Privacy, email, texts and contests

Creators collect more personal information than they often realize: email addresses for newsletters, phone numbers for text clubs, names and addresses for giveaways, purchase data from shops and analytics about every viewer. They also run promotions that the law treats specially, such as contests, sweepstakes and giveaways. This lesson covers the privacy rules that apply when creators collect and use audience data, the anti-spam laws that govern email and text marketing, and the legal requirements for contests and giveaways in your country. These are areas where small mistakes, such as a pre-checked consent box or a giveaway with no proper rules, can create surprisingly large liability.

Personal information in a creator business

Personal information is information about an identifiable individual. In a creator business it includes names, email addresses, phone numbers, mailing addresses, payment details, account usernames linked to real people, location data and, increasingly, biometric data such as face or voice recordings. Privacy laws generally require that you collect only what you need for clear purposes, obtain meaningful consent, protect the data, keep it no longer than necessary and let people access or correct it.

• Collect the minimum: a newsletter needs an email address, not a birth date and home address.
• Explain purposes clearly when collecting: what you will send, how often and whether data will be shared with brands.
• Do not share audience data with brands unless people agreed to that specifically.
• Secure the data with strong passwords, two-factor authentication and reputable service providers.
• Delete data you no longer need, such as giveaway entries after the winner is confirmed and the contest period ends.

US privacy law

The United States has no single comprehensive federal privacy law for the private sector. Instead, privacy is governed by sector laws, such as COPPA for children, HIPAA for health care providers and the Gramm-Leach-Bliley Act for financial institutions, by the FTC's authority over unfair or deceptive practices, which covers broken privacy promises and poor security, and by a growing number of state laws.

California led with the California Consumer Privacy Act (CCPA), expanded by the California Privacy Rights Act (CPRA). It gives consumers rights to know, delete, correct and opt out of the sale or sharing of their personal information, including sharing for cross-context behavioral advertising, and requires businesses to honor opt-out preference signals such as Global Privacy Control.

By 2026, around 20 states had passed comprehensive privacy laws with broadly similar rights, though thresholds and details differ. Many small creators fall below the revenue or data-volume thresholds of these laws, but the FTC Act still applies to everyone, and brands may require creators to follow privacy laws by contract.

Email and text marketing

Newsletters and text clubs are valuable because creators own the relationship rather than renting it from a platform. Anti-spam laws regulate them, and the rules differ significantly between the two countries.

The US CAN-SPAM Act of 2003 regulates commercial email. Unlike Canada's opt-in model, it is an opt-out law: businesses may send commercial email without prior consent, provided they follow its rules. Text messages are governed separately by the Telephone Consumer Protection Act (TCPA), which is stricter. CAN-SPAM's main requirements for commercial email are:

• No false or misleading header information or deceptive subject lines, and clear identification of the message as an advertisement where required.
• A valid physical postal address for the sender, and the sender's identity.
• A clear way to opt out, honored within 10 business days, with no fee or extra information required beyond an email address.

Each email in violation can bring a penalty of up to $53,088 under the FTC's 2025 amount, still in effect in 2026, and senders are responsible even if a vendor sends the email for them. For texts, the TCPA requires prior express written consent for marketing messages sent using automated systems, and consumers can sue for $500 to $1,500 per message, which makes text marketing class actions common. Several states have added their own telemarketing and text rules.

Contests, sweepstakes and giveaways

Giveaways are one of the most common creator promotions, often run with brand partners. Many people assume a giveaway is simple: post, pick a winner, ship the prize. But contests are a regulated area because of gambling laws, and they create disclosure duties under advertising law.

In the United States, a promotion that combines a prize, chance and consideration is generally an illegal lottery under state law unless run by the state. Sweepstakes, which award prizes by chance, avoid this by removing consideration: entry must be free, with a "no purchase necessary" method of entry that is as easy as the paid method. Contests, which award prizes by skill, such as best photo, avoid it by removing chance, though some states restrict skill contests that require payment. Sponsors should publish official rules covering eligibility, entry period, how to enter, prizes and their approximate retail value, odds, how winners are chosen and the sponsor's identity. New York and Florida require registration and bonding for sweepstakes with total prizes over $5,000 offered to their residents.

• Write official rules and link them in every giveaway post.
• State who is running the giveaway and who provides the prize, and disclose the brand relationship.
• Specify eligibility, including age and location, and exclude places where the giveaway would be unlawful.
• Avoid requiring purchases to enter, or provide a free alternative.
• Do not require entrants to post positive reviews; asking for tags or follows is allowed by some platforms but not others.
• Follow platform promotion rules, which typically require a statement that the platform does not sponsor or endorse the promotion.
• Collect only the personal information needed and delete it afterwards.

Tracking, analytics and brand partners

Creators use tracking links, pixels and analytics tools that collect data about audiences. Brands often ask creators to install their tracking pixels on a website or to share audience data for campaign reporting. Before agreeing, a creator should understand what data the tool collects, whether it identifies individuals, whether it is shared with the brand or third parties and whether the creator's privacy notice covers it. Aggregated, de-identified statistics, such as total clicks, views and conversion counts, are generally safe to share. Lists of individual subscribers, customers or giveaway entrants are personal information and should be shared only where people clearly agreed to that sharing.

A creator's website or shop needs a privacy notice that explains, in plain language, what information is collected, why, with whom it is shared, how long it is kept and how people can contact the creator to access, correct or delete it. Cookie banners and consent tools are required in some places and are good practice everywhere when non-essential tracking is used.

Security and breaches

Privacy law also requires reasonable security. Creators are targets for account takeovers, phishing and data theft because their accounts and audience lists are valuable. Practical safeguards include unique strong passwords stored in a password manager, two-factor authentication on every account, limiting who has access to email lists and stores, removing access when assistants or agencies leave and choosing reputable service providers. If a breach happens and personal information is exposed, privacy laws may require notifying affected people and the regulator, depending on the risk of harm, and keeping a record of the breach. A quick, honest response reduces both legal risk and damage to audience trust.

Multi-partner giveaways

Large giveaways often involve several creators and brands, each promoting a shared prize pool. These raise extra questions: who is the official sponsor responsible for the rules, who collects and holds entrants' data, how entries from each creator's audience are combined and whether each partner may contact entrants afterwards. Agree these points in writing before launch, name all sponsors in the rules, tell entrants who will receive their information and make any marketing consent separate and optional. Each creator must still disclose their own relationship with the brands involved in their own posts.

Retention and deletion

Keeping personal information longer than needed increases risk without adding value. Set simple retention rules: delete giveaway entries within a few months after the winner has received the prize and any disputes are resolved, remove unsubscribed contacts from marketing lists while keeping a suppression record so they are not emailed again, and review customer records periodically. Write the rules down and follow them consistently, because privacy laws in both countries expect personal information to be kept only as long as necessary for the purposes it was collected for. When someone asks you to delete their information, respond promptly and confirm when it is done.

Direct messages and community features

Creators increasingly use direct messages, broadcast channels, community chats and membership platforms to reach their most engaged followers. Commercial messages sent through these channels can fall under anti-spam laws as well as platform rules, and personal information shared in them, such as names, locations or health details, is still personal information. Avoid sending unsolicited promotional direct messages, respect opt-outs in community channels, do not export member lists to other tools without consent and set clear community rules about what members should not share publicly. When a brand partner wants to message your community, the brand should do so only through features members agreed to and with your clear disclosure of the relationship.