documentation

Here are the concrete steps for a fair and legal contest:

1. Clearly define the draw mechanism

Draft the contest rules specifying: "The winner is designated by random prize draw among all eligible participants. The draw will be supervised by [name of the independent third party]."

2. Choose an independent third party

Contact a bailiff, an auctioneer, or a certified platform (often called a "trusted provider"). Verify that they have a certification or recognized experience in prize draws.

3. Set up technical traceability

If the draw is digital:

• Record all logs (participant, timestamp, result).
• Use third-party timestamping to seal the evidence.
• Encrypt the list of participants until the draw.

If it is physical (drawing balls, for example):

• Film the draw (visual evidence).
• Have independent witnesses.
• Draft a signed official report.

4. Request an audit before publishing

Submit your process to an independent auditor. Correct the flaws detected (random bias, poorly secured data, etc.).

5. Generate the certificate/report

The independent third party produces a signed, time-stamped document attesting the fairness of the draw. Keep this document and make it available in case of dispute.

6. Document for the GDPR

Draft a data processing register (who has access to the data, how long it is kept, how it is deleted). This also reassures the CNIL.

GDPR obligations and personal data in a prize draw

In a contest, you collect personal data (name, email, phone). The GDPR requires:

Explicit consent: Participants must check a box confirming that they accept that their data will be processed for the draw. This consent must not be pre-checked.

Transparency: A privacy policy must explain exactly what you do with the data (prize draw, temporary storage, deletion after the contest).

Limited duration: You cannot keep the data indefinitely. Typically: storage during the duration of the contest + 30 days to process appeals (legal dispute period), then deletion.

Right to be forgotten: After the draw, any participant can request the deletion of their data. You must execute this request within 30 days.

Security: Participants' data must be encrypted and protected against unauthorized access. This also strengthens traceability: the access logs to participants' data are proof of impartiality.

This GDPR aspect actually strengthens your credibility: if the data is secured and well managed, it is difficult to modify it or make it disappear after the fact.

When the DGCCRF intervenes: what it looks for

If a complaint is filed with the DGCCRF, the agency asks for:

1. The contest rules (published and final).
2. The list of participants (anonymized, but with a verifiable total number).
3. The official report or the draw certificate (signed by a third party if possible).
4. The logs or traces of the draw (time-stamped, immutable).
5. The result (identity of the winner(s), proof that they were eligible).
6. Proof that the winner actually received the prize (confirmation email, acknowledgment of receipt).

If you have complete documentation, the DGCCRF generally concludes that there is no infringement. If the documents are missing or suspicious (modified logs, pre-dated certificate), it can order a reimbursement and a fine.

Technologies that support proof of fairness

Rather than detailing your algorithm, you can rely on standard technologies that guarantee randomness:

Certified random generator: Some cloud services (AWS, Google Cloud) offer certified prize draw APIs that guarantee randomness. Using one of these APIs gives credibility to your draw without revealing your implementation.

Blockchain and smart contracts: Some brands use the blockchain to record the draw immutably. Even without revealing the code, the fact that a smart contract executed the draw on a public blockchain proves that it was random.

Trusted third parties (Timestamping Services): Services like eSignature, Universign, or Docusign offer RFC 3161 certified timestamping. This creates a digital seal proving that your draw took place at a precise time and date.

Certified third-party audit: Some audit firms (Mazars, Deloitte, etc.) offer audit services for prize draws. Their report strengthens your credibility.

Using one of these technologies shows that you take fairness seriously, without exposing your secrets.

Best practices: a checklist for your contest

• ✓ Draft clear and final rules (immutable after publication).
• ✓ Explain the draw mechanism in an understandable way (without jargon).
• ✓ Designate an independent third party and name them publicly in the rules.
• ✓ Set up technical traceability (immutable logs, time-stamping).
• ✓ Have your system audited before the draw.
• ✓ Generate a certificate/report attesting fairness.
• ✓ Keep all documents (at least 3 years, as the law requires).
• ✓ Respect GDPR deadlines (rapid deletion of data).
• ✓ Publish a transparent summary without revealing trade secrets.
• ✓ Respond quickly to any dispute with the documented evidence.

Conclusion: transparency and trust

Proving the fairness of a prize draw is not a bureaucratic constraint, it is a marketing asset. Participants and authorities want honest contests. By documenting your process, having it audited by a third party, and publishing a transparent summary, you build trust.

You are never obliged to reveal your algorithm or your anti-fraud secrets. What the law requires is the proof that a fair random process took place. A third-party certificate, immutable logs, and a well-done audit are enough.

This approach protects your trade secrets, satisfies the authorities (DGCCRF, CNIL), and gives participants the assurance that the draw was honest. It is the optimal balance between legal transparency and corporate confidentiality.