When you type your name and email into an entry form, you're agreeing to two documents, not one. The official rules govern the prize. The privacy policy governs you — what the sponsor collects, who they share it with, and how long they keep it. Most entrants never open the second link, which is exactly why sponsors put the real terms there. Here's what that fine print actually permits, and how to give up less.
The consent you click is broader than you think
A typical sweepstakes privacy policy lets the sponsor collect your name, email, mailing address, and IP address — and often lets them share it with "partners," "affiliates," and "third parties" whose names never appear on the entry page. That's legal in the US as long as the policy discloses it. Read the sharing clause specifically: "we may share your information with select partners for marketing purposes" means your address is a product, and entering was the sale. Sweepstakes run by lead-generation companies exist for this reason — the prize is bait, the mailing list is the business.
Watch for the pre-checked marketing box and the "by entering you agree to receive emails from us and our sponsors" line, which are two different things. Under CAN-SPAM, a sponsor can email you as long as every message has a working unsubscribe link and a physical postal address, and honors your opt-out within 10 business days. But CAN-SPAM does not require prior consent — so "I never signed up for this" isn't a violation on its own if you entered a giveaway that disclosed it. The disclosure was the consent.
Your rights let you claw a lot of it back
If you're in California, the CCPA/CPRA gives you real leverage: the right to know what a business collected, the right to delete it, and the right to opt out of the "sale" or sharing of your personal information — including the partner-sharing described above. Look for a "Do Not Sell or Share My Personal Information" link, which covered businesses are required to post; submitting it cuts off the downstream data flow, not just the emails. Virginia, Colorado, Connecticut, Texas, and a dozen other states now have similar laws, so these rights increasingly apply well beyond California.
Deletion requests are the strongest tool. Email the sponsor's privacy contact (listed in the policy), state that you're exercising your right to deletion, and they generally must comply within 45 days. Separately, unsubscribing kills the emails but not the stored record — so do both if you want out completely. And remember these rights bind the sponsor; once your data reached a third party, you may have to chase that company on its own.
Enter clean and give up less up front
The cheapest privacy protection is limiting what you hand over in the first place. Use a dedicated giveaway email address (or a plus-alias like you+sweeps@gmail.com) so you can filter, and later nuke, everything tied to entering. Never provide more than the form strictly requires — if a field for your phone number or birthday isn't marked mandatory, leave it blank, because a phone number opens the door to text marketing under different rules.
Before you submit, do a 30-second check: open the privacy policy, search the page for the words "share," "partners," and "sell," and skip any giveaway whose answer is a wall of vague permissions with no opt-out. A legitimate brand running its own promotion collects little and shares less; a data broker's giveaway reads like a permission slip for everyone.
Enter with a throwaway address, opt out of sharing, and treat every entry form as a contract — because it is.