Advent prize draw on your website: running it by the rules

An Advent calendar is quickly drawn on a website: a grid of fields, one date per field, one click opens the content. The real work lies elsewhere. Prizes have to be bought or requested from partners, the terms of entry need a version that marketing, management and, where in doubt, a lawyer have seen, and the form has to work together with the newsletter system, the privacy notice and the inbox for queries. Anyone who only starts in November builds under time pressure, and time pressure produces exactly the shortcuts that cause trouble later: terms as a PDF in the footer, a pre-ticked newsletter box, a draw without a record. The Advent campaign is only one part of the year-end business, and the article on preparing an online shop for Christmas describes the other stages.

On top of that, an Advent calendar usually mixes several types of promotion. Behind one door there is a discount code for a day, behind the next a recipe, behind the third a prize draw. Legally, these are different things with different rules. A discount is a sales promotion whose conditions for use must be easily accessible and stated clearly and unambiguously (Section 6(1) no. 3 DDG). A prize draw is a competition with its own requirements for recognisability and terms of entry (Section 6(1) no. 4 DDG). If the calendar shows reduced prices, the price indication rules explained in the article on strike-through prices and discount claims apply as well.

A prize draw turns into gambling when, within a game, a fee is charged for acquiring a chance of winning and the decision on the prize depends entirely or predominantly on chance (Section 3(1) GlüStV 2021). Public gambling may only be organised with a licence from the competent state authority (Section 4(1) GlüStV 2021). Such a licence is not a realistic option for a shop's Advent campaign. A draw with an entry fee, a premium-rate phone number or a ticket that has to be bought therefore has no place on the campaign page.

Linking entry to a purchase is trickier, for example “every order in December is entered into the draw”. Such a model is not inadmissible from the outset, but it calls for care in how it is presented: the purchase condition must be clearly visible before the order, product prices should not be raised for the campaign, because a surcharge can be seen as a fee for the chance of winning, and the terms of entry must state whether cancelled or returned orders count. The easiest campaign to assess remains one in which entry is possible without a purchase. If you also promote instalment payments during Advent, the new rules are covered in the article on instalments and buy on invoice, and why even entry into a prize draw in return for a review is delicate is explained in the article on Google reviews.

A second cost trap lies at the end of the campaign. If a business tells consumers that they have won a prize and makes receiving it depend on paying a sum of money or bearing costs, this is one of the commercial practices that are prohibited per se towards consumers (UWG Annex no. 31). Shipping fees, a handling charge or a premium-rate number for claiming the prize are therefore ruled out. Anyone shipping prizes plans the shipping as a cost of the campaign from the outset.

Advent calendars appeal to families and therefore also to children and teenagers. If an online service is offered directly to a child and processing is based on consent, it is lawful without parental agreement only once the child has reached the age of sixteen (Art. 8(1) GDPR). The regulation allows member states to set a lower age, which may not be below thirteen (Art. 8(1) GDPR). For newsletter consent collected through the campaign form this means: a minimum age in the terms of entry and an age confirmation in the form spare you the later question of whether consent was valid at all. Advertising that directly urges children to buy the advertised product or to persuade their parents to do so is prohibited towards consumers in any case (UWG Annex no. 28). Anyone raffling wine, spirits or other age-restricted goods aligns the minimum age with youth protection rules and checks it at handover; the article on age checks in online shops shows what that looks like in a shop.

The draw itself usually does not need consent. Processing of entry data is based on it being necessary for the performance of a contract to which the data subject is party (Art. 6(1)(b) GDPR), because without a name and a contact channel no winner can be notified. When collecting data in the form, the controller provides, among other things, its name and contact details, the purposes and the legal basis of the processing (Art. 13(1) GDPR). A separate privacy notice for the campaign that answers exactly these points for the draw is clearer than an additional paragraph in the general privacy policy.

After the campaign, the principle of storage limitation applies: personal data may be kept in a form that permits identification only for as long as is necessary for the purposes of processing (Art. 5(1)(e) GDPR). Once the prizes have been handed over and queries settled, the entry data is deleted. Whatever has to be kept as proof of the draw or for tax reasons goes into a separate, lean record. If a participant asks which data is stored, the answer is due without undue delay and at the latest within one month (Art. 12(3) GDPR). Only if requests are particularly complex or numerous can this period be extended by a further two months, and the participant must be told so within the first month (Art. 12(3) GDPR).

An Advent campaign that is reprogrammed every year is expensive and error-prone. A building block in the CMS that the editorial team fills with new content each year makes more sense. Grid, form and terms of entry are not maintained as free text but as fields: organiser, period, entry deadline per door, type of door, prizes and the version of the terms. From these fields the building block assembles the page, places the link to the terms at every form and switches the form off at the entry deadline. This way the team can edit content without accidentally removing the mandatory information.

One point is often overlooked: a door should open server-side on its date, in German time, and not merely be hidden in the browser by a script. If the content for every day is already in the page source, resourceful visitors can read the discount code for 20 December on the first day, and a draw is then no longer the same for everyone. The same applies to previews: the editorial team sees future doors through a protected preview link, the public only on the day itself. For shops, the same building block can be connected to the cart, for example so that a discount door applies its code directly; the service page shows how we build online shops.

Usability means that the doors are real buttons with understandable labels, reachable by keyboard, with sufficient contrast and a visible focus. A door that only reacts to a mouse movement shuts participants out. How to achieve this without the calendar losing its charm is part of our work on accessible websites. On a phone the grid may wrap, but the terms of entry must remain one tap away.

After the campaign the page stays online, with a note that the campaign has ended and the archived version of the terms of entry. This answers queries and keeps the address ready for next year, instead of deleting it in January and creating it again in November. For businesses with a physical store, the campaign page can also be combined with collection or handover on site, which on a website for retail is often the more natural route than shipping.