Data protection, age limits and prize reporting for contest entries in the Netherlands
Contest data protection in the Netherlands rests on three published rules. Consent must cover one specific processing activity and one specific purpose, the Autoriteit Persoonsgegevens states. Minors enter a promotional game of chance only with parental permission, the Kansspelautoriteit's Gedragscode promotionele kansspelen requires. Joining a lottery, lotto or promotional game of chance over the internet does not count as an online game of chance for tax purposes, the Belastingdienst answers. Together these decide what an organiser is allowed to ask of an entrant, at what age an entry becomes valid, and how a prize is treated at tax time. This page assembles those rules into one checklist, answers the six questions entrants raise most often, and marks the spots where no official source names a fixed figure.
Last confirmed against the sources on 8 October 2026.
Specific consent governs every use of an entrant's personal data.
The Autoriteit Persoonsgegevens is unambiguous: consent must always cover a specific processing activity and a specific purpose. Written into a contest form, that kills the old habit of one long checkbox ticking entry, newsletter, partner offers and profiling in a single stroke. Each purpose stands alone.
For an entrant this means the form should separate what happens to the email address used for the entry from what happens after the winner is drawn. Contacting you about the prize needs one permission. Sending you offers needs another. Sharing details with a sponsor needs a third.
The rule also works backwards. Permission given for one purpose does not silently stretch to a new one, so an organiser that wants to reuse last season's entry list for a fresh campaign needs fresh consent for it.
- An entry form asks separately for permission to process the entry and to send a newsletter.
- A sponsor's name appears in the rules together with its own stated use of entrant details.
- An entrant withdraws consent for marketing and the organiser keeps only what the contest itself required.
Minors enter promotional games of chance only with parental consent.
The Gedragscode promotionele kansspelen puts the obligation on the organiser: it must set parental consent as a condition of a minor's participation in a promotional game of chance. The code does not print a single nationwide age number for every contest; it makes the parent's permission the gate.
In practice an organiser working under this code asks for an age statement on the form and, where the entry comes from someone underage, requires a parent's permission before the entry counts. Organisers publish this in their conditions, and the condition is theirs to enforce.
Note the scope. The Gedragscode governs promotional games of chance, the prize-draw category, not every competition on the internet. A pure skill contest without a chance element sits under different rules, which is why the age question is always answered by the specific organiser's own published conditions.
- A prize draw's conditions state that entries from under-eighteens require a parent's permission.
- A contest form asks for a birth year before accepting the entry.
- An organiser deletes entries from minors whose parental permission never arrived.
Prize taxation depends on how the winning entry was cast.
The Belastingdienst addresses the question directly on its prize pages: joining a lottery, lotto or promotional game of chance via the internet is not classified as an online game of chance for the tax rules in question. The distinction sounds technical and it decides real money.
Because internet participation in those categories is carved out, the treatment of a prize won through such an entry follows the rules for that category rather than the rules for online games of chance. The organiser's prize communication is where an entrant reads which category their contest sat in.
This page prints no thresholds and no percentages, because the Belastingdienst keeps those on its own pages and they move. The stable point is the classification: the channel of entry alone does not turn a promotional game of chance into an online game of chance.
- An entrant checks the organiser's prize letter before filing anything with the tax office.
- A lottery win through an online entry is treated under the lottery category, not the online games category.
- The Belastingdienst's own prize page answers the classification question for promotional games of chance.
Retention follows purpose, and no official page names a fixed number of days.
None of the three sources cited here fixes a storage period for contest data in days or months. The limiting rule is the specific-purpose rule instead: once the purpose of the processing has ended, the permission that justified holding the data ends with it.
That gives entrants a practical test. An organiser needs the entry details to run the draw and contact the winner. It needs nothing more once prizes are handed out, unless a separate consent covers a newsletter or a future campaign.
So the honest answer to the storage question is conditional, not numeric. The organiser's privacy notice should state its own period, and where it does not, the entrant can ask for it and ask for deletion.
- A privacy notice states that entry details are removed after the winners are paid out.
- An entrant requests deletion of the entry file six months after the draw.
- A contest keeps only the winners' addresses for delivery, not the full entry list.
Transparency duties tell entrants what happens to their details.
Consent given blind is not valid consent. Before an organiser asks for permission, the specific-purpose rule obliges it to say what the data is for, because a permission without a stated purpose covers nothing. That obligation is what an entrant should see honoured on the form.
The minimum an entrant should find: who is running the contest, what the details will be used for, whether a sponsor or partner receives any of them, and how permission is withdrawn. A form with no stated purpose and no named organiser fails the test before the draw even opens.
This is also the fastest scam filter on this page. A fake contest hides its organiser and skips the purpose statement, because both would expose it.
- A contest page names the organiser above the entry form and states the use of each field.
- The conditions name every partner that receives entrant details.
- An unsubscribe link sits in the footer of every marketing email an entrant receives.
Fake contests and disqualification are caught by rule hygiene, not prize size.
The legality objection resolves through the same two texts. A promotional game of chance in the Netherlands falls under the Gedragscode promotionele kansspelen, published by the Kansspelautoriteit, and under the consent requirements the Autoriteit Persoonsgegevens enforces. An organiser that hides who it is fails both frameworks at once.
Disqualification, the second objection, is decided by the organiser's own published conditions. The code and the consent rule tell organisers what they must require; the conditions tell entrants what voids an entry, from duplicate submissions to entries that bypass the stated limits.
And the platform layer adds its own checks: counters, entry logs and moderation steps are visible to the organiser, so an entry that manipulates them is visible too. Nothing on this page teaches bypassing any of that; it teaches reading the rules before entering.
- A contest without a named organiser and without conditions is treated as a warning sign.
- An organiser voids entries that its published conditions already excluded.
- An entrant checks for a privacy notice and a stated purpose before submitting details.
What the law and the rules say
Three official texts carry the weight here. First, the Autoriteit Persoonsgegevens states that consent to processing personal data must always apply to one specific processing activity and one specific purpose, so a single general permission cannot cover entry, prize contact and marketing at once. Second, the Kansspelautoriteit publishes the Gedragscode promotionele kansspelen, the national code for promotional games of chance, which makes parental consent a condition of any minor's participation and thereby functions as the de facto age rule for that category of contest. Third, the Belastingdienst, the Dutch tax administration, states in its prize guidance that participation over the internet in a lottery, lotto or promotional game of chance falls outside its classification of an online game of chance, which changes how winnings from such entries are treated. Everything on this page is read against those three sources.
What this guide does not cover
This page is a checklist of published rules, and it is honest about what it refuses to do. It is not legal advice, and it does not interpret individual cases or draft conditions for an organiser. It carries no tax figures, no thresholds and no percentages, because the Belastingdienst keeps those current on its own pages and stale numbers here would mislead. It does not state a national minimum age, because the Gedragscode sets parental consent as the condition rather than a fixed age. It never explains how to submit duplicate entries, hide an identity or work around an organiser's limits; organisers catch such entries through counters, logs and moderation, and this page will not help anyone try. It covers promotional games of chance and privacy, not skill competitions, television votes or electoral questions, and it names no organiser beyond the authorities cited.
Common questions
The Autoriteit Persoonsgegevens requires that consent to processing cover one specific processing activity and one specific purpose. Applied to a contest entry, that means the permission for entering and drawing a winner is separate from the permission for marketing, and separate again from any sharing with a sponsor. An entrant gives each permission on its own, and withdraws each on its own. The practical checklist is short: read the form for a stated purpose behind every field, look for the organiser's name, and refuse any form that bundles everything into a single untickable box. Where an organiser wants to reuse entry details for a later campaign, the same rule demands fresh, specific consent for that new purpose.
For promotional games of chance, the Gedragscode promotionele kansspelen sets no single age number; it obliges the organiser to make parental consent a condition of a minor's participation. That shifts the answer from a national figure to the organiser's own published conditions, which entrants should read before submitting anything. In practice an underage entry counts only once a parent's permission is on record, and an organiser working under the code must build that requirement into its form. Keep the scope in mind: the code covers promotional games of chance, not every competition. A skill contest with no chance element answers to different rules, so the age limit there is whatever the organiser's conditions state.
Tax treatment follows the classification of the game the entry was cast in. The Belastingdienst states that participation via the internet in a lottery, lotto or promotional game of chance is not regarded as an online game of chance for the relevant tax rules, so such prizes are not pushed into the online-games category by the online channel alone. What that means for a specific prize depends on the category and on the figures the Belastingdienst publishes on its own prize pages, which this page deliberately does not restate. The working habit for an entrant: read the organiser's prize communication, note which category the contest sat in, and settle the tax question against the Belastingdienst's current published guidance rather than a forum post.
No official source cited on this page fixes a storage period in days, and an organiser that quotes one is stating its own policy, not a national rule. The binding constraint is the specific-purpose rule: consent covers a specific processing and a specific purpose, so once the draw is run and the winners are paid, the permission to hold the entry file has run out unless a separate consent covers something more. That gives entrants a working test. Ask what the stated purpose is, ask when it ends, and ask for deletion once it has. A privacy notice that names its own retention period is the sign of an organiser that has understood the rule.
Marketing sits in its own consent lane. Because the Autoriteit Persoonsgegevens requires consent to be specific to one processing activity and one specific purpose, a permission given to enter a contest does not reach the organiser's newsletters, and no checkbox hidden in the entry flow covers it. An entrant who wants the offers ticks the marketing permission separately; an entrant who does not, refuses it and still enters on equal terms. Withdrawal works the same way: permission for marketing ends when the entrant says so, without touching the validity of the original entry. An organiser that ties entry eligibility to marketing consent has inverted the rule, and that inversion is itself a signal worth reading.
Disclosure must be enough that consent can be specific. A permission without a stated purpose covers nothing, so before collecting anything the organiser names itself, states what each collected field is used for, discloses any sponsor or partner receiving details, and explains how permission is withdrawn. For a minor's entry it must also state, as the Gedragscode promotionele kansspelen requires, that parental consent is a condition of participation. Entrants should treat this list as a filter: a form with no named organiser, no purpose statement and no withdrawal route fails the transparency test before the contest even opens. Everything else, from retention periods to prize handling, should follow from what that notice states.