Physical Retail
In-store receipt validation and loyalty programs
E-commerceComing Soon
Online purchase verification and fraud prevention
Consumer GoodsComing Soon
Product authentication and warranty validation
UK Promotional Compliance Memorandum
Legal basis for chance, skill, and gift-with-purchase promotions operated through the Playe platform across physical retail, consumer-packaged-goods and ecommerce channels.
| Document reference | PLAYE-COMP-001 |
|---|---|
| Version | 1.0 |
| Date of issue | 9 October 2026 |
| Prepared by | Playe Labs Limited — Compliance Office |
| Jurisdiction | England & Wales (UK-wide application) |
| Review cycle | Annual, or upon material change in law |
| Publication status | Public |
1. Executive Summary
This memorandum sets out the legal and regulatory framework governing promotional campaigns operated through the Playe platform within the United Kingdom, and demonstrates how the platform's wizard, validation gates and stored evidence operate to discharge the promoter's obligations under that framework. It is intended both as an internal reference for the platform's compliance team and as a defensive document capable of being produced, in whole or in part, to the Advertising Standards Authority[1], the Information Commissioner's Office[2], the Gambling Commission[3], or to a court of competent jurisdiction.
The platform supports four campaign archetypes — Single Win, Leaderboard, Fixed-Pool and Reward for All — and three merchant verticals — Physical Retail, Consumer-Packaged Goods (CPG) and Ecommerce. Each archetype falls into one of three legal categories under the Gambling Act 2005[4]: a prize competition relying on skill (s.14(5)); a lawful prize draw either free of charge or accompanied by a free entry route (s.14 read with Sch.2); or a promotional gift-with-purchase outside the scope of the Act altogether.
Operative Conclusion
Of the four campaign styles, only the Fixed-Pool style constitutes a prize draw within the meaning of s.14(2) of the 2005 Act when entry is conditional on payment, and is the only style for which the platform mandates a Free Entry Route. The remaining three styles are either skill-based (Single Win, Leaderboard) or guaranteed gifts-with-purchase (Reward for All) and do not engage the lottery provisions of the Act.
2. Regulatory Framework
The promotional activity facilitated by the platform is regulated principally by six instruments. Each is summarised below; their application to specific campaign styles is treated in §3 onwards.
2.1 Gambling Act 2005
The Act, in force since 1 September 2007, regulates "gambling" in Great Britain, comprising gaming, betting and participating in a lottery (s.3). A lottery is defined at s.14(1)–(3) as an arrangement under which (i) persons are required to pay to participate, (ii) one or more prizes are allocated to one or more members of a class, and (iii) the prizes are allocated by a process which relies wholly on chance.
"A process which relies wholly on chance includes a process which consists of a series of operations or processes that may, by removing the element of skill, prevent a significant proportion of persons who participate in the arrangement of which the process forms part from receiving a prize." — s.14(5), Gambling Act 2005[4]
Operating an unlawful lottery is an offence under s.258, punishable on indictment by up to 51 weeks' imprisonment, an unlimited fine, or both. Schedule 2 ("Prize Competitions and Free Draws") provides the safe harbour: a promotion is not a lottery if either (a) participation is genuinely free, or (b) entry is by a method that is no more inconvenient or expensive than the paid route — the Free Entry Route ("FER").
2.2 The CAP Code (Non-Broadcast)
The UK Code of Non-broadcast Advertising and Direct & Promotional Marketing[5]("the CAP Code") is administered by the Advertising Standards Authority. Section 8 governs sales promotions and is engaged by every campaign run on the platform. Particular attention is drawn to:
- §8.2 — the principle that promotions must be conducted equitably, promptly and efficiently and must not cause unnecessary disappointment;
- §8.14–8.16 — administration: the promoter must be able to demonstrate that adequate resources have been allocated and that the promotion is conducted under proper supervision;
- §8.17 — the duty to communicate "significant conditions" before or at the time of entry, including the closing date, restrictions, the promoter's identity and address, and any costs to enter;
- §8.18 — gifts-with-purchase: where every qualifying purchaser receives the item, the promotion is treated as an offer rather than a prize promotion;
- §8.24–8.28 — prize promotions specifically: winner notification, publication of winners, and prize substitution.
2.3 UK GDPR & Data Protection Act 2018
Personal data collected during entry (name, email, postal address for postal FER, device identifiers, EXIF metadata where receipt scans are used) is processed under the UK General Data Protection Regulation as supplemented by the Data Protection Act 2018[6]. The relevant lawful bases under Article 6(1) are:
- Article 6(1)(b) — performance of a contract: administering the entrant's participation;
- Article 6(1)(c) — legal obligation: e.g. retention for tax, advertising standards complaints;
- Article 6(1)(f) — legitimate interests: fraud detection, including device fingerprinting where consent is not relied upon;
- Article 6(1)(a) — consent: marketing communications and any non-essential tracking governed by PECR.
Where receipt images are uploaded, EXIF metadata may include GPS coordinates and device timestamps. This is properly characterised as location data and, although not "special category" within Article 9, is treated by the ICO as warranting heightened transparency under the Article 5(1)(a) principle of fairness.
2.4 Privacy and Electronic Communications Regulations 2003
PECR[7]governs electronic marketing and the use of cookies and similar technologies. Two provisions are engaged routinely:
- Regulation 6 — storage of, or access to, information on a user's device requires prior consent unless strictly necessary for a service requested by the user. Device fingerprinting deployed for fraud control falls outside the "strictly necessary" exemption and accordingly requires consent.
- Regulation 22 — direct marketing by electronic mail requires consent, save for the narrow "soft opt-in" exception applicable to existing customers in respect of similar products. The platform requires the promoter to confirm the applicability of the soft opt-in or, in the alternative, the presence of unbundled marketing consent.
2.5 ICO Direct Marketing Code of Practice
The Code[8] is statutory guidance under s.121 DPA 2018. It interprets PECR and UK GDPR in the marketing context and confirms that consent to marketing must be a separate, optional act — never a precondition of entry to a promotion. The platform implements this requirement through the unbundled "Surface marketing opt-in" toggle exposed in Step 2 of the wizard.
2.6 Consumer Protection from Unfair Trading Regulations 2008
The CPRs[9] prohibit misleading actions and omissions in commercial practices. Schedule 1 enumerates 31 always-unfair practices, of which two are of particular relevance: paragraph 19 (falsely advertising a prize-promotion when none is available) and paragraph 31 (creating a false impression that the consumer has won a prize when in fact taking the prize requires further payment). The platform's prize-quantity validation and "guaranteed reward" distinction in Reward for All are designed to ensure compliance with both prohibitions.
3. Campaign Style Analysis
The four campaign styles are analysed below in the standard IRAC[10] structure.
Closing Date — Channel Distinction (CAP §8.17.1(b))
CAP §8.17.1(b) requires that a "closing date" for entries be communicated as a significant condition. The Code does not prescribe that the closing event be a calendar date; the ASA has consistently accepted event-based termini provided the closing event is objectively ascertainable in advance and disclosed to entrants before entry. For digital campaigns (Ecommerce; web/SMS entry) the platform requires a calendar endDate/endTime. For physical campaigns operated through Physical Retail and CPG verticals, the campaign is structured around a finite, pre-allocated pool of participant numbers (unique serialised codes printed on pack, receipt, scratch-card or shelf barker) and the closing event is defined as the activation of the last issued participant number. The platform enforces three safeguards in respect of physical campaigns:
- the total pool size is fixed at publication, immutable thereafter, and disclosed verbatim in the generated terms;
- a long-stop date is published beyond which any unactivated codes are void, satisfying the "ascertainable closing date" requirement under CAP §8.17.1(b) as interpreted in ASA case practice; and
- a public "campaign closed" notice is automatically posted within 24 hours of pool exhaustion via the Playe winners-page endpoint, providing contemporaneous evidence of the closing event.
3.1 Single Win — Skill-Based
Issue
Whether a promotion in which a single winner is selected by judgment of skill, knowledge or judgment exercised by the entrant constitutes a lottery within s.14 of the 2005 Act.
Rule
By s.14(5), an arrangement does not satisfy the "wholly by chance" limb of s.14(2)(c) where it includes a process which, by removing the element of skill, would prevent a significant proportion of participants from receiving a prize. The Gambling Commission has consistently treated genuine skill-tiebreaks (e.g. an editorial judgment of the most apt caption) as sufficient[11].
Application
In the platform's Single Win style, the winner is determined by editorial or algorithmic judgment of merit. No random element determines the outcome. The platform accordingly does not engage Schedule 2 of the Act and an FER is not required.
Conclusion
Single Win is a prize competition under s.14(5) and is lawful without an FER, provided the skill judgment is documented and capable of being explained on request.
3.2 Leaderboard — Skill-Based
Issue
Whether a promotion ranking entrants by score, speed, or performance over a finite period engages s.14 of the 2005 Act.
Rule & Application
Where the metric ranking entrants is one over which the entrant exercises material control — a quiz score, a time-trial, a sales-volume metric — the s.14(5) "significant proportion" threshold is met and the promotion sits outside the lottery definition. The platform's leaderboard mechanism aggregates entrant-controlled metrics and therefore qualifies.
Defence Note
The platform retains, for each leaderboard campaign, the complete ordered scoring log with entrant pseudonymous identifiers, allowing the promoter to demonstrate to the Commission that ranking was performance-based rather than random.
3.3 Fixed-Pool — Chance Draw (FER Mandatory)
Issue
Whether a promotion in which a fixed number of winners is selected at random from a pool of paying entrants constitutes a lottery, and if so, whether the promotion may lawfully proceed under the Schedule 2 safe harbour.
Rule
The arrangement satisfies all three limbs of s.14(2): (i) entry requires a qualifying purchase; (ii) prizes are allocated to members of a class (the entrants); (iii) selection is wholly by chance. It is therefore a lottery and unlawful unless one of the permitted lottery categories under Part 5 of the Act applies, or the Schedule 2 conditions are satisfied.
Schedule 2, paragraph 8 (as substituted by the Gambling Act 2005 (Amendment of Schedule 2) Order 2020) provides that an arrangement is not a lottery if any payment required to enter does not exceed the cost of an ordinary first-class postage stamp and a participant may also enter by a method that is at least as convenient as the paid method.
Application
The platform mandates, at Step 2 of the wizard, configuration of an FER for any campaign of Fixed-Pool style. The permitted methods are: postal entry to a stated address; a free-of-charge web form; or a free SMS short-code. Validation blocks publication where no FER is configured. The FER must confer an equal probability of winning and impose no greater inconvenience than the paid route.
Conclusion
With the FER properly configured and disclosed, Fixed-Pool falls within the Schedule 2 safe harbour and is lawful. Without the FER, the promotion is an unlawful lottery contrary to s.258 and the platform will not permit publication.
3.4 Reward for All — Gift-with-Purchase
Issue
Whether a promotion in which every entrant receives the same reward upon completing a qualifying purchase constitutes a lottery, prize competition, or sales promotion.
Rule
A lottery requires the allocation of prizes to some members of a class — implicitly, not to all. Where every qualifying participant is guaranteed the same reward, the arrangement lacks the element of allocation by chance and constitutes a sales promotion (or "premium offer") rather than a prize promotion. CAP §8.18 confirms this distinction. The CPRs 2008, Sch.1 para.31 (false claim of having won) is not engaged because every entrant does in fact receive the stated benefit.
Application
The platform binds Reward for All campaigns such that prize quantity equals entry quantity, eliminating any chance element. Where a minimum qualifying spend is configured, the platform automatically inserts a "significant condition" notice into the generated terms pursuant to CAP §8.17.
Conclusion
Reward for All is a sales promotion outside the scope of the Gambling Act 2005. No FER is required. The promoter's principal duty is the §8.17 disclosure obligation and the §8.2 fairness principle.
4. Retention Loops
A "Retention Loop" is a structured, repeat-purchase reward mechanism: an entrant who completes n qualifying transactions within the campaign window receives a guaranteed additional reward. The legal characterisation is identical to that of Reward for All: every participant who satisfies the stated condition receives the stated benefit, and accordingly the arrangement is a sales promotion rather than a lottery, irrespective of the underlying base style of the campaign.
Retention Loops do not, of themselves, transform a skill-based or guaranteed-reward base campaign into a chance promotion. They do, however, give rise to additional significant conditions for the purposes of CAP §8.17, in particular: the number of qualifying transactions required, any minimum spend per transaction, the redemption window and any geographic or product restrictions. The platform surfaces these conditions in the T&Cs builder at Step 5 and pre-flight checklist will not pass without them being present.
Distinction Drawn
A loop that increased the entrant's chances of winning a prize draw — for example, by granting one additional draw entry per qualifying purchase — would constitute payment-to-enter and engage the lottery regime. The platform does not implement that mechanic.
For Retention Loops attached to physical campaigns the loop terminates on exhaustion of the underlying participant pool rather than on a recurring calendar window: once every serialised code has been activated, no further loop iterations are possible and the campaign is treated as closed for the purposes of §3 and §8 of this memorandum.
5. Merchant-Type Considerations
The base regulatory analysis is supplemented by considerations specific to the entry vector employed by each merchant type.
5.1 Physical Retail
Entry is by Optical Character Recognition of a printed receipt uploaded by the entrant. Two compliance considerations are specific to this vector:
- EXIF metadata. Receipt photographs commonly embed device identifiers, timestamps and GPS coordinates. The platform's optional "EXIF scan" feature, when enabled, requires the promoter to acknowledge the corresponding lawful basis under UK GDPR and to disclose the processing in the privacy notice. The platform retains the lawful-basis acknowledgment as evidence of an Article 30 record.
- Participating-store disclosure. Where the promotion is restricted to specified stores, the list of participating outlets is a significant condition under §8.17. The platform requires at least one selected store and renders the list both in-app and in the generated T&Cs.
- Pool-exhaustion closing event. Physical campaigns do not carry a calendar end date. The promotion closes on activation of the last issued participant number (see §3, "Closing Date — Channel Distinction"), subject to a published long-stop date. The platform records each code activation with a server-side timestamp and device fingerprint, producing an immutable audit trail capable of evidencing the precise moment of closure to the ASA, the Gambling Commission or a court.
5.2 CPG (Including Alcohol & HFSS)
Entry is by a unique on-pack code, either generated by the platform or supplied in batch by the promoter. The volume of codes contemplated (up to 100,000 per campaign) and their physical printing on packaging gives rise to bespoke obligations.
5.2.1 Batch / Lot Identification
Where on-pack promotional materials may interact with a product recall (e.g. under General Product Safety Regulations 2005, or Food Information Regulations 2014 for foodstuffs), the promoter must be able to identify the production lot bearing the codes. The platform mandates entry of a batch / lot identifier and, where applicable, a best-before date in Step 2.
5.2.2 Code Expiry
CAP §8.17.1(c) requires the closing date to be communicated. Where unique codes outlast the promotional window — for example, because stock remains on shelf — the platform records a redemption-side expiry (1–730 days, default 90) and binds it to the generated terms.
5.2.3 Alcohol Products
Where the qualifying product contains alcohol, the Portman Group Code of Practice on the Naming, Packaging and Promotion of Alcoholic Drinks[12] applies. Rule 3.2(h) prohibits promotions that have a particular appeal to under-18s; rule 3.2(j) requires that promotions encourage neither immoderate consumption nor a rapid drinking style. The platform:
- auto-locks the age gate to 18+ where the alcohol toggle is engaged;
- requires acknowledgement of the Portman Group Code; and
- blocks publication where the acknowledgement is absent.
A tangential consideration is the Licensing Act 2003, s.146, which criminalises the sale of alcohol to a person under 18 — relevant where a redeemed prize is itself alcohol. The platform recommends that prize-redemption be effected by a licensed retailer in such cases.
5.2.4 HFSS Products
The Health and Care Act 2022 inserted new restrictions on the promotion of products high in fat, salt or sugar ("HFSS"), in force from 1 October 2025 in respect of paid online advertising and 9pm television watershed restrictions, and from earlier dates in respect of in-store volume-price and location restrictions under the Food (Promotion and Placement) (England) Regulations 2021[13]. Although on-pack codes are out of scope of the advertising restrictions, creative materials promoting an HFSS product campaign may not be targeted at children. The platform requires acknowledgement of the HFSS regime where the toggle is engaged.
5.3 Ecommerce
Entry is by a single-use post-purchase email link, dispatched following an order webhook from a connected commerce platform (Shopify, WooCommerce, BigCommerce, Magento, or custom). Compliance considerations:
- PECR Reg 22 soft opt-in. The post-purchase dispatch typically falls within the soft opt-in for similar goods or services purchased from the promoter. The platform requires explicit confirmation by the merchant that the statutory tests are satisfied.
- Refund-invalidates-entry. Where a purchase is refunded within the configured window (default 14 days, mirroring the Consumer Contracts Regulations 2013 cooling-off period), the entry is invalidated. This avoids the risk of windfall winners and aligns with the §8.2 fairness principle.
- Single-use links. Each link is bound to an order identifier and consumed on first use, mitigating link-sharing fraud.
6. Significant Conditions Catalogue (CAP §8.17)
The CAP Code requires "significant conditions" to be communicated before, or at the time of, entry. The following table maps the §8.17 enumeration to the platform's data fields and indicates whether each is mandatory, conditionally mandatory or optional.
| §8.17 Sub-rule | Subject matter | Platform field | Status |
|---|---|---|---|
| (a) | Closing date — digital channels | endDate / endTime | Mandatory |
| (a) | Closing date — physical channels (serialised pool) | poolSize + longStopDate | Mandatory; campaign closes on pool exhaustion or long-stop, whichever first |
| (b) | Restrictions on availability | geoRestriction, ageGate | Mandatory |
| (c) | Promoter's name & address | promoterName, promoterAddress | Mandatory |
| (d) | Proof-of-purchase requirements | lineItemMatch, sku, batchNumber | Conditional |
| (e) | Description of prizes / number available | prizeQuantity, prizeValue | Mandatory |
| (f) | Notification & delivery timescales | winnerNotificationDays, prizeDeliveryDays | Mandatory |
| (g) | Substitution clause | prizeSubstitutionAllowed | Mandatory |
| (h) | Tax or other liabilities of the winner | termsAndConditions | Conditional |
| (i) | Means of obtaining a list of winners | winnerPublication | Mandatory |
| (j) | Judging criteria where applicable | judgeName, judgeRole | Conditional (skill) |
| (k) | Minimum qualifying spend | minimumSpend | Conditional |
7. Data Protection & Tracking
The platform's processing operations are catalogued for the purposes of Article 30 UK GDPR as follows.
| Operation | Lawful basis | Retention |
|---|---|---|
| Entry administration (name, contact, transaction reference) | Art. 6(1)(b) — contract | End of campaign + 12 months |
| Marketing communications | Art. 6(1)(a) — consent / PECR Reg 22(3) soft opt-in | Until consent withdrawn |
| Device fingerprinting (fraud) | Art. 6(1)(f) + PECR Reg 6 consent | End of campaign + 6 months |
| EXIF scan of receipt images | Art. 6(1)(f) — fraud control | End of campaign + 6 months |
| Winner verification & prize fulfilment | Art. 6(1)(b) + Art. 6(1)(c) | 6 years (limitation period) |
The platform's marketing opt-in is implemented as an unbundled, off-by-default switch in compliance with the CJEU's analysis in Planet49[14] and the ICO Direct Marketing Code.
8. Winner Selection, Notification & Publication
For chance-based promotions (Fixed-Pool), winner selection is performed by a cryptographically seeded pseudo-random number generator (CSPRNG). The seed is recorded at the moment of draw and retained for the limitation period; the draw is therefore re-producible on demand by the Gambling Commission, the ASA, or a court.
Notification is effected within the period stated in the T&Cs (default 7 days). The platform implements a configurable "reasonable endeavours" reattempt schedule and, where required, re-draw logic in accordance with CAP §8.28.5.
Publication of winners is offered in three modalities — full, anonymised (county and surname initial), or on-request — to accommodate the data-minimisation principle of Article 5(1)(c).
9. Record-Keeping & Audit Trail
The platform automatically retains the following artefacts for each published campaign, comprising the promoter's defensive evidence base:
- Campaign configuration snapshot at the moment of publication, hashed and timestamped;
- The version of the T&Cs presented to entrants, with content hash;
- Entry log including entrant pseudonym, timestamp, route (paid / FER), and any fraud-control signals;
- For FER routes: the inbound message log (web form, SMS, postal scan);
- Winner-selection seed and the ordered output of the CSPRNG;
- Notification log including delivery receipts and reattempt history;
- Prize-fulfilment receipt from the configured provider (Tillo, Runa, Giftpro, Reward Cloud, Amazon, or manual);
- Consent records evidencing marketing opt-in and PECR Reg 6 consent where applicable.
10. Defence Posture & Escalation Protocol
In the event of a regulatory enquiry, the following protocol is to be observed by the platform's compliance officer:
- Acknowledge within 5 working days. Confirm receipt of the enquiry to the regulator and identify the campaign(s) in scope.
- Preserve. Issue a litigation hold on all artefacts described in §9 above; suspend any scheduled retention deletions for the campaigns in scope.
- Produce the campaign dossier. A single PDF export comprising the configuration snapshot, T&Cs version, FER configuration, consent records and CSPRNG seed.
- Engage external counsel. For Gambling Commission or ICO matters, instruct a solicitor with a current practising certificate. ASA matters of complexity warranting external advice should be escalated similarly.
- Without-prejudice engagement. Substantive response should be issued within the regulator's stated deadline, ordinarily 21 days, marked "without prejudice" where appropriate.
11. Glossary
| ASA | Advertising Standards Authority |
|---|---|
| CAP Code | UK Code of Non-broadcast Advertising and Direct & Promotional Marketing |
| CSPRNG | Cryptographically Secure Pseudo-Random Number Generator |
| FER | Free Entry Route — the no-payment alternative under Sch.2 of the 2005 Act |
| HFSS | High in Fat, Salt or Sugar — products subject to the 2021/2022 Regs |
| ICO | Information Commissioner's Office |
| PECR | Privacy and Electronic Communications Regulations 2003 |
| UK GDPR | The retained EU General Data Protection Regulation as it forms part of UK law |
12. Schedule A — Statutory References
- Advertising Standards Authority — UK regulator of marketing communications under the CAP Code.
- Information Commissioner's Office — UK supervisory authority for UK GDPR and PECR.
- The Gambling Commission — non-departmental public body sponsored by DCMS, established under the Gambling Act 2005.
- Gambling Act 2005 (c.19), as amended.
- CAP Code, 12th edition (2010), as amended by the Committee of Advertising Practice.
- Retained Regulation (EU) 2016/679 (the UK GDPR), supplemented by the Data Protection Act 2018 (c.12).
- The Privacy and Electronic Communications (EC Directive) Regulations 2003 (SI 2003/2426).
- ICO, Direct Marketing Code of Practice, draft published 2020 and finalised in 2024.
- The Consumer Protection from Unfair Trading Regulations 2008 (SI 2008/1277).
- Issue, Rule, Application, Conclusion — the conventional structure of a legal opinion.
- Gambling Commission, Promotions and Prize Competitions: A Quick Guide (2018).
- Portman Group, Code of Practice on the Naming, Packaging and Promotion of Alcoholic Drinks, 6th edition (2022).
- The Food (Promotion and Placement) (England) Regulations 2021 (SI 2021/1368).
- Case C-673/17 Planet49 GmbH [2019] EU:C:2019:801.
Disclaimer: This memorandum is published by Playe Labs Limited, the operator of the Playe platform, for the purpose of documenting the platform's promotional compliance posture. It is provided for general information only and does not constitute legal advice. No solicitor-client or other professional relationship is created between Playe Labs Limited and any reader of this document. Playe Labs Limited gives no warranty, express or implied, as to the suitability of this material for any particular promotion or fact pattern. Promoters remain solely responsible for obtaining independent advice from solicitors regulated by the Solicitors Regulation Authority and, where applicable, from licensees of the UK Gambling Commission, in relation to their own promotions.