How to Comply with the Voluntary Code of Good Practice: A Clause-by-Clause Implementation Guide for Prize Draw Operators

Who this guide is for

This guide is written for operators of UK prize draw and competition websites who need to comply with the DCMS Voluntary Code by 20 May 2026. Whether you’re starting a competition website from scratch or running an established site that now needs updating, the implementation requirements are the same. It is equally useful for developers and agencies building competition websites on behalf of operators. For operators who’d rather hand the full implementation to a specialist team, our competition website design service builds every clause of the Code into every site we deliver.

It does not apply to operators who run skill-based competitions only, because the Code specifically covers prize draws that qualify for the free-entry-route exemption under the Gambling Act 2005. It also does not apply to licensed lottery operators, who sit under a separate regulatory regime.

The 20 May 2026 deadline: what it actually means

The 20 May 2026 date is the implementation deadline for every operator who has signed the Code. It is the cut-off point by which every measure in the Code must be fully operational on your website and in your business processes.

The Code was published by the Department for Culture, Media and Sport (DCMS) on 21 November 2025, with a six-month implementation window. Signatories agreed at the point of signing to implement the Code in full by 20 May 2026. Any operator becoming a signatory after that date must comply from day one.

The Code is voluntary, which means non-compliance is not itself a legal breach. However, DCMS has made clear that if voluntary adoption fails to raise standards, legislative intervention is likely. That means either bringing prize draws under the Gambling Commission’s regulatory remit, or introducing bespoke legislation for the sector. Either outcome would be significantly more restrictive than the current Code.

For operators, the Code is therefore best treated as the floor rather than the ceiling. Meeting its requirements protects your business commercially (signatory status is increasingly expected by payment providers, ad platforms, and affiliates) and shields you from the harder regulatory framework that is likely to follow if the industry fails to self-regulate.

How the Code is structured

The Code is divided into three pillars covering 22 individual clauses. Pillar 1 (Player Protections) contains 11 clauses covering age verification, spending controls, harm monitoring, and support signposting. Pillar 2 (Transparency) contains 6 clauses covering how draws are conducted, how free entry routes are presented, and how prizes and charitable contributions are handled. Pillar 3 (Accountability) contains 5 clauses covering internal compliance processes, third-party oversight, and public disclosure.

Each clause below is quoted in full from the Code and followed by a plain-English explanation, a numbered implementation checklist, any technical considerations that apply, and the decisions you need to make before going live.

Pillar 1: Player Protections

The Player Protections pillar is the largest and most implementation-heavy part of the Code. It draws directly on the player-protection standards applied to licensed gambling operators and adapts them to the prize draw context. Most of the clauses in this pillar translate into specific competition website features that need to be designed, built, and tested before go-live.

Clause 1.1: Age verification and protection of under-18s

Operators should only make prize draws available for players aged 18 or over. Operators should implement a reasonable age verification process. Advertisements for prize draws should not be targeted at anyone below the age of 18.

What this clause requires. A reasonable age verification process, not a self-declared tick box. The standard set by gambling regulation is the reference point: you must capture and validate a real date of birth, store it against the customer account, and block any entry attempt by someone under 18.

How to implement it on your website:

1. Add a mandatory date of birth field to the account signup flow. Use a date picker rather than free text to avoid formatting errors.
2. Run the validation server-side, not just in the browser. Client-side validation can be bypassed by disabling JavaScript or by automated entry tools. Your server must calculate age from the submitted DOB and reject any account under 18.
3. Handle existing customers who signed up before this change. The two practical options are a pop-up on their next login requesting their date of birth, or an additional required field at the next checkout. The customer should not be able to complete any entry, paid or free, until the DOB is captured.
4. Store the date of birth against the account so the check only happens once. Repeated prompts create a broken customer experience and risk cart abandonment.
5. Block the checkout entirely if the field is empty, invalid, or the calculated age is under 18, with a clear on-screen explanation.
6. Configure your advertising platforms (Meta, Google, TikTok, Snapchat) to exclude under-18 audiences. On Meta and TikTok this is a single audience-exclusion toggle. On Google Ads it requires age-group exclusions in the audience settings of every campaign.
7. Display visible “18+ only” messaging in the site header, footer, and checkout.

Technical considerations. If you run high-demand draws (a major cash draw closing at a set time, or an instant win launching at a set moment), be careful about when you roll DOB capture out to existing customers. Thousands of customers can hit the site in the same few minutes, and if every one of them is prompted to fill in a new mandatory field at the same moment, each submission triggers a database write. Under peak load this can slow the site or cause checkout errors at precisely the moment you need performance to be fastest.

Two ways to manage this. First, phase the DOB capture rollout across several days leading up to the implementation date rather than switching it on the night before a major draw. Second, cache the verification once a date of birth is stored against the account, so subsequent entries don’t re-query the database to confirm the check.

What you need to decide. Whether you have any scheduled draws in the two weeks leading up to 20 May 2026, and plan the rollout window around them.

Clause 1.2: Complaints and dispute resolution

Operators should have an appropriate, transparent and robust complaints process for players and, where required to resolve a complaint, an appropriate dispute resolution process for players.

What this clause requires. A clear, accessible complaints process on your website, and access to independent dispute resolution for complaints that cannot be resolved directly between you and the player.

How to implement it on your website:

1. Add a dedicated “Complaints” page linked from the footer of every page. Write it in plain English and cover how to raise a complaint, what information to include, who handles it, and how long each stage takes.
2. Build a complaints submission form that captures the customer’s details, the specific draw or order in question, and the nature of the complaint. The form should route submissions to a designated email inbox and log them in your admin panel so nothing is lost.
3. Publish clear response timeframes. The standard used across UK consumer regulation is three working days to acknowledge and 20 working days to fully respond. Publish these on the complaints page and make sure your internal workflow hits them.
4. Add an escalation section explaining that if the customer is not satisfied with the outcome of the direct complaints process, they can refer the complaint to an independent dispute resolution provider. List the provider’s name and contact details.
5. Cross-reference the complaints process from your terms and conditions and your “measures we have in place” page (see Clause 3.4).

What you need to decide.

1. The email address that complaints should route to, and the internal owner responsible for monitoring and responding within the published timeframes.
2. An Alternative Dispute Resolution (ADR) provider. The Centre for Effective Dispute Resolution (CEDR) and ProMediate are the two most commonly used in the UK for consumer disputes. Membership is typically a few hundred pounds a year. You need to sign up before publishing the complaints page so the provider can be named.
3. Your response timeframes. Three working days to acknowledge and 20 working days to fully respond is the safe default.

Clause 1.3: Credit card restrictions

Operators should not accept credit card payments in excess of £250 per month per player (“credit card limit”). Operators should not accept any credit card payments whatsoever for any instant win prize draws.

What this clause requires. Two separate restrictions, both applying to direct credit card payments and to credit card payments routed through money service businesses:

1. No more than £250 per month per player on credit card payments across all draws.
2. No credit card payments at all on instant win prize draws, regardless of amount.

Why this ideally needs to happen at payment provider level. Tracking the £250 limit only at website level leaves gaps that undermine the point of the clause. A determined customer can create a second account under a different email address to reset the counter, or split spending across multiple credit cards. The site has no way of knowing those accounts or cards belong to the same person.

Enforcing the limit at payment provider level ties it to the card rather than the account. The limit then follows the customer across any account they register on your site, and the provider can see the true total spend across all their cards on your platform. This is the more robust, Code-aligned way to meet the clause.

How to implement it:

1. Contact your payment provider and ask whether they can enforce a £250 monthly credit card spend limit at card level across your account, and whether they can block credit card payments on specific product types (to cover the instant win requirement). If they can, get it configured.
2. Layer site-level controls on top as a first line of defence. Track credit card spend per account per calendar month, and block further credit card payments once £250 has been reached. Allow debit card, Apple Pay, Google Pay, and any other non-credit payment methods to continue.
3. Block credit card as a selectable payment option on any instant win draw. This should be controlled at product type level in your CMS so the block is applied automatically to any new instant win you add, not manually draw by draw.
4. Add a clear checkout message when a player approaches or reaches the limit, explaining the limit and pointing to alternative payment methods.
5. Reset the counter at the start of each calendar month, not on a 30-day rolling basis.

Technical considerations. If your payment provider cannot support card-level enforcement by 20 May 2026, the site-level controls become your primary compliance mechanism. Document this on your “measures in place” page: the limit is enforced at account level today, with card-level enforcement to be added when provider capability is available. This demonstrates good faith and gives you a clear audit trail if your approach is questioned. Operators who are still experiencing broader payment provider rejection or friction should treat Clause 1.3 as part of the same conversation, because providers comfortable with the Code are increasingly the ones comfortable with the competition sector as a whole.

What you need to decide.

1. Speak to your payment provider and confirm what they can enforce at card level and on what timeline.
2. Confirm whether your CMS has an “instant win” product type flag. If not, you will need to add one so the credit card block can be applied automatically to all products of that type.

Clause 1.4: Monthly spend limits

Subject to the credit card limit in clause 1.3, operators should set suitable and proportionate maximum monthly total spend limits for all players, or provide the facility for players to set individual monthly total spend limits which cannot be exceeded. Operators should allow customers to set their individual spend limit at £0.

What this clause requires. You must implement one of two approaches, or a combination of both. Either a fixed monthly spend limit applied to every player, or a player-set monthly limit that each customer chooses themselves with £0 being a valid option. The limit must apply across every draw you run, not per draw.

Which approach to choose. A fixed limit is simpler for customers and easier to manage operationally. There is no additional signup step, no limit management UI, no cooling-off logic on increases, and no confusion for customers who are not sure what to set. The downside is that a fixed limit is blunt: it applies identically to someone entering £5 a month and someone entering £500 a month.

A player-set limit gives individual customers control. It matches the approach taken by licensed gambling operators and satisfies the £0 requirement cleanly. The downside is UI complexity, additional customer support queries, and the cooling-off rule on increases.

A hybrid approach (a fixed ceiling with the option for players to set a lower individual limit) combines the simplicity of a fixed limit with full satisfaction of the £0 requirement. This is the recommended pattern for most operators.

How to implement it on your website:

1. Decide your fixed ceiling. £750 per calendar month is a reasonable starting point for a typical operator, generous enough that most normal customers will never approach it while still providing a meaningful cap. Adjust up or down based on your average basket size and typical repeat customer behaviour.
2. At signup, capture an optional “set your own lower limit” value, allowing any figure from £0 up to the fixed ceiling.
3. For existing customers, prompt them to set an optional lower limit the next time they enter, before allowing further entries.
4. Track total monthly spend against each account across every payment method and every draw, resetting at the start of each calendar month.
5. Block further entries once the effective limit (the lower of the fixed ceiling or the player-set figure) is reached, with a clear message explaining why.
6. Allow players to adjust their limit in their account area. Decreases apply immediately. Increases take effect only after a 24-hour cooling-off period, matching the standard used in licensed gambling. This prevents impulsive limit raises during a session.
7. Display a “monthly spend remaining” indicator in the customer’s account area.
8. Build a spend limit view into your admin panel showing each player’s current monthly spend and their effective limit.
9. Publish the limit (both the fixed ceiling and the ability to set a lower personal limit) in your terms and conditions and on your “measures in place” page.

Technical considerations. The spend tracker must apply across every paid entry method, not just card payments. If you accept PayPal, Apple Pay, Google Pay, or bank transfers, all of them feed the same counter. The counter must reset on the first of each calendar month at 00:00, not on a rolling 30-day basis, to match the language of the clause.

If you sell bundled products (a £500 “ultimate bundle”, for example), decide what happens when a single purchase would push a customer over their limit. Either block the purchase entirely at product level, or allow the purchase up to the available limit and reject the excess at submission. Blocking entirely at product level is cleaner for the customer experience and avoids the kind of checkout friction that drives up abandoned entries.

What you need to decide.

1. Your fixed ceiling figure.
2. Whether to offer the player-set lower limit alongside the fixed ceiling (recommended) or go fixed-only.

Clause 1.5: Account suspension and closure

Operators should provide players with options to suspend their account temporarily or to close their account permanently. Any request for a temporary suspension should be actioned by the operator in a timely manner and last for a minimum period of 6 months. During the period of suspension, the operator should not permit the player to take part in its prize draws, and should not send any marketing material to them.

What this clause requires. Customers must be able to suspend their account for a minimum of six months or close it permanently, through a self-service option on the site. The Code also encourages a shorter “pause” option where technically feasible.

How to implement it on your website:

1. Add a “Manage my account” section in the customer account area with three clearly labelled options: Pause, Suspend, and Close.
2. Pause: a short break chosen by the player, from one day up to six months.
3. Suspend: a longer break of at least six months. The six-month minimum is set by the Code and cannot be overridden by the customer, even on request.
4. Close: permanent account closure.
5. Apply the suspension or closure immediately when requested. Do not impose a waiting period before the block takes effect.
6. Block all entries (paid and free) during a pause or suspension, and after permanent closure.
7. If a paused or suspended player tries to log in or enter, display a clear on-screen message explaining the status of their account and when it will reactivate.
8. For permanent closure, add a confirmation step that explicitly explains the action is irreversible. This prevents accidental closures and protects against later disputes.
9. Automatically remove the customer from all marketing lists during suspension and on closure, across every channel (email, SMS, push notification, and any third-party remarketing audiences fed from your CRM).
10. Build a view into your admin panel showing which accounts are paused, suspended, or closed, with the date each status change took effect.

What you need to decide. Nothing material on your end. The parameters are largely set by the Code itself. The main implementation question is whether you want to surface the pause option (strongly recommended, because it acts as a safety valve before customers reach the formal six-month suspension).

Clause 1.6: Monitoring for harm

From the point when an account is opened, operators should make reasonable efforts to have in place effective systems and processes to monitor players’ activity to identify harm or potential harm. This could include, but is not limited to, any financial harm or distress, excessive participation, social or psychological distress.

What this clause requires. Ongoing monitoring of customer activity for signs of harm, from the moment an account is opened. The Code lists example indicators including frequency of hitting spend limits, spending patterns, behaviour and play patterns, use of suspension tools, staff interactions, self-reported information, and frequent changes to payment methods.

How to implement it on your website and in your operation:

1. Log every entry, payment, limit change, suspension request, failed payment, and payment method change against the customer account. This is the raw data that makes monitoring possible. Without this logging, you have no ability to identify patterns.
2. Build admin dashboard flags triggered by specific signals. Examples: a customer hits their spend limit in three consecutive months; a customer changes payment method five or more times in a week; a customer experiences multiple declined payments; a customer’s monthly spend jumps significantly above their own historical average; a customer requests a temporary suspension and then immediately tries to reverse it.
3. Surface these flags to a named operational owner. The flag is only useful if someone is reviewing it and acting on it.
4. Implement automated customer-facing nudges at defined thresholds. For example, a message in the account area when a customer passes 50% of their monthly spend limit, and another at 90%.
5. Record all staff interactions relating to harm concerns (phone calls, email exchanges, chat sessions) in a searchable log against the customer account.
6. Document your monitoring processes in a short internal policy document. This is what you will point to if your approach is ever questioned, and it forms part of the evidence base for Clause 3.1.

Technical considerations. The Code uses the phrase “reasonable efforts”, which allows for significant variation by operator size and resource. A small operator running a few draws a month does not need the same monitoring infrastructure as Omaze. What matters is that the effort is proportionate and documented. Most operators will find that logging the right data, building three to five meaningful dashboard flags, and assigning clear ownership is enough to satisfy the clause.

What you need to decide. Who owns harm monitoring operationally, and how often they review flagged accounts (weekly is a reasonable baseline for most operators).

Clause 1.7: Intervention

Where operators are reasonably able to identify any indicators of harm for any player, they should take a tailored and proportionate approach to intervention to ensure the best resolution for the player that mitigates harm and encourages responsible play.

What this clause requires. A documented process for what happens when Clause 1.6 monitoring flags a concern. The Code expects intervention to be tailored to the specific indicator, proportionate to the level of concern, and ultimately capable of preventing continued play in significant cases.

How to implement it:

1. Document a three-tier intervention framework. Tier 1: soft intervention, such as an in-account message acknowledging the concern and signposting support resources. Tier 2: a direct outreach from your team by email or phone, asking the customer to review their spend limits and account activity. Tier 3: operator-imposed suspension or closure where the concern is significant and the customer has not responded to earlier interventions.
2. Record every intervention (what was flagged, what action was taken, what the outcome was) against the customer account. This protects you evidentially and feeds Clause 3.1.
3. Train any staff who handle these interactions. Intervention is a high-stakes conversation and the customer is often vulnerable.
4. Use the account tools already built for Clause 1.5 (pause, suspend, close) as the mechanism for Tier 3 interventions.
5. Make sure your signposting resources (Clause 1.8) are available and up to date, so Tier 1 interventions can point to them directly.

What you need to decide. Who inside your business has authority to initiate each tier of intervention, and how quickly they act once a flag is raised.

Clause 1.8: Signposting to support services

Operators should signpost players to available support for those experiencing harm, including relevant information on responsible play and available resources for dealing with such harm. This includes, but is not limited to, directing players towards relevant support services such as Citizens Advice, Money Advice Trust, National Debtline, Samaritans, Mind, or any other suitable support service.

What this clause requires. Clear, accessible signposting to external support services from your website, covering financial harm, mental health, and general welfare.

How to implement it on your website:

1. Build a dedicated “Responsible play” or “Player support” page and link it from the footer of every page.
2. List each of the services named in the Code with their phone number, website, and a one-line description of what they help with. Include Samaritans, Mind, Citizens Advice, Money Advice Trust, and National Debtline as a baseline. Add any further services that are relevant to your specific audience.
3. Surface the same signposting contextually inside the customer account area, particularly when limits are hit, a suspension is triggered, or a harm flag has resulted in an intervention.
4. Include the signposting page in your complaints response templates, so any complaint that touches on harm automatically includes the resources.
5. Keep the page under your own content management, and review the listed phone numbers and URLs every six months. Support service contact details occasionally change, and out-of-date signposting is worse than none.

What you need to decide. Nothing material. The Code lists specific services and the signposting pattern is well established in the gambling sector.

Clause 1.9: Time period between opening and closing draws

Operators should ensure that an appropriate time period elapses between a prize draw opening and concluding with a view to encouraging responsible play.

What this clause requires. Draws should run for a long enough period that customers are not rushed into impulsive entries. The Code does not set a specific minimum, leaving the figure to operator judgement.

How to implement it in practice:

1. Set internal minimum draw durations. A reasonable baseline for most operators is seven days for small weekly draws, 14 days for mid-value cash or product draws, and 21 days or longer for high-value vehicle, house, or holiday draws.
2. Enforce the minimum in your admin panel by preventing any draw from being scheduled with a closing date less than the minimum period after its opening date. This removes the risk of accidentally publishing a draw that breaches the clause.
3. Document the minimum periods on your “measures in place” page as evidence of compliance with Clause 1.9.
4. Instant win draws are treated separately under Clause 1.10 and are not covered by this minimum period logic, because the mechanic is instantaneous by design.

What you need to decide. Your minimum durations for each draw type, based on your typical product mix.

Clause 1.10: Instant win draws

Operators who offer instant win prize draws are expected to ensure compliance with, and equivalence between, the paid and free-entry routes as set out within clause 2.4. Alongside this, operators should ensure that they provide clear and transparent information to consumers as to how the free entry route works for such draws. Instant win prize draws should not form the majority of an operator’s total number of competitions at any given time.

What this clause requires. Three distinct requirements for operators running instant win draws:

1. The free entry route must offer genuine equivalence to the paid entry route in chance of winning.
2. The free entry route mechanism must be clearly explained on every instant win product page.
3. Instant win draws must not make up the majority (more than 50%) of the operator’s total live draws at any given time.

How to implement it on your website:

1. For every instant win draw, import free entries into the same draw pool as paid entries so both routes have an equal mathematical chance of winning. Do not run a separate “free entry only” pool with a different prize structure.
2. Publish a clear “how the free entry route works” section on every instant win product page, including how to submit a free entry, what format it must take (typically a postal route with specific address requirements), how long it takes to be added to the pool, and the deadline for receipt.
3. Track your live draw mix in the admin panel. Add a simple count of total live draws versus live instant wins, and a warning threshold that triggers if instant wins exceed 40% of the total (giving you margin before you hit the 50% Code limit).
4. Review your historical draw mix. If instant wins have consistently formed more than half of your product output, you will need to rebalance toward traditional drawn formats to meet the Code from 20 May 2026.
5. Block credit card payments on all instant win draws at checkout (Clause 1.3).

What you need to decide. Whether your current product mix is already within the 50% ceiling. If not, a rebalancing plan before 20 May 2026.

Clause 1.11: Marketing and advertising compliance

Operators should ensure that all marketing and advertising of their prize draws is undertaken in accordance with (where applicable) the CAP code and BCAP code. Additionally, any marketing should be undertaken in a socially responsible manner, particularly taking steps to protect children, young persons and other vulnerable persons from potential harm. This includes, but is not limited to, ensuring advertising does not suggest participating in prize draws provides an escape from personal, professional or educational problems. It should also not suggest participating in prize draws can be a solution to financial concerns, an alternative to employment or a way to achieve financial security.

What this clause requires. All marketing must comply with the Committee of Advertising Practice (CAP) Code and the Broadcast Committee of Advertising Practice (BCAP) Code, plus a set of specific social responsibility restrictions on messaging.

How to implement it across your marketing:

1. Audit all live and scheduled paid advertising creative (Meta, Google, TikTok, YouTube, Snapchat, out-of-home). Remove any messaging that suggests a prize could solve financial problems, replace employment, fund retirement, clear debt, or provide an escape from personal difficulty. This specifically targets common angles in the competition sector like “quit your job” or “financial freedom” creative.
2. Audit your organic social content and testimonial library. The same social responsibility rules apply. Winner-facing testimonials that frame a win as life-changing financial relief are high risk.
3. Configure under-18 audience exclusions on every advertising platform where this is available. This covers Clause 1.1 as well as Clause 1.11.
4. Audit on-site content. Any banners, pop-ups, hero copy, or email creative that makes the same type of claim needs to be rewritten.
5. Document your internal marketing approval process. A named team member should sign off every piece of paid creative against the CAP and BCAP Codes and the Voluntary Code’s specific restrictions before it goes live.
6. Review your affiliate marketing content. If you run an affiliate programme, you are responsible for the creative your affiliates publish on your behalf (Clause 3.2).

Technical considerations. The Advertising Standards Authority (ASA) has increased scrutiny of the competition sector over the last 18 months, with several adjudications specifically against prize draw operators on socially responsible marketing grounds. Compliance with Clause 1.11 reduces your exposure to both ASA adjudications and the reputational damage that comes with them.

What you need to decide. Who owns marketing compliance sign-off in your business, and whether you need a formal creative review process before anything goes live.

Pillar 1 alone is a three-week build job

Age verification, spend limits, suspension tools, harm monitoring. Each one is a structural change to your site. We’ve built all of it into the platforms we deliver as standard. If you’d like us to audit where your current site stands against Pillar 1 specifically, get in touch.

Get a compliance audit

Pillar 2: Transparency

The Transparency pillar covers how draws are conducted, how free entry routes are presented, how prizes are delivered, and how charitable contributions are disclosed. These are the clauses most closely tied to customer trust, because they determine whether customers can believe what you tell them about each draw.

Clause 2.1: Clear summary of draw mechanics

For every variant of prize draw product offered by an operator, players should be provided with a clear summary of how that prize draw will be conducted alongside the relevant rules and game mechanisms to ensure transparency and integrity of the draws themselves. This should include a statement that the prizes are to be awarded in accordance with the laws of chance.

What this clause requires. Every product page must include a plain-English summary of how the draw works. The summary must include a specific statement that prizes are awarded in accordance with the laws of chance.

How to implement it on your website:

1. Add a standard “How this draw works” section to every competition product template. Populate it with: draw mechanism (random computer draw, Facebook Live, certified physical drawing machine), closing date and time, draw date and time, prize summary, and the required “prizes awarded in accordance with the laws of chance” statement.
2. Build the template block at product level in your CMS so every new draw automatically includes it. This prevents individual draws from slipping through without the required disclosure.
3. Display the block prominently on the product page, not hidden in a tab or accordion. The Code’s intent is that the information is easily visible before entry.
4. Cross-link from the block to your full terms and conditions and to the relevant free entry route instructions (Clause 2.4).

What you need to decide. The wording of your standard template block, so it is consistent across every draw.

Clause 2.2: Fair draw mechanism

Promoters of prize draws should ensure that prizes are awarded fairly in accordance with the rules and terms displayed to players. This should be by an independent person, or under the supervision of an independent person, unless winners are selected by a computer process that produces verifiably random and auditable results, or by a certified physical drawing machine. Entries to any variant of prize draw product offered by an operator (whether via the free entry route or the paid entry route) should have an equal chance of winning each available prize.

What this clause requires. Draws must be conducted using one of three valid methods: an independent person (or supervision by one), a verifiably random and auditable computer process, or a certified physical drawing machine. Every entry, free or paid, must have an equal mathematical chance of winning.

The three valid methods compared.

Facebook Live or equivalent live-streamed draw with an independent witness. Simple to implement, high transparency, high trust signal, but operationally expensive to run and limited to set draw times. Widely used in the UK competition sector.

Verifiably random and auditable computer process. Most scalable option, lowest operational cost, suitable for high-volume draw operations. “Verifiably random” means the random number generator must be seeded from a documented, non-manipulable source and the result must be reproducible from the seed. “Auditable” means the seed, the entry list, and the selection process must be logged in a way that could be reviewed after the fact. Random.org’s signed draw service is the most commonly used external solution, because it provides a third-party-verifiable record.

Certified physical drawing machine. Rare in the online competition sector but accepted by the Code. Requires formal certification and physical operation.

How to implement a compliant computer-based draw:

1. Use a cryptographically secure random number generator, seeded from either a Random.org signed draw, a hardware RNG, or a documented combination of multiple entropy sources. Do not use basic pseudo-random functions like JavaScript’s Math.random() or PHP’s rand() for draw selection.
2. Log the seed, the complete entry list (with both paid and free entries in the same pool), the timestamp, and the selected entry for every draw. Store the log immutably in a location separate from your primary database.
3. Merge free and paid entries into a single draw pool, numbered sequentially. Every entry in the pool has an equal chance of selection regardless of route. This is the mechanical implementation of the “equal chance” requirement.
4. Publish the draw mechanism on your website (required under Clause 2.2 explicitly). Include enough detail that a reasonably informed customer can understand how the draw is conducted.
5. Keep the draw log for a minimum of 12 months in case of dispute or audit.

How to implement a compliant Facebook Live draw:

1. Broadcast the full draw, from the reading of entry numbers through to winner confirmation, without cuts.
2. Have an independent witness visible on camera throughout. “Independent” in this context means not an employee, contractor, or family member of the operator. A community member, accountant, or solicitor can serve.
3. Publish the recording immediately after the live stream so customers can review it.
4. Use a verifiable selection method on camera (typically a wheel or random number generator visible in the stream), so the selection process itself is observable, not just the result.

What you need to decide. Which draw mechanism matches your operational model. Most operators in the sector use a hybrid: live streams for flagship draws (for the marketing value) and automated computer-based draws for higher-frequency smaller draws.

Clause 2.3: Likelihood of winning

Where possible, prior to entering a draw, operators should provide players with clear and easily accessible information regarding the likelihood of winning a prize and how prizes will be allocated. Whilst the exact likelihood of winning a prize will depend on the number of tickets sold, information of that nature could include, but is not limited to, the maximum number of tickets available (where applicable) or data from previous comparable prize draws.

What this clause requires. Clear, accessible information about chances of winning, provided before the customer enters. The exact figure is flexible because ticket sales vary, but the Code lists maximum tickets available and historical comparable draw data as examples of acceptable disclosures.

How to implement it on your website:

1. Display the maximum ticket count on every product page where the draw has a fixed ceiling. This is the simplest and most transparent disclosure.
2. Display the current ticket count sold so far, updated in near-real time. This allows customers to see the actual odds at the point of entry.
3. For draws with no fixed ceiling, publish the historical average ticket count for comparable recent draws on the same product type. Update this figure monthly.
4. Calculate and display the current odds (1 in N, where N is the total entries) on the product page. Update this live as entries come in.
5. Make this information prominently visible on the product page, alongside the “How this draw works” block from Clause 2.1.

What you need to decide. Whether to display live ticket counts (recommended, but requires real-time updating infrastructure) or averaged historical data (simpler to implement, less transparent).

Clause 2.4: Free entry route disclosure

Operators should clearly and prominently provide players with details of any “free entry” option(s) for the prize draw before the point of purchase, and in line with the requirements of the Act. Free entry routes may be (a) ordinary post (i.e. ordinary first- or second-class post, without special arrangements for delivery), or (b) any other method of communication which is neither more expensive nor less convenient than entering the draw by a paid entry route.

What this clause requires. The free entry route must be clearly and prominently disclosed before the point of purchase, and the route itself must offer genuine equivalence in cost and convenience to paid entry. This is directly linked to the Section 14 free draw exemption under the Gambling Act 2005.

How to implement it on your website:

1. Display the free entry route on every competition product page, not only in the terms and conditions. “Clearly and prominently” means visible without scrolling through multiple sections, and certainly not buried three clicks deep.
2. Specify the exact format the free entry must take: the postal address, the information the entry must contain (customer name, email, specific draw identifier), and the deadline for receipt.
3. Ensure the deadline allows genuine time for postal entry. A draw closing at midnight today with a free entry deadline of midnight today is not a genuine free entry route.
4. Do not require unusual postage (recorded, signed-for, or special delivery). The route must be ordinary first- or second-class post, or an equivalent electronic method that is no less convenient than paid entry.
5. Process free entries into the same draw pool as paid entries, with the same chance of winning (Clause 2.2).
6. Audit your terms and conditions and the static copy across the site to remove any language that discourages, devalues, or makes the free entry route appear less desirable than paid entry. The Code treats this kind of framing as evidence that the free route is not genuine.
7. Publish the free entry route on your “measures in place” page as part of your public disclosure under Clause 3.4.

Technical considerations. The free entry route is the mechanism by which your draws qualify for the Section 14 free-draw exemption. If it is not genuine, or is presented in a way that discourages use, the draw is at risk of being reclassified as a lottery under the Gambling Act 2005, which requires a licence. This risk exists regardless of whether you sign the Voluntary Code. The Code reinforces what is already UK law on free draws.

What you need to decide. The exact format of the free entry (postal address, required information, deadline) and the implementation pattern on your product pages.

Clause 2.5: Prize delivery and integrity

Operators should promptly provide the winning player with the advertised prize for a draw, or a reasonable cash alternative. To ensure the integrity of each draw, operators should not provide a prize of lower value due to low ticket sales, change the date on which a draw ends, or cancel a draw due to low ticket sales.

What this clause requires. Winners must receive the advertised prize or a reasonable cash alternative. Operators cannot reduce prize value, change the draw date, or cancel the draw because of poor ticket sales.

How to implement it:

1. Commit to every published prize. Once a draw is advertised, the prize value and the draw date are fixed. This is a commercial risk that must sit with the operator, not with the customer.
2. Document a prize delivery process with named ownership and target timeframes. Publish the process on your “measures in place” page.
3. If you offer a cash alternative, publish how the cash alternative value is calculated (typically a fixed percentage of retail value, or a pre-agreed figure published on the product page) and make the cash alternative choice available to the winner at the point of prize notification.
4. Keep evidence of prize delivery (delivery confirmation, winner acknowledgement, handover photos or video where appropriate) for at least 12 months.
5. Review your terms and conditions and remove any clauses that reserve the right to reduce prize value, extend draw dates, or cancel draws due to low sales. These clauses are now non-compliant.

What you need to decide. Your cash alternative methodology (if offered), and how you will cover prize-cost risk on draws that sell below break-even.

Clause 2.6: Charitable contributions

Operators who provide a charitable contribution as part of a prize draw (e.g. where charitable contributions are a percentage of sales or profits) are expected to outline clearly the parameters surrounding these contributions. Where possible, operators should ensure information is routinely published on how much is given to charity and the frequency of such contributions. In addition, where operators use this charitable contribution as part of their promotional activity, operators are expected to meet the requirements set out in the Code of Fundraising Practice and are encouraged to register with the Fundraising Regulator where eligible.

What this clause requires. If you include a charitable contribution as part of a draw or use charity messaging in your marketing, you must publish the parameters (which charity, what percentage or amount, what frequency) and comply with the Code of Fundraising Practice.

How to implement it on your website:

1. Build a dedicated “Our charitable contributions” page accessible from the footer and linked from any product page that carries a charity component.
2. Publish the charity name and registered charity number, the percentage of sales or profits contributed, the frequency of donations, and the cumulative total given to date. Update the total on a published schedule (monthly or quarterly).
3. On each applicable product page, display a charity block showing the specific contribution for that draw (percentage or fixed amount) and linking to the main contributions page.
4. Retain evidence of every donation (transfer confirmation, charity acknowledgement) and make this available on request.
5. Review the Fundraising Regulator’s Code of Fundraising Practice and ensure your marketing does not overstate the charitable benefit, mislead customers about the proportion going to charity, or use imagery that misrepresents the charity’s role.
6. Register with the Fundraising Regulator where eligible. Registration is low-cost and signals good-faith compliance with the Code of Fundraising Practice.

What you need to decide. Which charities you partner with, your standard contribution methodology, and who internally owns the charity reporting and reconciliation process.

Pillar 3: Accountability

The Accountability pillar covers internal compliance processes, third-party oversight, public disclosure, and ongoing engagement with DCMS and the wider sector. These clauses are less website-implementation-heavy but are critical for demonstrating that your compliance is ongoing, not a one-off tick-box exercise.

Clause 3.1: Internal compliance monitoring

Operators should have processes and systems to monitor and regularly review compliance with this Code. Where any inadequacies or improvements are identified, operators are expected to take swift action to ensure compliance with this Code.

What this clause requires. A documented internal process for monitoring ongoing compliance with every clause of the Code, including regular reviews and swift remediation of any gaps identified.

How to implement it:

1. Build a compliance review checklist covering every clause in the Code. The checklist becomes the basis for a regular internal review.
2. Schedule a compliance review at a defined cadence. Quarterly is the reasonable baseline for most operators. Large operators or those with high draw volume should review monthly.
3. Assign a named internal owner for the review. This is usually a compliance lead, operations manager, or, in smaller businesses, the owner-operator.
4. Document the outcome of every review. What was checked, what was found compliant, what was flagged, and what action was taken. Retain the documentation as evidence.
5. Where a gap is identified, log it with a target resolution date and review completion at the next cycle.

What you need to decide. The review cadence, the named owner, and the format of the compliance documentation.

Clause 3.2: Third-party compliance

Operators should take reasonable steps to ensure that all relevant Code requirements are also followed by any third-parties that support their prize draw operations (for example, affiliate marketers or draw-management partners). Operators should seek to manage compliance of third parties through contractual arrangements and consider terminating relationships with third parties who fail to comply with relevant Code requirements.

What this clause requires. You are responsible for ensuring that any third party supporting your draws (affiliates, draw management partners, marketing agencies, affiliate networks) also complies with the relevant Code clauses. Compliance must be managed through contract, with the ability to terminate non-compliant relationships.

How to implement it:

1. Audit every active third-party relationship. Identify which Code clauses are relevant to each (affiliates typically fall under Clauses 1.1 and 1.11, draw management partners under Clauses 2.1 and 2.2).
2. Update your contracts with each third party to include a Voluntary Code compliance clause. The clause should require the third party to comply with the relevant Code requirements, provide evidence on request, and accept termination for non-compliance.
3. Communicate the Code’s requirements to every affiliate in writing. Include a simple summary of what they can and cannot do (audience exclusions, creative restrictions, social responsibility rules) and request confirmation of compliance.
4. Review affiliate creative regularly and suspend any affiliate producing non-compliant content.
5. Document your third-party compliance process and include it in the Clause 3.1 review cycle.

What you need to decide. Whether existing contracts need to be amended or whether you rely on a side-letter communicated to each third party.

Clause 3.3: Engaging with the sector

Operators should engage with other operators and work across the sector to share best practice in relation to player protections, transparency and accountability.

What this clause requires. Active engagement with the wider prize draw sector to share best practice. This is a lighter-touch clause but signals the Code’s expectation that the industry raises its standards collectively, not in silos.

How to implement it in practice:

1. Join any industry body that forms around the Code. At time of publication, the sector does not have a single established trade body, but DCMS has signalled that one may emerge.
2. Respond constructively to best-practice requests from other signatories, and share your own implementations where appropriate.
3. Attend DCMS review meetings where invited (see Clause 3.5).
4. Document your engagement activity in your Clause 3.1 review cycle as evidence of compliance.

What you need to decide. Who represents your business in sector engagement, and how much operational time you allocate to it.

Clause 3.4: Publishing your measures

Operators should publish all of the measures they have in place with regards to player protections, transparency and accountability, ensuring their adherence with this Code is transparently displayed on their websites.

What this clause requires. Every measure you have put in place to comply with the Code must be published transparently on your website.

How to implement it on your website:

1. Build a dedicated “Our commitment to player protection” or “Voluntary Code measures” page, linked from the footer of every page.
2. Structure the page around the three pillars of the Code: Player Protections, Transparency, and Accountability.
3. Under each pillar, list the specific measures you have implemented in plain English. For Player Protections, this covers age verification, spending limits, pause/suspend/close, credit card restrictions, harm monitoring, intervention, and support signposting. For Transparency, this covers draw mechanics, odds of winning, free entry routes, prize delivery, and charitable contributions. For Accountability, this covers your compliance process, third-party oversight, and sector engagement.
4. Add a clear statement at the top of the page confirming that you follow the DCMS Voluntary Code of Good Practice for Prize Draw Operators, with a link to the gov.uk page.
5. Add a visible footer badge or statement (“We follow the Voluntary Code for Prize Draw Operators”) on every page, linking to the measures page.
6. Keep the page in your CMS so it can be updated as your measures evolve or the Code is revised.
7. Review the page against your actual implementation in every Clause 3.1 compliance review, and update it to reflect any changes.

What you need to decide. The structure, tone, and level of detail of the measures page. The principle is that a customer should be able to read the page and understand exactly what protections exist, without marketing spin. Done well, this page becomes one of the single strongest opportunities to build trust in your competition brand, because visible, specific compliance is now a genuine competitive differentiator in the sector.

Clause 3.5: Working with DCMS

Operators are encouraged to work with the Department for Culture, Media and Sport on ensuring this Code remains fit for purpose and sharing any learnings or challenges.

What this clause requires. Ongoing engagement with DCMS as the Code evolves. DCMS has oversight of the Code and reserves the right to amend it following consultation with signatories.

How to implement it in practice:

1. Respond to DCMS consultations on the Code when invited.
2. Feed back practical implementation challenges via the prizedrawcode@dcms.gov.uk address.
3. Attend any meetings DCMS convenes for signatories.
4. Document engagement activity in your Clause 3.1 compliance review.

What you need to decide. Who in your business represents the operator in DCMS engagement.

How the Code interacts with other regulation

The Voluntary Code does not replace any existing legal obligation. It sits alongside a number of other regulatory frameworks that prize draw operators must also comply with.

The Gambling Act 2005 is the primary piece of legislation governing prize draws in Great Britain. Section 14 of the Act defines the free-draw exemption that most competition websites rely on. If your free entry route is not genuine (Clause 2.4 directly reinforces this), you risk your draws being reclassified as lotteries, which require a licence from the Gambling Commission. Section 339 sets out the equivalent exemption for prize competitions based on skill, where the validity of the skill question is the critical legal test. Compliance with the Voluntary Code does not protect you if your draws fail the Section 14 test on the underlying legal question.

The UK General Data Protection Regulation and Data Protection Act 2018 govern every piece of customer data captured through the signup, entry, and payment processes described throughout this guide. The date of birth captured under Clause 1.1, the spending data tracked under Clauses 1.3 and 1.4, and the harm monitoring data under Clause 1.6 are all personal data. You need a clear lawful basis for processing each category, appropriate retention periods, and appropriate technical and organisational measures to protect the data.

The CAP Code and the BCAP Code govern non-broadcast and broadcast advertising in the UK, enforced by the Advertising Standards Authority. Clause 1.11 of the Voluntary Code explicitly requires compliance with both. Compliance with the Voluntary Code does not by itself constitute compliance with the CAP or BCAP Codes, which cover a wider range of rules on advertising.

The Consumer Protection from Unfair Trading Regulations 2008 apply to all commercial practices, including competition websites. Misleading customers about the chance of winning, the value of a prize, or the charitable benefit of a draw is a potential breach regardless of Code compliance.

The Code of Fundraising Practice, enforced by the Fundraising Regulator, applies to any operator using charity messaging in marketing (Clause 2.6).

Northern Ireland operates under separate gambling legislation from Great Britain. Operators targeting Northern Ireland should take specific legal advice on the applicable regime there.

The Voluntary Code is therefore best treated as one layer of a broader compliance stack, not a standalone framework.

Your implementation timeline

The 20 May 2026 deadline is roughly four weeks from the publication date of this guide. That is a tight but achievable window for most operators. Below is a four-week implementation plan built around the clauses most likely to require technical development.

Week 1: Foundations and decisions. Audit current compliance against every clause of the Code. Identify which clauses you already meet, which need configuration changes, and which need new build. Make the decisions flagged throughout this guide (spend limit ceilings, complaints timeframes, ADR provider, charity contribution methodology, draw mechanism). Open the conversation with your payment provider about credit card enforcement. If this audit reveals more gaps than you have internal capacity to close, this is the point at which most operators bring in a UK competition website specialist to run the build in parallel with your operational decisions.

Week 2: Build high-complexity clauses. Prioritise 1.1 (age verification), 1.3 (credit card restrictions), 1.4 (spend limits), 1.5 (pause/suspend/close), and 2.2 (draw mechanism). These are the clauses with the most development work and the highest customer-facing visibility. Begin logging infrastructure for Clauses 1.6 and 3.1.

Week 3: Build content and disclosure clauses. Build the complaints page (1.2), the responsible play page (1.8), the “how this draw works” template block (2.1), the free entry route updates (2.4), the charitable contributions page (2.6), and the “measures in place” page (3.4). Update terms and conditions. Audit and update marketing creative for Clause 1.11.

Week 4: Testing, documentation, and cutover. Test every customer journey (registration, entry, limit hit, pause, suspend, close, free entry, complaints, winner notification) end to end. Document your compliance framework for Clause 3.1. Brief your team. Go live ahead of 20 May 2026.

Operators who are starting from a low compliance baseline should treat this as a floor and plan for additional time on the development-heavy clauses.

What happens if you don’t comply

The Voluntary Code is voluntary and non-compliance is not itself a legal breach. However, there are three meaningful consequences for operators who ignore it.

Legislative intervention. DCMS has explicitly said that if voluntary adoption does not raise standards across the sector, legislative intervention becomes likely. That means either bringing prize draws under Gambling Commission licensing or introducing bespoke legislation. Either outcome would be more restrictive and more expensive to comply with than the current Code.

Commercial pressure. Payment providers, advertising platforms, and affiliate networks increasingly expect operators to demonstrate compliance with sector standards. Signatory status is becoming a working requirement for access to the infrastructure competition websites depend on.

Reputational exposure. Customers, media, and regulators are now aware of the Code. Operators who publicly ignore it face higher scrutiny on every existing regulatory question (ASA adjudications, Gambling Commission reviews of free-draw compliance, consumer protection investigations) and a weaker trust position when disputes arise. This kind of exposure is one of the biggest mistakes new competition businesses make, because a single compliance gap can cascade into payment provider concerns, advertising rejections, and a damaged trading relationship across the sector.

Treating the Code as optional is, in practical terms, choosing higher future compliance cost, narrower operational options, and greater commercial risk. The retrofit cost of bringing a non-compliant site up to standard after the fact is almost always higher than the cost of building a competition website with compliance engineered in from day one.

How to become a Code signatory

Becoming a signatory to the Voluntary Code is straightforward and does not carry a fee. To request to become a signatory, contact DCMS at prizedrawcode@dcms.gov.uk with your operator name, website, and a statement that you commit to implementing the Code in full.

Operators who become signatories after 20 May 2026 must be compliant with the Code from the point of signing, not after a six-month grace period. Plan your implementation before you apply.

Web developers, agencies, and other sector participants who are not operators can also sign as “Other Relevant Signatories”. These signatories commit to promoting compliance with the Code to the best of their abilities and are listed separately on the gov.uk page.