Running a Fair Giveaway: Entry Rules, Duplicate Checks and the Draw

A giveaway has one promise: every honest entrant gets the odds the rules describe. Duplicate entries break that promise. They also pollute the numbers the client is paying for, because each duplicate is a fake "new person" the brand rewarded with a chance at a prize.

This post is for agencies and brands that run giveaways, sweepstakes and promotions for clients. It covers how to write entry rules that hold up, how duplicate entries get caught in layers, why the claim step does the most work, how to handle an entrant who was wrongly disqualified, and how to test your own checks before launch. It does not help anyone enter more than the rules allow, and the rules you write should make clear that doing so voids every entry.

Why Entry Limits Exist

Giveaways aren't charity. A brand runs one to reach new people: email sign-ups, follows, people who might buy something later. If one person submits a few hundred entries, the sponsor's numbers are polluted and every honest entrant's odds shrink.

There's a legal reason too. In the US, broadly speaking, a promotion that combines a prize, chance and some form of payment can count as an illegal lottery, which is why sweepstakes remove the payment element ("no purchase necessary") and publish official rules. Those rules are the sponsor's promise that the draw is run fairly. A sponsor that knowingly lets one person stack entries is breaking its own published terms. Other countries frame it differently, but the expectation of a fair draw under published rules is close to universal. Get legal advice for each jurisdiction you run in.

Write the Entry Rules First

Most disputes trace back to the rules, not the software. Good official rules state, in plain words and near the entry button:

• The entry limit, and what it is counted against: per person, per email address, per household, per day.
• What happens to entries above the limit. Most rules void them, and many reserve the right to disqualify every entry from a person who tried to exceed it.
• Eligible territories and ages.
• Alternative method of entry, where the law in your market requires one (many US sweepstakes offer a free mail-in entry).
• A named sponsor or administrator with contact details, and a written appeal route.
• How the winner is selected and verified, including the declaration and ID check at prize claim.

A limit buried in a PDF paragraph under six-point grey text invites disputes. Put it next to the button.

Be careful with "one entry per household". It treats four unrelated adults in a flatshare as one person because of how a router happens to be wired, so state clearly what counts as a household and give an appeal route.

How Duplicate Entries Get Detected

Detection on a serious promotion is layered. None of these layers is decisive alone. What flags a set of entries is that several of them point the same way.

1. The entry details themselves. This is the cheapest check and catches the most. Email addresses get normalised: Gmail, for example, ignores dots in the part before the @ and delivers "name+anything" to the same inbox, so j.smith+win1@ and jsmith+win2@ collapse to one person. (Google documents both behaviours in its Gmail help pages.) Postal addresses get standardised. Phone numbers get compared. Names and dates of birth that repeat across "different" entrants stand out.

2. Network signals. Several entries from the same IP address in a short window get grouped. Treat that as a prompt to look closer, not proof: shared Wi-Fi, universities and mobile carriers put many honest people behind one address. Datacenter and VPN ranges often push an entry into manual review.

3. The device and browser. A browser exposes a lot about the machine it runs on: how it draws a hidden canvas image, the GPU name reported through WebGL, the installed font list, screen size, timezone and language. Combine them and you get a fingerprint that's fairly stable for one device. We've covered the less obvious signals in our piece on audio, font and hardware fingerprinting. Some promotions buy this from fraud-scoring vendors such as SEON or Fingerprint; others rely on whatever their giveaway tool provides. A timezone that disagrees with the claimed location is a classic review flag, the same timezone mismatch logic ad platforms use on suspicious clicks.

4. Behaviour. How fast forms get filled. Whether bonus actions are completed or just clicked. Ten entries that arrive at suspiciously regular intervals. Referral chains where every "friend" referred is another entry from the same cluster.

5. Human review. Look at the shortlist before drawing, and at the potential winner afterwards. A reviewer with a spreadsheet of entries sees patterns no script needs to.

6. The prize claim. This is the one that matters most, and it has nothing to do with browsers.

The Layer That Does the Most Work: Claiming the Prize

Before a prize changes hands, the potential winner is typically asked to confirm their identity and sign a declaration (often called an affidavit of eligibility) stating they met the rules, plus a release, and often tax details for larger prizes. Rules commonly say that if the winner can't be verified, or turns out to have broken the entry limit, the prize is forfeited and an alternate is drawn.

Think about what that means for duplicate entries. Entries under invented names can't claim anything, because an invented person can't prove they exist. Several entries under one real name get matched to that person at exactly the moment they step forward. And entries under a friend's or relative's identity mean either that person claims the prize, which is legally theirs, or someone signs a false declaration, which is where a rules breach starts to look like fraud.

The practical lesson for anyone building a promotion: spend modestly on device fingerprinting and carefully on the claim step. One signed declaration does more work than a year of canvas hashes. Most promotion tooling is built the other way round.

Running the Draw

A draw you can defend has a short list of properties:

• Deduplicate before drawing, not after. Merge or void duplicates first so the pool reflects one chance per allowed entry.
• Use a documented random selection and record the method, the time and who ran it.
• Draw alternates in case the first winner fails verification, and say in the rules how long they have to respond.
• Verify before announcing. Confirm eligibility and identity first, then publish the winner.
• Keep records of the pool, the draw and the verification for as long as your local rules require.

What Duplicate Entries Cost the Entrant

Your rules should say what happens, because it is also your deterrent:

• Every entry void, not just the duplicates. Most official rules reserve that right.
• Forfeited prizes, and in some cases a request to return a prize if the breach comes out after delivery.
• Bans from future promotions run by that sponsor, agency or giveaway platform.
• Fraud exposure if fake or borrowed identities were used to obtain a prize. The specifics depend on the jurisdiction.

Giving Entrants Legitimate Ways to Get More Chances

Fair promotions give honest entrants real options, which also reduces the pull towards cheating:

• Daily or recurring entry, one entry per person per day.
• Bonus entries you offer, such as following an account, referring a friend who genuinely enters, or answering a quiz.
• A free alternative method of entry where required.
• Clear per-person rules for household members, so each eligible adult can enter once on their own behalf where the rules allow it.

Handling an Entrant Who Was Wrongly Disqualified

False positives happen. Shared Wi-Fi in a flat, a family computer, a university network, a mobile carrier that puts lots of customers behind one IP address: any of them can make honest entrants look like a cluster.

Build a simple appeal process:

1. Publish a named administrator and contact details in the official rules.
2. Ask the entrant for the single email address they entered with, the date, and a plain explanation of the shared connection.
3. Review the entry on its merits. A shared IP address alone should lead to review, not automatic disqualification.
4. Reply in writing, within the time the rules promise.

Promotions inboxes are often an agency alias nobody owns. Assign someone to it, because silence is the most common complaint.

Testing Your Duplicate-Entry Checks Before Launch

If you run promotions, you need to know your checks work before real entrants find the gaps. That's a testing problem, and a multi-account browser handles it well, because each profile is its own browser with its own cookies, storage, proxy and identity parameters.

On your own staging or test promotion, create test entries from separate profiles set to different locales, timezones and proxies, including some that reuse an email variant, address or phone number, and confirm that your deduplication groups the ones it should on entry details rather than on the browser alone, your geo-eligibility check refuses the regions it should, and your winner-review step flags what it should. Include the false-positive case: two genuinely different test entrants behind the same network must not be disqualified automatically.

Sensible ways teams use JustBrowser around giveaways:

• QA on your own promotion. Run the test entries above in staging or a test mode, never against a live promotion that real entrants are in. The same approach works for testing lead-gen forms across geos.
• Checking geo-restricted eligibility. A promotion open to one country should show the right rules and refuse ineligible regions. Profiles pinned to different locales let you see what each audience sees.
• Ad verification. Confirming the ads promoting a giveaway render correctly in each target market, as covered in our ad verification workflow.
• Agency work in client-owned accounts. Staff logging into a client's giveaway tool or social accounts, with the client's permission, without mixing that client's sessions with another client's. Team seats are free, and a seat can run the profiles shared with it.

In plain terms, JustBrowser is a custom Chromium engine with native C++ integration (not an extension), patched on every upstream Chromium release, with 40+ identity parameters. It runs on Windows x64 and macOS (Apple Silicon). Proxies aren't included in the subscription; bring your own or buy a proxy plan in the app, and route them per profile. A local REST API and CDP let you script test runs with Playwright, Puppeteer or Selenium. If you're new to the category, what a multi-account browser actually is is a better starting point than this post.

It is not a tool for entering promotions more times than the rules allow.

Two sister products sit on the detection side of the same problem: ClickzProtect for bot filtering (its glossary of bot-detection terms pairs well with this post) and JustAnalytics for cookieless analytics on where promotion traffic really comes from.

Frequently Asked Questions

Why do giveaway rules limit entries per person?

Because a brand runs a giveaway to reach new people, and every duplicate entry is a fake new person the brand paid a prize to acquire. A per-person limit, often tightened to one per email address or household, keeps the draw fair for everyone who entered once. Entries above the limit are void, and the rules usually let the sponsor disqualify every entry from a person who exceeded it.

How do sponsors detect duplicate giveaway entries?

By combining layers: normalised entry details (email variants, addresses, phone numbers), network signals such as shared IP addresses, device fingerprints from the browser, behavioural timing, referral patterns, manual review, and identity checks at prize claim. No single layer decides it; the cluster does.

A genuine entrant was disqualified after entering once. What should we do?

Provide a named contact and a written appeal route in the official rules. Ask the entrant for the single email they entered with, check for innocent overlap such as a shared household connection or a family computer, and reply in writing. Treat a shared IP address on its own as a reason to review, not a reason to disqualify.

Is entering a sweepstakes multiple times illegal?

Going over an entry limit is mainly a rules breach that ends in disqualification. Using invented or borrowed identities to win or claim a prize is different: depending on the jurisdiction it can be treated as fraud. This isn't legal advice; if you're unsure, read the official rules and ask a lawyer where you operate.

How can an agency test its duplicate-entry checks before launch?

Run the promotion in a staging or test mode, create test entries from separate browser profiles in different locales, including some that reuse entry details, and confirm the deduplication, geo-eligibility and winner-review steps catch what they should. Separate profiles make that kind of QA repeatable.

---

Try JustBrowser

A multi-account browser for teams, built on a custom Chromium engine with native C++ integration, not extension-based. Each profile is its own browser, with its own cookies, storage, proxy and 40+ identity parameters. Local REST API and CDP for Playwright, Puppeteer, Selenium. Windows x64 and macOS (Apple Silicon). $9.99/month or $99.99/year. 7-day free trial, card required — cancel any time in the seven days and you are not charged. Unlimited profiles.

Get started → · How it differs from Multilogin / GoLogin / AdsPower