Collection of Personal Data Through Website Cookies, Forms, and Contest or Giveaway Campaigns

The marketing website uses tracking cookies and pixels by default on page load, collects personal data through lead-capture forms (name, email, phone, company), and periodically runs contests or giveaways on social media that require participants to submit personal details and follow/share requirements to enter.

1. Does the current cookie and form-based data collection meet DPDP's consent and transparency requirements?
2. What specific risks arise from contest and giveaway campaigns that collect personal data through third-party social platforms?
3. What is the compliant approach to consent management on marketing properties and campaigns?

Not compliant as currently structured.

Cookies firing before any consent interaction, and lead forms with no clear statement of purpose or downstream use, do not meet DPDP's requirement that consent be free, specific, informed, and given through clear affirmative action. Contest and giveaway mechanics that condition entry on data submission without transparent disclosure of how that data will subsequently be used compound the gap.

 

• Cookies set before consent is obtained — Tracking and analytics cookies loading automatically on page visit, ahead of any cookie banner interaction, means data collection has already occurred before the visitor had any opportunity to consent or decline.
• Lead forms with no purpose statement — Forms that collect name, email, phone, and company with no adjacent statement of what the data will be used for (sales follow-up, newsletter, event invites) leave the visitor unable to give genuinely informed consent to a specific processing purpose.
• Contest and giveaway data used beyond the campaign — Personal data collected through a giveaway is frequently absorbed into the general marketing database and used for ongoing campaigns well beyond the contest's conclusion, without the participant having agreed to that broader, continuing use.
• Data collected via third-party social platforms sits outside organisational control — Contests run through social media platforms rely on the platform's own data collection (comments, shares, follows) which the organisation cannot fully audit or control, while still using the resulting engagement data for its own marketing purposes.
   

1. Implement a consent-first cookie mechanism. Configure the website so that non-essential cookies (analytics, advertising, retargeting) do not fire until the visitor has made an affirmative choice through the cookie banner, with a genuine 'reject' option presented as prominently as 'accept'.
2. Add a clear purpose statement to every lead form. Every data-capture form should state, in plain language adjacent to the submit button, what the data will be used for and whether it will be used for anything beyond the immediate request.
3. Scope contest and giveaway consent explicitly. Contest entry terms should separately and explicitly ask whether the participant consents to being added to the ongoing marketing database, distinct from consent to participate in the contest itself, with the marketing add-on unchecked by default.
4. Document the specific data flow for social-platform-run campaigns. Before launching any contest run through a third-party social platform, document what data the organisation will extract from the platform and for what purpose, and ensure this is consistent with the platform's own terms and the organisation's privacy notice.

DPDP Risk Summary