CAP: naming prize winners and marketing to children

When is it necessary to obtain the consent of a parent or guardian to use a child’s data for marketing? What process should be adopted in terms and conditions for announcing winners of competitions and prize draws?

The background

In November 2018 the Committee of Advertising Practice (CAP) opened a public consultation on proposed changes to rules 10.16 (Marketing to children) and 8.28.5 (Naming prize winners) of the CAP Code. These changes were aimed at bringing the Code in line with the Data Protection Act 2018 (DPA).

Marketing to children: Rule 10.16

Under the original wording of rule 10.16, marketers were banned from collecting the personal data of children under 12 unless they had obtained the verifiable consent of the parent or guardian. Under the DPA, the UK derogated from Article 8 of the General Data Protection Regulations (GDPR) and set the relevant age at 13. This resulted in inconsistency between the age at which consent could be given by a child under the DPA and under the CAP Code. CAP sought to address this by amending rule 10.16.

CAP didn’t receive any responses to their proposals on marketing to children. In March 2019 they brought the following changes into effect:

• the age at which children can provide consent to the use of their data for online services was increased to 13
• if a child is younger than 13, online service providers have to obtain the verifiable consent of the parent or guardian
• for other marketing purposes (ie not in relation to online services), marketers have to have “compelling reasons” to rely on a child’s consent (rather than a parent or guardian) and have to give “particular regard to the child’s privacy rights”. What CAP actually means by “compelling reasons” remains to be seen.

Naming prize winners: Rule 8.28.5

The original wording of rule 8.28.5 required that promoters obtained consent from competition entrants so that they could publish the name and county of major prize winners. However, CAP considered this to be incompatible with consent under the GDPR. First, consent is now withdrawable at any time and has to be as easy to withdraw as to give. This presents difficulties when information is published but consent is subsequently withdrawn. Secondly, requiring entrants to give their consent to enter the competition is likely to be viewed as a condition of service and therefore not freely given. CAP proposed changes to Rule 8.28.5 to bring the wording in line with processing for legitimate interests under the GDPR. 

CAP received three objections to their proposals on prize winner announcements. In March 2019, they brought the following changes into effect:

• promoters are required to publish the surname (rather than full name) and county of major prize winners
• prize winners must be given the opportunity to object before their information is published (instead of being asked for their consent at entry). In such circumstances, they must still provide the information and winning entry to the ASA if challenged
• the privacy of winners cannot be prejudiced by publishing their personal information. So if it is likely that the winner can be identified from their surname and county, then their information should not be published.

Why is this important?

Standardising the age of consent under the CAP Code and the DPA is helpful for online businesses. It provides clarity on the age limits they should use in in their policies. However, the meaning of “compelling reason for relying on the child’s consent” and “particular regard to the child’s privacy rights” is not particularly clear. This leaves non-online marketers with uncertainty as to how the new rule should be interpreted.

The change to the rules on prize promotions should leave promoters in a situation where they are more likely to comply with data protection law. This is a welcome step, even if assessing when a surname and county will identify someone may not always be easy.

Any practical tips?

Businesses should tread carefully whenever collecting children’s data (whether online or non-online). Their online terms should reflect the increased age threshold of 13 and careful consideration should be given as to how to practically enable a parent or guardian to give verifiable consent for any child under the age of 13. Although the new rules suggest that parental or guardian consent may not be needed in non-online situations where there are “compelling reasons” not to obtain it, judging this will be hard. It follows that the safest course must still be to obtain such consent, at least until such time as CAP clarifies the position.

Make sure you change your precedent competition and prize draw terms to reflect the fact that publication of prize winner information must now be limited to surname and county, and do remember to check with prize winners to give them a chance to object to the publication. And finally, look out for more unique names or winners from smaller counties (or Scottish islands!) where publication of even a surname may reveal their identity. Don’t publish if so!