Contests and age verification: validating without blocking registration (GDPR + compliance)

Why age verification is a real challenge in contests

A public contest often attracts participants of all ages. If the entry conditions stipulate an age limit (for example "18 years minimum"), the organizer has a legal and GDPR compliance obligation to verify it — not simply to display it. The problem: validating age without collecting, storing or exposing sensitive data, while keeping a smooth process that doesn't abandon legitimate users. This tension between legal rigor and user experience explains why many brands struggle with this issue.

Distinction between declarative verification and documentary verification

Declarative verification consists of asking the participant to declare their age or date of birth via a simple form (for example, a date-of-birth field or a checkbox "I certify that I am 18"). This approach is fast and doesn't offend the user experience, but it creates a major legal risk: you have no verifiable proof in the event of a dispute or an audit. If a minor participates in a contest reserved for adults, and you only have a written declaration, the liability rests entirely on you.

Documentary verification requires validating age via a supporting document: identity card, driver's license, passport, or other official proof. This approach offers solid legal protection, but it raises enormous GDPR issues. Collecting a copy of an identity document means processing biometric data or sensitive identifiers; you must then justify this collection, obtain explicit consent, store the data securely (encryption, protected server), and implement a right of access and deletion. Many small organizations are not equipped for this.

The GDPR risks of collecting an identity document

Under the GDPR, an identity document contains several categories of data:

• Official identifier (identity card number, passport number): standard personal data, but sensitive.
• Biometric data (photo): special category under the GDPR (Article 9), which requires a reinforced legal basis and increased safeguards.
• Place and date of birth: personal data.
• Residential address: sensitive data with regard to profiling.

To legally collect an identity document as proof of age in a contest, you must:

1. Document the legal basis: generally legitimate interest (proving participants' compliance with the contest rules) or performance of a contract (entry into the contest). This basis must be justified in your privacy policy and in a processing register.
2. Obtain explicit and specific consent: a simple "I accept the terms" checkbox is not enough. You must ask the participant to explicitly accept the collection of their identity document as age verification.
3. Minimize the data collected: do not keep the entire document if you can verify just the date of birth. For example, mask all fields except the date of birth and the photo.
4. Secure storage: end-to-end encryption, protected server, restricted access, regular audit.
5. Define a retention period: for example, delete the identity document 30 days after the end of the contest (you keep only the verification proof in case of dispute).
6. Declare the processing to your local GDPR authority (in France, the CNIL) if the risk is high. A contest involving the collection of identity documents may require a data protection impact assessment (DPIA).

The CNIL has issued specific recommendations: if you collect an identity document, prefer verification by a trusted third party (see next section) rather than storing the document yourself.

Trusted third-party solution: delegating verification

To avoid storing and managing identity documents, the recommended practice is to use a trusted third party or identity verification provider. These companies (for example IDnow, Onfido, Veriff, or in France solutions such as Sigid) handle the collection, verification and destruction of identity documents on your behalf. Here is the flow:

1. The participant arrives at the contest.
2. At registration, if age verification is required, they are redirected to the trusted third party's platform.
3. The third party collects and verifies the identity document (often with live video verification to combat fraud).
4. The third party returns a simple signal to your platform: "✓ Age verified" or "✗ Age not verified", without transmitting the raw data.
5. Your system unlocks registration based on this signal.

GDPR advantages:

• You do not store identity documents; the third party assumes responsibility for them.
• You sign a data processing agreement (DPA) with the third party, which assumes part of the obligations.
• Your legal basis relies on proportionate processing: you receive just a "yes/no", not the raw data.
• Drastic reduction of the risk of data breach.

Drawbacks:

• Additional cost per verification (generally 0.50 to 2 euros per participant).
• Latency: verification can take a few seconds to a few minutes, affecting the smooth registration experience.
• The third party must be established in a safe jurisdiction (EU or third country with an adequacy decision from the European Commission).

Hybrid verification: declarative + documentary on demand

Many brands adopt a hybrid approach to reduce friction:

1. Phase 1 (declarative): At registration, simply ask for the date of birth or a checkbox "I certify that I am 18". This fast approach allows legitimate participants to register immediately.
2. Phase 2 (documentary, if necessary): If the participant is drawn or designated as a winner, then request documentary proof of age before the prize is paid out. At this point, the participant is motivated to provide the proof.

This approach reduces the number of documentary verifications (and therefore the cost) and the impact on the registration experience, while ensuring solid proof for winners.

Managing minor participants with guardian consent

In some contests, you may voluntarily allow minors subject to the consent of a legal guardian. Here is how to document this compliance:

1. Clearly define the minimum age: for example, "13 years minimum, parental authorization required".
2. Collect the guardian's consent: at the minor's registration, require that the guardian (parent or legal representative) accept the contest terms, ideally via a separate checkbox.
3. Verify the guardian's identity: optional but recommended to prevent the minor from impersonating their parent. You can request simple proof (last page of the guardian's tax notice, scan of the parental card, etc.).
4. Document the minor's age: a declaration of date of birth is generally sufficient for a minor, since the guardian validates the whole thing.
5. Adapt data processing: minors have extended rights (reinforced right to be forgotten). Limit the collection of their data strictly to the contest and set up short retention periods (for example, deletion 6 months after the end of the game).

In your privacy policy, state explicitly: "For minor participants (under 18), parental authorization is required. The parent/guardian must accept this policy at registration and has the right to request deletion of the child's data at any time".

Technical challenge: integrating age verification without slowing down registration

From a user perspective, you must minimize the time and clicks before registration is validated. Here are technical best practices:

Place verification at the right time

• Start of the flow: if verification is mandatory for everyone, it is better to request it at the very beginning (before the main form). This creates a bottleneck, but it is transparent for the user.
• End of the flow: request verification after validation of the main form, just before final confirmation. The user has then invested time and is more motivated to complete.
• Post-registration: validate age after registration confirmation, but before access to the game. The user does not feel blocked at the time of registration, but cannot participate until they have proven their age.

Optimize the trusted third-party experience

• Use a lightweight redirect (popup or iframe) rather than a full dedicated page.
• Offer a mobile-first mode: most modern third parties offer a phone-optimized experience.
• Display a time estimate: "Verification in about 30 seconds".
• Handle timeouts and network errors: if verification fails, offer an alternative (retry, contact support, manual email).

Prepare user data

• Pre-fill known fields (email, first name, last name) before redirecting to the trusted third party, to avoid re-entry.
• Receive a callback/webhook from the third party in real time to update the verification status without the user refreshing the page.

Impact on statistics and participation metrics

Age verification affects several key contest metrics:

Conversion rate (registration vs complete participation)

If verification is mandatory from registration, expect a drop in conversion rate, because some users will abandon when verifying their identity. Industry studies show abandonment of 5 to 30% depending on the rigor of verification. If you use a hybrid approach (verification only for winners), the impact is almost zero.

Audience composition

With strict age verification, you eliminate minor participants, which can change your audience profile. If your product naturally attracts young people, this restriction can drastically reduce participation volume.

Fraud and chargebacks

Good age verification reduces fraud (minors using a fake ID, or attempts to access reserved content/products). This reduces subsequent complaints and payment chargebacks.

Operational load

If you accept minors with guardian consent, expect additional support emails: parents asking for clarifications, minors losing access and asking for help, etc. Budget additional support time.

Documenting compliance: audit trail and processing register

In the event of an audit by an authority (CNIL in France, other DPAs in Europe) or a dispute with a participant, you must be able to prove that you complied with the rules. Set up:

1. A processing register: a document describing the collection of data for age verification, the legal basis, the third party involved, the retention periods.
2. An audit trail: immutable logs (timestamped, not modifiable after the fact) of each age verification performed. Example: timestamp, participant's email, verification status (approved/rejected), name of the trusted third party.
3. A clear privacy policy: a specific section on age verification, the third party used, the participant's rights (access, rectification, deletion).
4. A data processing agreement (DPA): if you use a third party, have a signed DPA documenting each party's responsibilities.
5. A record of consent: for each participant who accepted the collection of sensitive data, keep a timestamped record of consent (screenshot of the moment they clicked "I accept", or a token generated by your system).

These records make it possible to demonstrate "good faith" in compliance, reducing penalties in the event of a problem.

Use case: example of a retail brand with a product contest

Imagine a clothing brand launching a free contest to win a 500-euro gift voucher. The contest has no legal age restriction (no reserved product), but the brand wants to target adults (18+) for marketing reasons.

Ideal scenario:

1. At contest registration, a simple request: "To participate, please confirm that you are at least 18 years old" (checkbox + declarative date of birth).
2. Participants register quickly (no slowdown).
3. At the end of the contest, 5 winners are selected from among the participants.
4. Before sending the gift voucher, the brand requests documentary age verification via a trusted third party (Onfido, for example). Email to the winner: "Congratulations! To receive your prize, please validate your identity in 2 minutes via this link".
5. The winner completes the verification (ID check via selfie video).
6. Onfido returns a ✓ signal to the brand.
7. The brand sends the gift voucher.

GDPR documentation:

• Privacy policy: "Declarative collection of date of birth at registration. In the event of a win, documentary identity verification via Onfido, a certified trusted third party. The raw identity document data is not retained by the brand".
• Audit trail: each registration timestamped, each documentary verification attempt (successful or failed) recorded.
• Retention period: registration data retained for 1 year (in accordance with the contest terms), verification data deleted 30 days after the prize is paid out.

Summary: compliance checklist for your contest

• ☐ Clearly define age restrictions in the contest terms.
• ☐ Choose between declarative, hybrid or documentary depending on your legal risk and your budget.
• ☐ Assess the usefulness of a trusted third party to minimize your GDPR liability.
• ☐ Draft a privacy policy explaining age verification and participants' rights.
• ☐ Obtain explicit consents if collecting sensitive data (identity document, biometrics).
• ☐ Set up logs and an audit trail for each verification.
• ☐ Train your team on GDPR risks and compliance obligations.
• ☐ Test the user experience: ensure that the verification process does not abandon 30% of participants.
• ☐ Consult a lawyer specializing in GDPR if you accept minors or if you have a very large number of participants.