- Enforcing jurisdiction
- Finland · Geography does not establish applicable law.
- Confirmed applicable legislation
- Privacy topics
DPA case 8086/182/2019 – No Violation (Finland, 2023)
Privacy enforcement record
This record is classified outside cookie consent. Subject classification does not confirm an applicable law. It is not included in cookie statistics or the Risk Calculator.
The Finnish Data Protection Authority looked into a lottery's requirement for participants to consent to direct marketing. They found that making consent a condition for entering the lottery is not voluntary and could mislead users. This decision highlights the importance of clear and genuine consent for marketing practices.
What happened
A lottery required participants to consent to direct marketing to enter.
Who was affected
People who wanted to participate in the lottery but were asked to consent to marketing.
What the authority found
The DPA noted that consent was not freely given since it was a condition for participation, which is against GDPR rules.
Why this matters
This case emphasizes that companies must ensure consent is truly voluntary and not tied to participation in other activities. Businesses should review their consent practices to avoid similar issues.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Secondary-source text retrieved.
Automated check recorded — 18 October 2026.
Processing notes: articles corrected.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
The Finnish DPA received a submission from a complainant regarding a data controller's processing of personal data in connection with a lottery. As a condition for participating to the lottery requested the participants to consent to direct marketing. According to the lottery, the complaint concerned a marketing campaign related to the company's 30th anniversary including a lottery for the customers, and the rules for the lottery said that in order to participate, a customer had to give their consent for direct marketing. Consent was given by ticking a box saying "Yes, I want to participate to the lottery and subscribe to direct marketing or I am already a subscriber". After receiving the first marketing email or newsletter, a data subject could unsubscribe by following instructions on the email. The Finnish DPA considered the following questions: 1) is consent for direct marketing freely given as required under Article 4 (11) GDPR when consent is a condition for participating in a lottery, and 2) has the data controller complied with Article 7(3) GDPR and provided a possibility to data subjects to withdraw consent. The Finnish DPA viewed that it is undeniable that participating to the lottery is depending on consent for marketing, and that a consent is not voluntary if data subject does not have real option to not give consent without having negative consequence. The DPA noted that the European Data Protection Board has stated that adding consent to agreement terms is strongly undesirable. The DPA stated that the wording in Article 7(4) GDPR is not absolute and that the view of the European Data Protection Board has been, there may be some rare cases where this conditionality would not invalidate the consent. When assessing whether consent is valid, the DPA paid attention to the purpose of processing personal data which in the case was about voluntary participation in the lottery. The Data Protection Commissioner emphasizes the importance of voluntary consent
Outcome
No Violation
The DPA investigated and found no violation.
Related Enforcement Actions (0)
No other enforcement actions found for DPA case 8086/182/2019 in FI
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. DPA case 8086/182/2019 - Finland (2023). Retrieved from cookiefines.eu
Last updated: