Giveaway Rules Builder

A giveaway feels like a friendly gesture. You post a picture, ask people to comment, and pick someone on Friday. In law it is usually a promotion, and promotions come with rules that change from one border to the next.

A giveaway is a promotion, and promotions have law

Start with the United States, where the Federal Trade Commission tells consumers that real sweepstakes are free and decided by chance, and that it is illegal to ask people to pay or buy something to enter or to improve their odds. That one sentence carries most of the weight in this area. The same page adds that a skills contest, where people solve problems or answer questions to earn a prize, can ask for payment. So the first decision is not about the prize at all. It is whether the winner is chosen by luck or by judging, and whether money changes hands anywhere on the way in.

Federal law also says what a complete set of sweepstakes rules looks like, at least for entries that travel by post. Under 39 U.S.C. 3001(k), mailed entry material must state, in the mailing, the rules and the entry form, that no purchase is necessary and that a purchase will not improve the chance of winning. It must give all the terms, name the sponsor with an address, and state the estimated odds and the quantity, estimated retail value and nature of each prize. Even if you never mail anything, that list is a good test of whether your own rules leave something out.

States add their own layers. Florida’s statute on game promotions applies when a promotion is tied to selling consumer products or services and the prizes have a total announced value of more than 5,000 US dollars. The operator must file the rules and a list of prizes with the state Department of Agriculture and Consumer Services at least 7 days before it starts, and hold a trust account or a surety bond for the full prize value. Afterwards comes a certified list of everyone who won a prize worth more than 25 dollars. The same section makes it unlawful to require an entry fee or proof of purchase, or to remove or disqualify an entry arbitrarily.

Canada approaches it through competition law. Section 74.06 of the Competition Act treats a promotional contest as reviewable conduct when the number and approximate value of the prizes, the regions they apply to, and any known fact that materially affects the chances are not fairly disclosed. It also covers prizes that are unduly delayed, and winners who are not chosen by skill or at random within each region.

In England, Wales and Scotland the question is often whether a draw has become a lottery. Schedule 2 of the Gambling Act 2005 says an arrangement is not treated as requiring payment if everyone eligible can choose to enter instead by ordinary post, or by another route that is no more expensive and no less convenient. That choice has to be publicised, and prizes cannot be allocated differently between the two routes. Paying to find out whether you won, or to take a prize, counts as paying to enter.

None of this is legal advice, and four places are examples, not a map. Registration, bonding, age limits and tax on prizes all vary. The useful habit is to write down every decision and take the list to someone who knows the law where you run the giveaway.

Write the decisions down before anyone enters

The questions are plain once they are in one place. Who runs it, under which legal name, and how can people reach them? Who can enter, with a minimum age, a place of residence and a list of people excluded, such as staff? When does it open and close, and in which time zone? How does someone enter, is there a free way in if a purchase is one route, and how many entries may one person have? What is the prize, and how many are there? How and when are winners chosen and told, and what happens if a winner never answers?

Social posts raise one more question. The FTC’s answers on its Endorsement Guides deal with promotions where entrants post with a tag. A slogan tag does not tell readers that a post was made for a chance at a prize. Putting the word “contest” or “sweepstakes” in the tag should be enough, the FTC says, while “sweeps” probably is not, and entrants should be told to put it where readers will see it, such as the start of the post.

A draft assembled from those answers is not “official rules”. It is your decisions written as sentences, with every blank marked as open. That is exactly what a reviewer needs, because a gap is visible instead of hidden behind confident boilerplate.

Fairness is something you can demonstrate

Most arguments about giveaways are not about law. They are about trust. Did the organiser pick a friend, or quietly drop someone who complained? A fair draw that nobody can check looks, from the outside, exactly like an unfair one. Canada’s rule asks for winners chosen at random, but random by whose account?

The answer is a draw someone else can repeat, and the method is called commit, then reveal. First you freeze the entry list and compute its SHA-256 fingerprint, the hash function defined in NIST’s Secure Hash Standard. It is 64 hex digits long, and changing a single name or ticket count produces a completely different one. You publish that fingerprint before the draw, so the list cannot quietly change afterwards. Then you wait for a seed that nobody involved controls: a value someone else will publish at a time fixed in advance. The winners follow from the fingerprint and the seed by a fixed rule. Anyone with the list, the seed and the rule gets the same names.

Be clear about what that proves. It proves the winners follow from the published list and the announced seed. It does not prove the list was complete, or that nobody was removed before it was frozen. So decide disqualifications first and keep each reason. Florida’s ban on arbitrary disqualification is one good reason to have them written down.

When nobody needs to repeat the draw, a plain secure draw is enough. Browsers provide cryptographically strong random values through the W3C Web Cryptography interface, and that is the right source.

Modulo bias, the classic way to cheat by accident

The usual code for picking a winner takes a random number and keeps the remainder after dividing by the length of the list. The Wikipedia article on the Fisher-Yates shuffle explains the flaw. If the generator’s range is not a whole multiple of the list size, the leftover part of the range favours the small remainders. Take random bytes from 0 to 255 and a list of 100 people. Two full hundreds fit into 256, with 56 left over. The remainders 0 to 55 can each be reached three ways, the remainders 56 to 99 only two. The first 56 people on the list are 1.5 times as likely to win as the other 44, and nobody meant it.

The fix is rejection sampling: throw away any number that falls in the incomplete top part of the range and draw again. With 32-bit numbers the discarded slice is tiny for a list of a few thousand, so retries are rare, but the result is exactly even. The tool’s picks were checked with a chi-square test over 200,000 simulated draws for six list sizes, against critical values from the NIST/SEMATECH handbook. A deliberately biased version, run on a list size built to expose it, failed the same test by a factor of about 400.

Here is a worked example you can repeat on the page. It loads with twelve rows. Row five is the same person as row one, typed with a lower-case letter, so the two merge and keep the larger count of two tickets. Row ten is disqualified for entering after the close, and its reason is kept. That leaves ten people holding 18 tickets.

Entrant 11 has four of them, so their chance of first place is 4 in 18, or 22.2%. The frozen list’s fingerprint begins 8afbb363. With the seed “example public value 4821-7730”, the winners are Entrant 04 and Entrant 10, and the alternates are Entrant 05 and Entrant 11. Change the last digit of the seed to 1 and the first winner becomes Entrant 02. That is why the seed must be out of the organiser’s hands.

One prize per person changes the arithmetic after the first place. Once a person wins, all their tickets leave the drum, so every later place is drawn from fewer tickets. The odds shown for first place are only the first place.

When it is over, delete the list

An entry list is other people’s personal data: names, handles, sometimes email addresses. The UK Information Commissioner’s Office says personal data must not be kept longer than it is needed, and should be erased or anonymised once it is not. Keep the draw record, which holds names and ticket counts without contacts, for as long as you might be asked about the result. Delete the contact details once the prizes have arrived.

The tool cannot tell you whether your giveaway is legal where you run it. It checks the format of an email address, not whether the address exists. Its merge rule is a matching rule, not proof that two rows are one person. And it cannot prove that the list you froze was honest.

Draft, decide, freeze, publish, draw, verify, delete. None of these steps is hard. Skipping one is how a friendly giveaway turns into an argument.