Most giveaway advice assumes your entrant is an adult. As soon as children can enter yours, that assumption breaks in two places. A child can’t legally agree to your official rules, and in most countries you can’t collect their personal details without asking a parent first.

Brands usually find this out after launch. The campaign goes live, a nine-year-old wins, and someone in legal asks who exactly agreed to the terms.

This guide covers the one decision everything else hangs on, what US and European law actually require, the simple habit that removes most of the risk, and how to run the draw so the result holds up in front of a room full of parents.

Nothing here is legal advice. Rules vary by country and by state, and they change. If your campaign is large, crosses borders, or is aimed directly at children, have a lawyer read your official rules before launch.

The decision that shapes everything else

Before the prize, before the mechanics, answer one question: is the entrant the child, or the parent?

Almost every problem that shows up later starts with leaving this vague.

Parent enters on behalf of the child. The adult agrees to the rules, gives their own contact details, and receives the prize. The child gets the prize but isn’t the entrant. This is the simpler setup, and it’s what most brands running family campaigns choose. You’re collecting adult data, so most of the child-specific rules in COPPA and the GDPR stop applying.

Child enters directly. Now you’re collecting a minor’s personal details and asking someone who can’t legally agree to a contract to accept your terms. It can be done, and sometimes it’s the whole point, since a drawing contest where children submit the entries can’t work any other way. But it’s more work to stay compliant, and you want to plan for that rather than find out later.

If the campaign works with the parent as entrant, do it that way. Only let children enter directly when their taking part is the point of the campaign.

United States: COPPA and the under-13 line 🇺🇸

The Children’s Online Privacy Protection Act covers personal information collected online from children under 13. If your promotion is aimed at children, or you know an under-13 is giving you data, COPPA applies.

“Personal information” is broader than people expect. It covers full name, email address, phone number, mailing address, photos and videos of the child, and persistent identifiers like cookies and device IDs.

COPPA requires verifiable parental consent before you collect any of it. That means a real check, not a box that says “I am over 13.” A signed consent form, a payment-card check, or a phone or video call with the parent all count. The bar is high enough that most brands don’t try, and set a minimum entry age of 13 instead, stated plainly in the rules.

Two exceptions are worth knowing:

The one-time contact exception. You can collect a child’s email address just to tell them they won, as long as you don’t contact them again or use it for anything else, and you delete it soon after.

Collect late. Nothing says you have to gather personal details at entry. Take the bare minimum up front, pick the winner, then collect full details from that one person through their parent. That one change removes most of your risk, because data you never collected can’t be leaked, lost, or misused. It’s the most useful habit in this guide and the one almost nobody follows.

A promotion doesn’t have to be aimed at children to fall under COPPA. If the subject matter, visuals, music, or influencers make it child-directed in practice, the rules apply whoever you meant to reach.

United States: ages 13 to 17 🇺🇸

Above 13 the data problem gets smaller and a contract problem takes its place.

Minors generally can’t sign binding agreements, and a set of official rules is a binding agreement. A 15-year-old who accepts your terms hasn’t really accepted anything, which leaves your liability release, your publicity rights, and your dispute clauses standing on nothing.

Two answers work:

1. Set the minimum entry age at 18. Simplest, and the reason most sweepstakes do it.
2. Allow 13 to 17, with a parent or guardian agreeing to the rules and claiming the prize. The parent’s agreement is the one that counts. Put it in the rules and build the claim process around it, so you actually collect that consent when the prize is claimed instead of assuming you have it.

Most of the old state laws restricting minors from sweepstakes are gone, so 13+ entry generally works in the US. The contract problem is what’s left.

Europe: GDPR sets a floor, not a number 🇪🇺

GDPR Article 8 sets the age at which a child can consent to an online service at 16, but each member state may lower it to no less than 13. The same campaign can be legal for a 14-year-old in Vienna and not for the same 14-year-old in Berlin.

Below the local age you need consent from whoever holds parental responsibility, normally a parent or guardian, and you have to make a reasonable effort to check that the consent is real.

Roughly where the limits sit:

Age	Countries
16	Germany, Netherlands, Hungary, Lithuania, Luxembourg, Slovakia
15	France, Czech Republic, Greece, Portugal
14	Austria, Italy, Spain, Bulgaria, Cyprus
13	Ireland, Denmark, Sweden, Poland, Belgium, Finland, Latvia, Estonia, Malta, UK

Treat that as a starting point, not an authority. National laws have been amended since 2018 and published lists contradict each other. Two sources we checked while writing this put the Czech Republic at 13, when Act No. 110/2019 Coll. sets it at 15. Check the age for every country you’re actually running in.

Running one campaign in several countries? You have two options. Set the minimum entry age at the highest age on your list, and 16 covers every member state. Or restrict entry by country and run different rules in each market, which is rarely worth the work unless the campaign is big.

The rest of the GDPR still applies on top of the age question. You need a lawful basis for using the data, a clear purpose, a retention period, and a privacy notice a parent can actually read. Our guide to GDPR-compliant giveaways covers those in full. Collecting late helps here too, for the same reason.

Prizes have their own age rules

The entrant’s age isn’t the only limit. The prize sets one of its own.

Alcohol, tobacco, lottery products, and gambling credit are out. Travel usually needs an adult, because someone has to sign for it. Cash and gift cards that work like cash can trigger tax reporting a minor can’t deal with. Anything with a liability waiver, so events, experiences, and sports activities, needs a parent’s signature whatever the entrant’s age.

Check the prize is suitable as well as legal. A year’s supply of energy drinks is a bad prize for a children’s campaign even where nothing forbids it.

What to put in your official rules

Rules protect you more than they protect entrants. When someone questions the result, the rules are your written answer. This page covers the age and consent parts; for everything else a promotion needs, see our guide to writing giveaway rules. If minors might enter, cover:

• Minimum entry age, as a number, on the entry form and not only in the terms
• Who the entrant is – the child, or the parent or guardian entering for them
• How you get parental consent, and at what point
• Who receives the prize, which for minors should be the parent or guardian
• What data you collect, when, and how long you keep it
• Publicity – whether you can name or photograph a winning child, and who agrees to that
• Entry period, number of winners, and how you pick them
• The response deadline and what happens if a winner doesn’t reply

On publicity, ask the parent directly before you name or show a child, and keep that separate from the box they tick to accept the rules. Default to a first name and an initial rather than a full name.

Running the draw so the result holds up

Campaigns involving children have an audience of parents, and parents talk to each other. School communities, sports clubs, and parenting groups are small and closely connected. If the winner looks like a friend of the brand, or the announcement is just a name in a caption with no explanation, that travels further than the campaign did.

What makes a draw hold up:

1. Publish the rules before entry opens. Dated, and don’t change them afterward.
2. Freeze the entry list when entry closes. The list you draw from has to be the list you can show later.
3. Use a method you can explain. “We picked randomly” proves nothing. A giveaway tool that leaves a record of the entry list, the time it ran, and who won does.
4. Pick alternates at the same time as the winner. Children miss notifications and parents miss emails, so you will need backups. Picking them later, once you know who said no, is exactly what looks arranged.
5. Publish the result where entrants can check it themselves. That ends the argument before it starts.

Point 2 pairs well with collecting late. Run the draw on entry IDs instead of names, and the record you can show contains no child’s personal data at all. Then collect details from the one winner, through their parent.

RandomPicker creates that record for you. Every draw produces a result you can share with participants, tying the entry list, the time it ran, and the outcome together. The free plan covers draws up to 100 entries, and there’s a free non-profit plan up to 100,000 entries for schools, PTAs, and charities. Trusted by 100,000+ organizers since 2009.

Where this comes up

The age question isn’t seasonal. It comes with the type of campaign you’re running.

Back-to-school promotions. Parents are buying against a deadline and students are the visible audience, so entries come from both. Supply bundles, tech giveaways, and classroom or teacher-nomination draws all sit here. Run them with the parent as entrant and most of the problem disappears. For picking a student or a name inside a classroom rather than running a public promotion, a random name picker is the simpler tool.

Toy, game, and children’s media launches. Almost always child-directed in COPPA’s sense, whoever you meant to reach. Assume the rules apply.

Sports clubs and youth teams. Raffles run by or for a youth club have the parent as the real entrant. There’s often a nonprofit angle too, which can change which plan you need.

School and PTA fundraisers. These add a layer, because many districts restrict commercial promotions aimed at students on school property or through school channels. Check before you announce anything.

Family and holiday campaigns. Christmas, Easter, and summer promotions pull in children even when the marketing is aimed at adults. Set the entry age on purpose rather than by accident.

Creator and influencer giveaways. The riskiest of the lot. The audience skews young, and entry is usually a comment or a follow collected before anyone has thought about age. If your following includes minors, so does your giveaway.

After the draw

Tell the winner privately first, through the parent if they’re a minor, and give them a deadline to reply – three to five days is normal. Announce it publicly only once they’ve confirmed, and link to the draw record so entrants can check it themselves.

Collect the winner’s details now, not earlier, and only what you need to send the prize. Delete what you took from everyone else once the campaign closes and your retention period runs out. Ask separately about publicity before you post a photo or a name.

Then go back to the people who didn’t win. They put their hand up and told you what they want. An offer sent within a week of the draw does better than the same offer sent cold two months later.

Common questions

Can children enter our giveaway? It depends on their age and your country. In the US, taking personal information from under-13s triggers COPPA and its verifiable parental consent rule, so most brands set a 13 or 18 minimum instead. In Europe the GDPR default is 16, and member states can lower it to 13, so Germany is 16 while Ireland is 13. Below the local age, a parent or guardian has to consent. For anyone under 18, the simplest setup is the parent entering and claiming for the child.

We’re running one campaign across several European countries. What age do we set? Set it at the highest age on your list, so 16 covers every member state. The alternative is separate rules per country and entry restricted by location, which is rarely worth it unless the campaign is big. Going 18+ avoids the question completely.

Can we just add “you must be 18” and stop worrying? It helps, but it won’t save you if the campaign is obviously aimed at children. Regulators look at who the audience really is, including the subject matter, the visuals, and the influencers involved, not only what the terms say. An age gate on a toy giveaway won’t hold.

Do we need official rules for a small giveaway? Yes. They set who can enter, define the entry period, and give you a written answer when someone questions the result. Short and clear is enough for most campaigns.

Can we post a photo of the child who won? Only if the parent has agreed to it, asked separately from accepting the rules. Use a first name and last initial by default. Some parents will say no, so don’t build the announcement around a photo you might not get.

How do we prove the draw was fair? Freeze the entry list when entry closes, use a giveaway picker that leaves a record, and publish that record where entrants can see it. The proof has to be something a participant can check without taking your word for it.

What if the winner never responds? Put the reply deadline in the rules before launch, and pick alternates at the same time as the winner. Then you’re following a published process instead of deciding after the fact. It matters more here than usual, because children miss emails all the time.