Sweepstakes in TYPO3: GDPR-Compliant, AI-Accelerated

Online sweepstakes in TYPO3 rarely fail on technology, almost always on the law

Programming a sweepstakes takes 3-5 days: form, validation, winner draw, email to the winners. Making it legally sound takes longer, because the legal requirements outweigh the technical effort. Terms and conditions, a separate marketing consent, the ban on bundling consent, automatic deletion of data after the sweepstakes ends, age verification, excluding employees: these aren’t optional extras, they are legal obligations. A TYPO3 sweepstakes without these safeguards risks GDPR fines and, in Germany, costly cease-and-desist letters from competitors. (US: There is no federal GDPR equivalent, and sweepstakes fall under state law: a prize plus chance plus a required purchase makes an illegal lottery, and states such as New York and Florida require registration for larger prize pools.)

TYPO3 has no standard extension for sweepstakes. The solution is always a custom build that maps the exact requirements of the specific sweepstakes. Gosign develops these modules as Extbase-based TYPO3 extensions with a complete GDPR compliance layer.

Typical use cases

Marketing campaigns with product giveaways. A consumer goods manufacturer gives away 10 products among everyone who fills out a form. The sweepstakes runs for 4 weeks; after that, a random generator picks the winners, who are notified by email. The technical requirements: a form with mandatory fields (name, email, age), one entry per email address (double opt-in), a checkbox for the terms and conditions (not pre-ticked), a separate checkbox for newsletter consent (optional, not tied to entry) and automatic deletion of the data 30 days after the end.

Sweepstakes linked to social media. Entrants come from Instagram or Facebook to the TYPO3 website and fill out the form there. The social media platform must not serve as the entry mechanism (the platforms’ terms prohibit this), only as a source of traffic. The TYPO3 page is the official entry page. For one client with 50,000 Instagram followers, three sweepstakes in one year generated 12,000 qualified contacts, 4,800 of them with a newsletter opt-in.

Recurring Advent calendar or monthly sweepstakes. An Advent calendar sweepstakes with 24 doors, each with its own prize. Technically more demanding: 24 sweepstakes in one extension, time-controlled unlocking, a separate draw for each day, tracking across all entries (nobody wins twice). For one retailer, the Advent calendar lifted December traffic by 300% compared with the same month the previous year.

Technical architecture

A TYPO3 sweepstakes module consists of five components:

Entry form. An Extbase controller with a Fluid template. The form fields are configurable: mandatory fields (name, email), optional fields (phone, address), checkboxes (terms and conditions, marketing consent). The form uses TYPO3’s CSRF protection (FormToken) and validates on the server side. Client-side validation is a useful addition, but not enough on its own.

Duplicate check. Each email address can enter only once. The check happens at database level (a unique constraint on email + sweepstakes ID). On top of that comes double opt-in via a confirmation email: an entry only counts once the confirmation link has been clicked.

Winner draw. A scheduler task or a manual trigger in the backend picks the winners with a cryptographically secure random generator (random_int() in PHP, not rand() or mt_rand()). The draw is logged in the database: timestamp, seed, winner IDs. If a regulator asks, the draw can be reconstructed.

Winner notification. An automatic email goes to the winners with congratulations and next steps (for example, entering a shipping address). Another automatic email goes to everyone who didn’t win (optional, but recommended for customer loyalty). All emails run through TYPO3’s Mail API with Fluid templates.

Data lifecycle. All entrant data is deleted automatically after a configurable period (default: 30 days after the sweepstakes ends). A scheduler task checks daily whether any sweepstakes have ended and deletes the related records. Winner data (name, address) is handled separately, because it has to be kept longer for shipping and tax records.

Common problems and solutions

Bot entries distort the results. Without protection, bots register thousands of fake entries. Solution: a honeypot field, rate limiting (a maximum of 3 submissions per IP per minute) and double opt-in as three layers of protection. Double opt-in is the most effective of them: bots can fill out forms, but they can’t click confirmation emails.

Violating the ban on bundling consent. Entry must not depend on marketing consent. If the newsletter checkbox is a mandatory field, that’s a violation: under Article 7(4) GDPR, consent that someone has to give in order to take part is not freely given. Solution: always implement marketing consent as an optional checkbox that isn’t pre-ticked, and check in the form validator that an entry goes through without the marketing checkbox.

Performance under heavy concurrent load. A viral sweepstakes with 10,000 entries in one hour puts a real strain on the server. Solution: configure the form submission as an uncached page (USER_INT), but cache the sweepstakes page itself (USER). For extreme load, use a separate worker process for the database writes and process the submissions through a queue.

Migration and version compatibility

Sweepstakes modules are custom builds with no standard migration path. With every TYPO3 upgrade, the Extbase APIs have to be adapted: v9 to v10 (dependency injection via Symfony, PSR-14 events, persistence mapping in Classes.php), v10 to v11 (Extbase changes), v11 to v12 (TCA refactoring, backend modules). A typical sweepstakes module takes 1-2 days per major upgrade.

If you run sweepstakes regularly, a generic extension configured through a backend module pays off: sweepstakes name, period, prizes, form fields, email templates. This one-time investment (5-8 developer days) saves 80% of the effort on every sweepstakes that follows. Gosign develops these modules as reusable TYPO3 extensions and can draft the terms and conditions if needed; legal sign-off remains with the client.