You're designing a loyalty program, referral campaign, or promotional sweepstakes. Marketing wants to collect purchase history. Product wants device identifiers. Sales wants email addresses for follow-up. Before you build the signup form, you need to answer one question: does this data collection trigger privacy compliance obligations?
The answer determines whether you need legal review, parental consent mechanisms, state-specific opt-out flows, or disclosure language that goes beyond "see our privacy policy." Here's how to make that decision.
The Decision You're Facing
You're collecting personal information through a promotional activity. That could be a points program, a contest, a referral bonus, or a discount code campaign. The question isn't whether you're collecting data, you know you are. The question is: which compliance obligations apply, and what does that mean for your program design?
This isn't a yes/no decision. It's a branching tree where each answer changes your requirements.
Key Factors That Affect Your Choice
Three factors drive your compliance path:
Who you're collecting from. Are participants under 13? If yes, the Children's Online Privacy Protection Rule (COPPA) applies. That means verifiable parental consent before you collect, use, or disclose any personal information from a child. A gaming company running a rewards program and a food brand running a kid-friendly sweepstakes both hit this threshold. You'll need age-gating, consent flows, and direct notice to parents, not just a checkbox.
How you'll use the data. Are you sending promotional emails or text messages? The CAN-SPAM Act governs email communications, requiring clear opt-out mechanisms and accurate sender information. The Telephone Consumer Protection Act (TCPA) is stricter: you need prior express written consent before sending marketing texts. A restaurant texting discount codes to app users without that consent exposes itself to statutory penalties per message. If you're using contact information for prize fulfillment only, your obligations are lighter. If you're using it for ongoing marketing, they're not.
Where your participants live. Nineteen states have enacted their own data privacy laws. If you're collecting information online from consumers in California, Virginia, Colorado, Connecticut, or any of the other states with comprehensive privacy legislation, you may need to provide specific opt-out rights, honor Data Subject Access Requests, and include state-specific disclosure language. A retailer running a national loyalty program can't use a one-size-fits-all privacy notice.
Path A: Promotional Activity with Adult Participants, No Ongoing Marketing
When to choose this path:
You're collecting information solely for contest entry, rebate fulfillment, or one-time participation. You're not targeting children. You're not planning to send marketing messages afterward.
What you need:
- A clear, conspicuous privacy disclosure at the point of collection explaining what information you're collecting and why
- A commitment to honor that disclosure; under Section 5 of the FTC Act, the Federal Trade Commission can bring enforcement actions against businesses that don't honor their privacy promises
- If you're collecting information in exchange for reviews or social media posts, explicit disclosure of that incentive (a generic hashtag or buried fine print won't meet the standard)
- State-specific compliance checks if your program operates in states with comprehensive privacy laws
What you don't need:
Parental consent mechanisms, opt-out flows for marketing communications, or prior express written consent for texts.
The risk:
Scope creep. If marketing later decides to use that contact list for promotional emails, you've moved into Path B without updating your disclosures or consent mechanisms.
Path B: Loyalty Program with Ongoing Communications
When to choose this path:
You're running a points-based program, a referral campaign, or any promotional activity that involves repeated contact with participants. You're collecting purchase history, behavioral data, or device identifiers. You plan to send promotional emails, app notifications, or text messages.
What you need:
Everything from Path A, plus:
- Opt-out mechanisms that comply with CAN-SPAM Act requirements if you're sending emails (clear unsubscribe links, accurate sender information, honoring opt-outs within 10 business days)
- Prior express written consent before sending marketing texts, meeting TCPA standards (that means a signature, electronic or otherwise, obtained after clear disclosure of what you're consenting to)
- State-specific opt-out rights if you're operating in states with privacy laws that require them
- A process for handling Data Subject Access Requests if your program collects data from residents of states with such requirements
- Regular review of your privacy notice to ensure it accurately reflects how you're using the data; deviating from your stated practices is an enforcement risk
What changes:
Your disclosure language needs to be more detailed. You're not just explaining what you collect; you're explaining how you'll use it, how often you'll contact participants, and how they can opt out. Your program mechanics may need adjustment based on state law variations.
The risk:
Multi-state programs create compliance complexity. Required disclosure language, opt-out rights, and even program mechanics can differ based on where your customers live.
Path C: Programs Targeting or Accessible to Children Under 13
When to choose this path:
Your promotional activity is directed at children, or you have actual knowledge that participants are under 13. This applies even if the activity "inadvertently" collects information from children, a sports betting app running an advertising campaign that attracts middle schoolers who like sports still triggers COPPA.
What you need:
Everything from Path A or B (depending on your use case), plus:
- Verifiable parental consent before collecting, using, or disclosing personal information from children
- Direct notice to parents about your information practices
- Age-gating mechanisms to prevent children from participating without consent
- A process for parents to review, delete, or refuse further collection of their child's information
- Careful review of what constitutes "personal information" under COPPA (it's broader than you think; persistent identifiers like device IDs count)
What changes:
Your entire signup flow. You can't collect first and verify later. Parental consent comes before data collection. That means email verification, credit card transactions, video conferencing, or another FTC-approved method.
The risk:
COPPA violations carry significant penalties and reputational damage. If your program could attract children, design for compliance from the start.
Summary Matrix
| Factor | Path A | Path B | Path C |
|---|---|---|---|
| Target audience | Adults only | Adults, ongoing contact | Children under 13 or mixed |
| Data use | One-time participation | Marketing communications | Any collection from children |
| Consent requirement | Privacy disclosure at collection | Disclosure + TCPA consent for texts | Verifiable parental consent |
| Opt-out mechanism | Not required for one-time use | Required (CAN-SPAM/TCPA) | Required + parental control |
| State law complexity | Moderate | High | High |
| FTC enforcement risk | Moderate if disclosure violated | High if consent/opt-out violated | Very high |
What This Means for Your Next Program
Before you launch, map your program against these decision points. Don't wait until after you've collected data to figure out which path you're on. Marketing's request for "just basic contact information" might trigger TCPA obligations if you're planning to text participants. Product's request for device identifiers might trigger COPPA if your app appeals to kids.
Getting ahead of these issues during program design is far easier than retrofitting compliance after launch. And remember: your privacy disclosure isn't marketing language. It's a legal commitment. The Federal Trade Commission treats it that way. So should you.
