Privacy, email, texts and contests

Creators collect more personal information than they often realize: email addresses for newsletters, phone numbers for text clubs, names and addresses for giveaways, purchase data from shops and analytics about every viewer. They also run promotions that the law treats specially, such as contests, sweepstakes and giveaways. This lesson covers the privacy rules that apply when creators collect and use audience data, the anti-spam laws that govern email and text marketing, and the legal requirements for contests and giveaways in your country. These are areas where small mistakes, such as a pre-checked consent box or a giveaway with no proper rules, can create surprisingly large liability.

Personal information in a creator business

Personal information is information about an identifiable individual. In a creator business it includes names, email addresses, phone numbers, mailing addresses, payment details, account usernames linked to real people, location data and, increasingly, biometric data such as face or voice recordings. Privacy laws generally require that you collect only what you need for clear purposes, obtain meaningful consent, protect the data, keep it no longer than necessary and let people access or correct it.

• Collect the minimum: a newsletter needs an email address, not a birth date and home address.
• Explain purposes clearly when collecting: what you will send, how often and whether data will be shared with brands.
• Do not share audience data with brands unless people agreed to that specifically.
• Secure the data with strong passwords, two-factor authentication and reputable service providers.
• Delete data you no longer need, such as giveaway entries after the winner is confirmed and the contest period ends.

Canadian privacy law

In Canada, the Personal Information Protection and Electronic Documents Act (PIPEDA) governs private-sector collection, use and disclosure of personal information in the course of commercial activities, except in provinces with substantially similar laws for activity within the province: Quebec, Alberta and British Columbia. PIPEDA is built on ten fair information principles, including accountability, identifying purposes, consent, limiting collection, safeguards and individual access. The Office of the Privacy Commissioner of Canada oversees it.

Quebec's Act respecting the protection of personal information in the private sector was overhauled by Law 25, with changes phased in between 2022 and 2024. It requires privacy by default, privacy impact assessments in some cases, express consent for sensitive information, and consent of a parent or guardian to collect information from a minor under 14. Penalties are significant: administrative monetary penalties up to $10 million or 2 % of worldwide turnover, and penal fines up to $25 million or 4 % of worldwide turnover.

Federal reform has been attempted several times. A bill to replace PIPEDA died when Parliament was dissolved in 2025, and a new bill, the Protecting Privacy and Consumer Data Act (Bill C-36), was introduced in 2026. At the time of writing it had not become law, so PIPEDA remains the federal standard.

Email and text marketing

Newsletters and text clubs are valuable because creators own the relationship rather than renting it from a platform. Anti-spam laws regulate them, and the rules differ significantly between the two countries.

Canada's Anti-Spam Legislation (CASL), in force since 2014, is among the strictest anti-spam laws in the world. It applies to commercial electronic messages, which include emails, texts and direct messages on social platforms that encourage participation in a commercial activity. It requires three things for each message:

• Consent: express consent, such as someone actively ticking an unticked box or typing their email into a sign-up form with a clear explanation, or implied consent in limited situations, such as an existing business relationship within set time periods. Pre-ticked boxes do not create express consent.
• Identification: the sender's name and contact information, including a mailing address and a phone number, email address or web address.
• Unsubscribe: a simple, free unsubscribe mechanism in every message, which must work for at least 60 days after the message is sent and be honoured within 10 business days.

The Canadian Radio-television and Telecommunications Commission (CRTC) enforces CASL. Administrative monetary penalties can reach $1 million per violation for individuals and $10 million per violation for businesses. Directors and officers can be personally liable, and the CRTC has imposed penalties on individuals as well as companies.

Contests, sweepstakes and giveaways

Giveaways are one of the most common creator promotions, often run with brand partners. Many people assume a giveaway is simple: post, pick a winner, ship the prize. But contests are a regulated area because of gambling laws, and they create disclosure duties under advertising law.

In Canada, the Criminal Code's illegal lottery provisions, in section 206, prohibit schemes that combine a prize, chance and consideration (something of value paid to enter) unless licensed. Promotional contests avoid the provisions by removing chance, which is why Canadian winners must correctly answer a mathematical skill-testing question, and by offering a no-purchase-necessary way to enter. Section 74.06 of the Competition Act requires adequate and fair disclosure of the number and approximate value of prizes, the regional allocation of prizes, any fact that materially affects the chances of winning, such as the odds or the number of entries expected, and requires that participants be selected and prizes distributed without undue delay. Contests open to Quebec residents above a modest prize-value threshold must also be declared to the Régie des alcools, des courses et des jeux, with duties paid.

• Write official rules and link them in every giveaway post.
• State who is running the giveaway and who provides the prize, and disclose the brand relationship.
• Specify eligibility, including age and location, and exclude places where the giveaway would be unlawful.
• Avoid requiring purchases to enter, or provide a free alternative.
• Do not require entrants to post positive reviews; asking for tags or follows is allowed by some platforms but not others.
• Follow platform promotion rules, which typically require a statement that the platform does not sponsor or endorse the promotion.
• Collect only the personal information needed and delete it afterwards.

Tracking, analytics and brand partners

Creators use tracking links, pixels and analytics tools that collect data about audiences. Brands often ask creators to install their tracking pixels on a website or to share audience data for campaign reporting. Before agreeing, a creator should understand what data the tool collects, whether it identifies individuals, whether it is shared with the brand or third parties and whether the creator's privacy notice covers it. Aggregated, de-identified statistics, such as total clicks, views and conversion counts, are generally safe to share. Lists of individual subscribers, customers or giveaway entrants are personal information and should be shared only where people clearly agreed to that sharing.

A creator's website or shop needs a privacy notice that explains, in plain language, what information is collected, why, with whom it is shared, how long it is kept and how people can contact the creator to access, correct or delete it. Cookie banners and consent tools are required in some places and are good practice everywhere when non-essential tracking is used.

Security and breaches

Privacy law also requires reasonable security. Creators are targets for account takeovers, phishing and data theft because their accounts and audience lists are valuable. Practical safeguards include unique strong passwords stored in a password manager, two-factor authentication on every account, limiting who has access to email lists and stores, removing access when assistants or agencies leave and choosing reputable service providers. If a breach happens and personal information is exposed, privacy laws may require notifying affected people and the regulator, depending on the risk of harm, and keeping a record of the breach. A quick, honest response reduces both legal risk and damage to audience trust.

Multi-partner giveaways

Large giveaways often involve several creators and brands, each promoting a shared prize pool. These raise extra questions: who is the official sponsor responsible for the rules, who collects and holds entrants' data, how entries from each creator's audience are combined and whether each partner may contact entrants afterwards. Agree these points in writing before launch, name all sponsors in the rules, tell entrants who will receive their information and make any marketing consent separate and optional. Each creator must still disclose their own relationship with the brands involved in their own posts.

Retention and deletion

Keeping personal information longer than needed increases risk without adding value. Set simple retention rules: delete giveaway entries within a few months after the winner has received the prize and any disputes are resolved, remove unsubscribed contacts from marketing lists while keeping a suppression record so they are not emailed again, and review customer records periodically. Write the rules down and follow them consistently, because privacy laws in both countries expect personal information to be kept only as long as necessary for the purposes it was collected for. When someone asks you to delete their information, respond promptly and confirm when it is done.

Direct messages and community features

Creators increasingly use direct messages, broadcast channels, community chats and membership platforms to reach their most engaged followers. Commercial messages sent through these channels can fall under anti-spam laws as well as platform rules, and personal information shared in them, such as names, locations or health details, is still personal information. Avoid sending unsolicited promotional direct messages, respect opt-outs in community channels, do not export member lists to other tools without consent and set clear community rules about what members should not share publicly. When a brand partner wants to message your community, the brand should do so only through features members agreed to and with your clear disclosure of the relationship.