Building a First-Party Data List Through Influencer-Run Giveaways and Lead Magnets

What is a first-party data list, and why do influencer giveaways build one?

A first-party data list is a list of emails, phone numbers or other contact details the brand itself owns and can use for future marketing — independent of a platform's algorithm, and independent of whether a tracking cookie ever gets set in the browser. An influencer-run giveaway or a downloadable lead magnet (a guide, a checklist, a discount code) is one of the few influencer-marketing formats that can genuinely build that kind of list, because the entry step itself naturally asks for a contact detail. But it requires keeping two questions separate that often get merged: is the competition itself allowed, and are you allowed to use the collected data for marketing afterward?

Two separate questions: the competition's legality and marketing consent

How to run an influencer giveaway or contest, legally covers the spam-ban rule against asking entrants to tag friends, Danish prize tax, and Spillemyndigheden's gambling-licence requirement. That article assumes the competition is only about winning a prize — not about building a list afterward. This article is about the second, separate question: if the brand also wants to use entrants' name and email for future marketing — a newsletter, an SMS campaign, a retargeting list — that requires its own legal basis, one that doesn't automatically come bundled with competition entry itself.

The legal basis: GDPR consent

Under GDPR, a competition or lead magnet where followers type in their own name and email is typically based on consent (Article 6(1)(a)) — the same category influencer marketing and GDPR: what brands need to know already names for competition entrants. GDPR's Article 4(11) defines consent as "any freely given, specific, informed and unambiguous indication of the data subject's wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her." Four conditions have to hold at once: consent has to be freely given, specific, informed and unambiguous.

Article 7(4) adds a "bundling" warning: when assessing whether consent is freely given, utmost account has to be taken of whether the performance of a contract — including the provision of a service — is made conditional on consent to processing that isn't necessary for that contract's performance. Applied to a giveaway: making competition entry itself conditional on consent to future marketing isn't automatically unlawful under GDPR — but it means the consent still has to be specific and informed, not just a pre-ticked box.

Denmark's markedsføringsloven § 10: a separate Danish requirement, not the same as GDPR

On top of the GDPR consent, a separate Danish requirement applies: markedsføringsloven § 10, the spam ban, requires prior consent before a business can contact anyone electronically for direct marketing purposes. Per Forbrugerombudsmanden's own guidance, direct marketing is defined broadly to include newsletters, SMS messages and — explicitly — "an invitation to a competition or special events": a competition invitation itself counts as marketing if the recipient hasn't already given consent. Consent, per the same guidance, has to be obtained in advance, has to clearly state the sending company and the communication channel (email, SMS), and cannot be obtained through pre-ticked checkboxes.

In practice, that means a brand using an influencer giveaway to build an email list has to satisfy two separate rulebooks at the same time: GDPR's consent requirement for the data processing itself, and markedsføringsloven § 10's consent requirement for the future electronic contact. The two consents can, in practice, be obtained in a single action — but both conditions have to be met, not just one of them.

The SmartResponse decision: what Datatilsynet actually approved — and what it criticized

The most directly relevant Danish decision on exactly this question is Datatilsynet's ruling of 30 September 2022 (case no. 2020-431-0075) on the company SmartResponse, opened after a referral from Forbrugerombudsmanden. SmartResponse ran internet competitions where entrants filled in name, email, phone and gender — and, by clicking "DELTAG NU" ("enter now"), simultaneously consented to receive marketing by phone, SMS, email and letter from ClubSmart, SmartResponse A/S and the competition's 45 partner companies.

Datatilsynet found the consent mechanism itself valid under GDPR Article 6(1)(a): the consent was judged "specific and informed" because the purpose, the data types and the partners' identities were disclosed, including via a direct link. Datatilsynet also rejected a requirement that consent to SmartResponse's own use and consent to sharing data with the partners had to be separated into two distinct actions — the authority found that the purpose of both processing activities was, in substance, the same: direct marketing. That's the central, corrective finding for this article: a combined competition-entry-plus-marketing-consent action isn't automatically invalid, provided the disclosure of purpose, recipients and data handling is clear enough.

What Datatilsynet did give serious criticism for was something else entirely: a "no thanks" list, where SmartResponse retained the phone numbers and emails of people who had withdrawn their consent for up to 5 years. Datatilsynet found that retention to be unnecessary processing in breach of GDPR Article 5(1)(c) and Article 6, and issued a binding order to delete the records within 4 weeks. The authority also criticized a blanket 5-year retention period justified by criminal statute-of-limitations reasoning, finding it incompatible with Article 5(1)(e)'s storage-limitation principle — a case-by-case necessity assessment was required instead.

The genuine takeaway for a brand building a list through an influencer giveaway: the technical validity of the consent action itself is rarely what goes wrong. What goes wrong is what happens afterward — whether an opted-out contact is actually deleted, or left sitting on an internal list "just in case."

Comparison: three ways to collect contact details

Model	What the entrant provides	Usable for future marketing?	Requirements
Plain competition entry (no marketing use)	Name, email — only to identify and contact the winner	No	No separate marketing consent needed — but the data can't be reused for any purpose beyond running the competition
Competition + bundled marketing consent (the SmartResponse model)	Name, email — plus consent to future marketing, often in the same action as entry	Yes, if the consent is specific and informed about purpose, recipients and retention	GDPR Article 6(1)(a) + markedsføringsloven § 10 consent; no pre-ticked boxes; a clear deletion process on withdrawal
Lead magnet (a download in exchange for an email, no competition element)	Email, often name — in exchange for a guide, checklist or discount code	Yes, on the same terms as above	The same two rulebooks apply — the absence of a competition element doesn't change what the marketing-consent requirement itself demands

Lead magnets as an alternative or complement to a giveaway

An influencer-run lead magnet — a free guide, a checklist, a discount code in exchange for an email address — builds the same kind of list as a giveaway, without the competition element, and therefore without having to deal with Danish prize tax or Spillemyndigheden's gambling-licence requirement. The creator links to a landing page where the follower types in their own email to get access to the material. The same two rulebooks — the GDPR consent and the markedsføringsloven § 10 consent — apply exactly as with a giveaway; the absence of a competition element doesn't change what the marketing-consent requirement itself demands, it just removes the competition-specific rules.

The difference is in the incentive, and in how many people actually convert. A giveaway with an attractive prize typically pulls in more entrants, because the effort required (one comment, one click) is lower than filling in a form for a guide — but a portion of those entrants are there purely for the prize and have low real interest in the brand. A lead magnet typically pulls in fewer, but more qualified contacts, because the act itself — downloading a guide about a specific topic — signals interest in the topic on its own.

What the entry flow actually needs to look like

• State clearly who is sending, and what. Not just "get updates" — name the company and the communication channel (email, SMS), as Forbrugerombudsmanden's guidance requires.
• No pre-ticked boxes. The entrant has to actively opt in — that satisfies both GDPR's requirement for an "unambiguous" action and markedsføringsloven § 10.
• Name the purpose and the recipients if the data is shared with partners. The SmartResponse decision shows a combined consent action can be valid — but only if the recipients and the purpose are clearly stated, not hidden behind a link nobody reads.
• Build deletion in from the start, not as an afterthought. The serious criticism in the SmartResponse case didn't target the consent mechanism itself — it targeted opted-out contacts being left on file for years. Set a concrete deletion timeframe, and stick to it.
• Link to a privacy notice that explains how long the data is retained and who it might be shared with.
• Write the requirement into the brief to the creator, not just onto the landing page itself — see what to put in an influencer contract for how a specific requirement like this generally belongs in the agreement.

Decision framework

IF the only goal is picking a winner, and you don't need a list afterward → keep the entry form to the strict minimum (name and a way to contact the winner), and state explicitly that the data won't be used for anything else. Simpler, faster to set up, and no marketing-consent requirement at all.

IF the goal is building a list, and you have the resources to actually run it properly → add a separate, specific marketing consent to the entry flow, with a clear sender, purpose and retention period. The SmartResponse decision shows this can be done in the same action as entry, provided the disclosure is clear.

IF you're unsure whether a giveaway or a lead magnet fits better → choose a giveaway for reach and volume, a lead magnet for quality and relevance. Many brands run both, depending on the campaign's goal.

IF you're already running a "no thanks" list of people who withdrew consent → set a concrete deletion timeframe now. That's exactly what Datatilsynet gave serious criticism for in the SmartResponse case — not the consent mechanism itself.

Worked example: what a list can be worth compared to a tracking cookie (illustrative)

The numbers below are a made-up worked example to illustrate the point — not a real Make Influence customer case, and not a benchmark for what any specific campaign actually converts at.

Assume an influencer giveaway generates 2,000 entrants, of whom 60% (1,200) actively opt in to marketing consent in the same flow. A tracking cookie set in the same campaign typically has a 30-day lifetime, after which it can no longer match a purchase back to the click — see how influencer tracking actually works for the technical detail. The email list of 1,200 opted-in contacts has no built-in expiry — it can be used to re-contact the same people six months, a year, or longer from now, provided consent hasn't been withdrawn. If just 5% of the 1,200 (60 people) later convert via a follow-up newsletter that a tracking cookie would long since have lost the connection to, that illustrates the structural difference: a cookie is a time-limited window, a list is a durable asset — for as long as consent is kept valid and up to date.

Common mistakes

• Assuming competition entry automatically grants the right to send marketing afterward. It doesn't — it requires a separate, specific consent, as described above.
• Pre-ticked checkboxes. Both GDPR and markedsføringsloven § 10 require an active, unambiguous action — not a box the entrant has to opt out of.
• Leaving a "no thanks" list sitting for years with no deletion timeframe. That was the actual criticism in the SmartResponse case — not the consent design itself.
• Confusing the giveaway rules (prize tax, the tag-a-friend spam ban) with the marketing consent question. They're two different rulebooks that both have to be satisfied, but solve different problems — see how to run an influencer giveaway or contest, legally for the first one.
• Assuming a list replaces the need for tracking. An email list complements, rather than replaces, sales tracking — the two solve different parts of the measurement problem.

Make Influence's operational perspective

In our experience, the real risk in a giveaway-built list is rarely the consent design itself — the SmartResponse decision shows a combined competition-and-marketing action can be valid, provided the disclosure is clear. The real risk sits in what happens afterward: whether opt-outs are actually honored and deleted within a reasonable timeframe. We recommend building a concrete deletion process into the campaign from the start, not as something decided the day the first opt-out request lands. Much like cookie-based tracking can degrade over time as cookie law tightens, a well-maintained first-party list is one of the few assets in influencer marketing that only becomes more valuable the longer you own it — provided it stays clean and current.

FAQ

Can we use the same checkbox for competition entry and marketing consent?

Yes — Datatilsynet's SmartResponse decision shows a combined action can be valid, provided the purpose, recipients and data types are clearly disclosed. What's not allowed is a pre-ticked box, or a consent given without real information about what's being consented to.

Do we need one consent or two — one for GDPR and one for the marketing law?

The two rulebooks can, in practice, be satisfied with the same action, but both conditions have to be met simultaneously: GDPR's requirements for valid consent (freely given, specific, informed, unambiguous), and markedsføringsloven § 10's requirement for prior consent to electronic marketing.

How long can we keep data on people who withdrew consent?

No longer than necessary for a specific, documented purpose. Datatilsynet issued serious criticism of a blanket 5-year retention period in the SmartResponse case and required a case-by-case necessity assessment instead.

Can we share giveaway entrants' data with partner companies?

Only if the consent clearly discloses which partners are involved and what the purpose of the sharing is. The SmartResponse case shows this can happen within a single consent action, but without transparency about the recipients, it isn't valid.

Is a lead magnet a better choice than a giveaway if the goal is a list?

It depends on the goal: a giveaway typically pulls in more, less qualified contacts; a lead magnet typically pulls in fewer, more interested ones. Both require the same legal basis for the marketing consent itself.

Do these rules still apply if the creator collects the data themselves before handing it to the brand?

Yes. Who technically collects the data doesn't change the consent requirements — but it can affect who's actually the data controller; see influencer marketing and GDPR: what brands need to know for how that role split works between brand, platform and creator.