Who’s Responsible for What in a Loyalty Sweepstakes?

October 19, 2026 Arjit Mahendra

A typical promotional microsite has a pretty simple job: give someone a reason to enter, collect the entry, and pat them on the back to let them know it worked. Usually that means an on-screen confirmation, an email, or both.

Then loyalty gets involved. Now the promotion is talking to an existing customer ecosystem, potentially one with millions of members, like Marriott Bonvoy, United MileagePlus, Starbucks Rewards, or Target Circle. Accounts need to connect. Data needs to pass between systems. Entries need to be recorded. Emails need to fire. Suddenly that simple form has a few more moving parts under the hood. So what happens when someone links their loyalty account, enters the promotion, and then, poof.

Did the entry go through? Maybe. The confirmation email could be sitting in spam. It could have failed altogether. The loyalty account might have connected while the entry itself did not. Or the participant may have bailed before the last step.

To them, those scenarios can all look the same: Did this thing actually work? A well-planned loyalty sweepstakes should be able to answer the question. That means knowing which system is responsible for what, where the handoffs happen, what gets logged, and who is expected to investigate when something goes sideways.

Compliance in a loyalty sweepstakes depends on more than the official rules. It also depends on whether the systems, data, and administration behind the entry form work the way the rules and privacy notices describe.

RAVEN5 helps brands plan, build, and administer those pieces based on the scope of each program. Here are four areas worth sorting out before launch, rather than discovering them the hard way after someone starts contacting your help line.

When an account connection meets the entry form

A loyalty or membership promotion may depend on a system the sponsor already operates. The participant signs in directly on a custom promotional microsite or through the sponsor’s account system. This can let the sponsor retain control of its account and authentication process while the promotional experience is built for a specific campaign.

When the two systems need to talk, that usually happens through an API. To the participant, it feels instant. Behind the scenes, both systems are doing very different jobs.

That distinction matters because somebody has to decide what actually counts as an entry. Does connecting an account establish eligibility? Must the participant also submit a form? What information does the promotional site receive from the sponsor’s system, and what record confirms that an entry was created?

Consider the participant who never receives an email. The first useful check is the entry record. If the entry exists, the team can look into the message separately, including whether it was delivered or filtered. If there is no entry, the team needs to determine where the process stopped. A missing confirmation email does not, by itself, mean the entry is missing.

Privacy, data use and retention

Before launch, the teams should map what information moves between systems, why it is needed, who can access it, and how long it will be kept. An account identifier may contain less detail than a full account profile, but it can still relate to an identifiable person. Saying “we only use limited data” is a starting point. A field-by-field explanation gives the sponsor something it can actually review.

Privacy requirements depend on where a promotion runs and whose information it handles. In Canada, federal privacy guidance addresses purposes for collection, limiting collection, safeguards, and retention where applicable. In the U.S., applicable state privacy requirements may also affect what a promotion collects, shares, and keeps.

Hosting belongs in this discussion. RAVEN5 recommends building and managing the promotional microsite so their team can operate and support it directly. That arrangement does not remove the sponsor’s need to review an API connection to its own systems. The right approach depends on the campaign, the information exchanged, and the sponsor’s requirements. No hosting location makes a promotion automatically secure or compliant.

When the rules meet the live entry process

Official rules describe how a promotion is supposed to work. The live experience has to deliver on that description.

Suppose an advertisement says that connecting an account earns an entry, but the site requires one more step. A participant who stops after connecting may reasonably think they have entered. Separately, the rules may offer an alternative method of entry (AMOE). Those submissions may arrive and be stored separately from website entries. That can be a normal part of administering a promotion, provided the valid entries from each route are brought together and accounted for when the draw is prepared.

The team should test each route from start to finish. What does the participant see? What must they do? What record is created? Do entry limits and any bonus entries work as the rules describe? How will entries received through different methods be reviewed and included in the draw?

Entry methods and clear disclosures

For a chance-based sweepstakes, a purchase-related mechanism and any free route to participate require particular care. In its Publishers Clearing House action, the U.S. Federal Trade Commission alleged that online entry and shopping flows led consumers to believe a purchase was necessary or would improve their chances of winning. FTC guidance on digital advertising also explains that disclosures needed to prevent deception should be clear and conspicuous. The requirements for a particular promotion depend on its design and where it runs.

A link to the official rules cannot do all the work. Material conditions need to make sense where people see the offer and decide how to participate. The process behind the page must then record and administer entries consistently with those materials. An alternative entry method has to function throughout the program and be included in the draw process, not merely appear in the rules.

Within its agreed scope, RAVEN5 can help align the proposed mechanism, rules, site, and administration. Each should describe the same promotion, which sounds simple until four separate pieces have to agree on what “entered” means.

When participant information has more than one possible use

A promotion needs information to accept entries, contact potential winners, and award prizes. A sponsor may also want to build a marketing audience. Those goals may involve some of the same information, but they should not be treated as one purpose by default.

An email address may be needed to administer the sweepstakes and contact a participant about the program. Using it for future marketing is a separate question that should be addressed in the participant experience and reviewed against applicable requirements. If connecting an account takes a participant away from the promotional site, the teams should also decide what explanation appears before they leave and what happens when they return.

The practical questions are specific: Which organization collects each field? Who receives it afterward? Who approves the privacy and marketing language? How is a participant’s choice recorded? Does a later transfer to a CRM or another provider match what the participant was told?

These decisions affect the form, the data flow, and the agreement between the parties. A checkbox can record a choice. It cannot make an unclear purpose clear after the fact.

The review may also cover newer tools. If a sponsor wants restrictions on using participant information with AI tools or for model training, those restrictions should be stated explicitly and checked against the actual workflow. That is a data-use decision to make while planning the program.

When the promotion needs an answer

Most participants will enter and never need to ask what happened. The program still needs a way to answer the ones who do.

Return to the participant without a confirmation email. An administrator should be able to check whether an entry was recorded and, where appropriate, investigate the status of the message. The answer might be as straightforward as “your entry is recorded; please check your spam folder.” It could also reveal a step in the entry flow that needs attention.

Other questions may arise later. A selected participant might not meet an eligibility condition. A qualifying action may be reversed. A potential winner may not respond within the period stated in the rules. Each situation needs an applicable rule, records that help establish what happened, and someone responsible for making and communicating the decision.

Winner verification and record retention

The work continues after entries close. Depending on the program, administration may include combining entries from different permitted routes and reviewing the draw records. It may also include verifying potential winners, handling notifications and fulfillment, and answering questions. Other tasks may include retaining records in line with applicable obligations and the agreement. There is no single retention period that fits every promotion.

This is why “compliance handled” is too vague a line in a proposal. A sponsor should be able to see what its promotion partner will administer, what the sponsor must supply or approve, and how questions about the program will be investigated and documented.

Plan how the pieces work together

These operational questions belong in the scope and agreement. The parties may need to address system ownership, permitted data use, access, support, incident response, subcontractors, insurance, and how third-party claims will be handled. The commitments should match the services each party actually provides and the systems each one controls.

This is also where established frameworks can help. NIST, the U.S. agency behind widely used cybersecurity and risk-management guidance, recommends clearly defining responsibilities with suppliers and addressing relevant security requirements in agreements. It is not a checklist for running a sweepstakes, but the principle applies: everyone involved should know what they own before something goes wrong.

That plan should be reviewed for each new campaign. The sponsor may change its loyalty platform. A new promotion may use a different entry method or collect different information. Approval requirements and security practices may change as well. Experience from the last launch helps, but it does not answer every question for the next one.

The participant should not need to understand all of this. They should be able to enter, understand the offer, and get a clear answer if they have a question. RAVEN5’s role is to help brands connect the rules, technology, and administration behind that experience so the promotion works as intended.

The entry form is the part everyone sees. The planning behind it is what lets the team answer the much less glamorous question later: What actually happened?

Planning a sweepstakes that connects to customer accounts, purchase data, or other systems? Talk to RAVEN5 about the entry flow, data requirements, and administration before launch.

This article outlines questions to consider when planning a promotion. The specific responsibilities and commitments for any program are set out in its signed agreement.

Further reading from RAVEN5

Arjit Mahendra, Oakville, ON, October 2026