Who's on the hook when a client's promotion breaks the law — and the contract language that keeps it from being you.
The plain-English answer
Agencies run sweepstakes and giveaways for clients constantly, but most agency-client contracts say almost nothing about who owns the legal fallout when one goes sideways. If your shop is named Administrator on a promotion that trips state lottery law, the FTC's deceptive-practices rules, or a platform's promotion policy, you're a named party in whatever comes next — the law does not draw that line for you.
Every promotion gets tested against three elements: prize, chance, and consideration. When all three show up, the promotion is a lottery, and private companies generally cannot run one. A sweepstakes removes consideration by keeping a genuinely free way to enter. A contest removes chance by picking winners on skill or merit instead of a draw. Which structure a client picks determines which rules apply — and how much exposure exists before a single entry comes in.
Federal enforcement is layered on top of that test: the FTC polices deceptive practices, the FCC covers broadcast promotions, the USPS covers mail fraud, and the DOJ handles criminal lottery violations. Getting one layer wrong can mean civil penalties, an injunction, or worse — and an agency executing the promotion isn't insulated from that by default.
What it means for your shop
Why this is worse in 2026
The FTC is paying closer attention to social sweepstakes — disclosures, influencer-run giveaways, the works. State enforcement of New York and Florida's registration and bonding rules is active, not theoretical: launch before checking whether a filing is required, and the promotion is unregistered from day one. Platform rules have tightened too — TikTok's 2026 overhaul requires visible prize and eligibility disclosures on the video itself and bans guaranteed-prize and artificial-urgency tactics, and Meta still requires a full release of Meta plus a no-sponsorship statement. One enforcement letter, one account restriction, or one AG demand letter can be a very expensive week for a small shop.
Where compliance actually breaks
Most promotions problems surface after launch — a regulator investigates, a competitor complains, a platform restricts the account. By then, who's responsible is whatever the contract says, or doesn't.
✓Registration and bonding get skipped. Creative gets built and the promotion announced before anyone checks whether NY or FL requires a filing — by the time it's caught, the deadline has passed.
✓Official rules go missing or thin. A caption or a landing-page bullet list isn't enough — the rules need the sponsor's legal name and address, eligibility, entry periods, prize values, odds, and a liability limitation.
✓Platform rules get built right into the mechanic. Requiring a Facebook “like” to enter violates Meta's terms; skipping TikTok's on-video disclosure risks the post itself.
✓The AMOE is technically present but practically useless. Present on paper, inaccessible in practice — that's a structurally deficient promotion, not a compliant one.
Referral programs are a separate legal problem
Agencies tend to treat referral mechanics as simple marketing, not a regulated communication. The TCPA requires prior express written consent before a marketing text, and penalties run $500–$1,500 per text, mostly enforced through class-action suits. CAN-SPAM governs commercial email and tops out near $53,000 per non-compliant message. The specific trap in a referral program: the referred person never consented to anything — only the referrer did. If a client hands over a referral mechanism without verifying consent and the agency executes the outbound message, the agency can be treated as the sender.
Who actually ends up responsible
There's no single answer — it depends on who made which decisions and what the contract says. Regulators and plaintiffs' attorneys look at who structured the promotion, who executed the communication, and who benefited. Without a contract that defines the agency as executor rather than decision-maker, and without a written record that the client approved the final rules, an agency can't cleanly separate its role from the client's.
Why this is worth a contract clause
$5,000
Prize value that triggers NY & FL sweepstakes registration and bonding
$500–$1,500
TCPA penalty per unconsented text — enforced through class-action suits
$53,088
Maximum CAN-SPAM penalty per non-compliant email
The two clauses that do the work
A simple mirror indemnity — where each side indemnifies the other for its own conduct — leaves the ambiguity in place, because promotion structure decisions involve both parties. What actually shifts liability is a client indemnity clause scoped specifically to promotion legality, paired with a client-approval-of-rules clause that creates the paper trail. Used together, they establish that the client bears responsibility for the calls they made, and protect the agency from the fallout of those calls.
Clause-by-clause reference
Clause
Purpose
What it should say
Sponsor designation
Establishes the client as legal sponsor
Client is the sole Sponsor under applicable state and federal law. Agency acts as Administrator only.
Client approval of rules
Creates the evidentiary record
Client reviews and approves all official rules in writing before publication, and represents that the rules comply with applicable law.
Compliance representation
Shifts the compliance decision to the client
Client represents that promotion structure, prize value, eligibility, and entry mechanics comply with applicable lottery, sweepstakes, and consumer-protection law.
Registration & bonding
Assigns state filing responsibility
Client is solely responsible for determining whether registration and bonding are required, and for completing filings before launch.
Platform compliance
Covers social platform rules
Client has reviewed and approved all promotion mechanics and confirms they comply with the guidelines of each platform used.
TCPA & CAN-SPAM representation
Allocates consent compliance
Client represents that all contact lists used in the promotion or referral program were collected with legally sufficient consent.
Client indemnity
Shifts financial risk to the client
Client indemnifies, defends, and holds Agency harmless for claims arising from Client's promotion decisions, representations, or breach of law.
Agency carve-out
Retains the agency's own liability
Agency indemnity does not extend to claims from Agency's own gross negligence or willful misconduct in execution.
Limitation of liability
Caps agency exposure
Agency's total liability for a promotion claim is capped at fees paid in the preceding three months.
Mutual survival
Keeps protections active after the engagement
Indemnification and representation obligations survive termination of the agreement.
The contract only holds if the operational habits underneath it are consistent. A strong indemnity clause doesn't help if the shop routinely builds promotion mechanics without documented client sign-off.
✓Document every structural decision in writing. Prize structure, entry mechanics, AMOE design, platform selection — an email confirmation or signed rules doc is what makes the indemnity clause hold up later.
✓Build a pre-launch compliance checklist and get it signed. Lottery elements test applied, AMOE genuinely free and accessible, rules complete, NY/FL status verified, platform guidelines reviewed, TCPA/CAN-SPAM consent confirmed.
✓Never list the agency as Sponsor. Administrator only — every time, in every set of official rules.
✓Verify NY & FL registration before creative starts. New York's window is 30 days before launch; Florida's is 7 business days. Confirm it before the agency does any work, not after the promotion is announced.
✓Scope the AMOE on every purchase-linked promotion. If the agency designs the entry flow, get written confirmation that the client owns and accepts responsibility for its compliance.
✓Treat referral programs as their own TCPA engagement. Get written confirmation that contact data used in outreach was collected with legally sufficient consent — in the contract, and again at project sign-off.
✓Keep a litigation hold on every approval record. Approvals, signed rules, and checklists should outlive the engagement — if a claim lands two years later, that record is what separates the agency from joint liability.
What insurance actually covers the gap
Contract protections and insurance aren't substitutes for each other — they cover different failure modes. The indemnity clause allocates the client's structural decisions. Insurance responds when the claim is the agency's own execution error, or when it needs to fund a defense regardless of fault.
•Professional liability (E&O) — the foundational policy. Covers execution errors: wrong mechanics built, a filing the agency was supposed to facilitate that got missed. Written on a claims-made basis, so letting it lapse resets the retroactive date and can leave older work unprotected.
•Media liability — standalone or as an E&O endorsement. Covers content-specific claims from promotion creative and published rules: defamation, copyright, invasion of privacy.
•General liability — covers bodily injury and property damage, not professional-services errors. Relying on GL alone leaves the campaign-delivery claims that are most likely to actually happen uncovered.
•Cyber liability — a sweepstakes entry form collects names, emails, sometimes more. If that data is compromised, exposure runs through state privacy law and the promotion's own official rules.
Where marketer.law fits
We build the agency-client agreement — the Sponsor/Administrator designation, the client-approval-of-rules clause, the TCPA and CAN-SPAM representations, and an indemnity scoped to promotion legality rather than a vague mutual hold-harmless. We don't clear a client's specific sweepstakes, referral program, or ad claim — our forms put that responsibility on the client, in writing, before the promotion launches. If you need a real compliance answer for a specific campaign, that's a matched human attorney, not site copy.
✓Consultant — $69/mo — Run your agency's legal like a real business. Client retainers and creator agreements in one place.
✓SMB — $99/mo — Full-service shops with a bench of creators and a roster of clients.
Frequently asked
Q: What is the lottery elements test, and why does it matter for marketing agencies?
A: Prize, chance, and consideration — when a promotion has all three, it's a lottery, and private companies can't legally run one. Agencies that design promotion mechanics without applying this test, or without confirming the client's structure passes it, risk creating an illegal lottery that exposes both sides to federal and state enforcement. We structure agency-client agreements so compliance decisions belong to the client as the designated Sponsor, not to the shop executing the campaign.
Q: Who is responsible if a client's sweepstakes violates the law?
A: The Sponsor — the client brand — carries primary responsibility under state and federal law. But an agency named as Administrator in the official rules, or one that executed a promotion without documenting the client's approval of its structure, can be pulled into the same enforcement action. The agency-client contract determines whether the agency has a clean defense. Without a client indemnity clause and a written record of approval, there is no contractual mechanism to put that exposure where it belongs.
Q: What states require sweepstakes registration and bonding?
A: New York and Florida both require registration and a surety bond once total prize value passes $5,000 for a promotion open to their residents — New York needs a filing at least 30 days before launch, Florida at least 7 business days. Rhode Island registers promotions with prize value over $500 when they run at retail, though it doesn't require a bond. Confirm registration and bonding status with the client in writing before any promotion launches.
Q: Who is responsible if a client's referral program breaks the law under TCPA or CAN-SPAM?
A: It comes down to who is sending the message and whether the recipient actually consented. A referred friend hasn't consented to anything — the referring customer isn't the business. If an agency executes the outbound message without a client representation that consent was properly obtained, it can be treated as a co-sender. Our agency-client agreements include TCPA and CAN-SPAM representations that put consent compliance on the party who owns the contact data: the client.
Q: What insurance does a small marketing agency need when running sweepstakes for clients?
A: Professional liability (E&O) as the primary policy — it covers execution errors and negligent professional work. Media liability, standalone or as an E&O endorsement, for content claims like defamation or copyright issues in promotion creative. General liability for premises and operations, which does not cover professional-services errors on its own. And cyber liability, given how much personal data a sweepstakes entry form collects. Contract protections and insurance complement each other: the indemnity and approval clause handle the client's structural decisions, the E&O policy handles the agency's own execution errors.
Q: What should the official rules of a sweepstakes say about the agency's role?
A: The client is the Sponsor — the party legally responsible for the promotion. The agency is the Administrator, executing on the Sponsor's behalf. That distinction is not cosmetic: if the agency is named Sponsor, it takes on primary legal responsibility for compliance, and no indemnity clause fully repairs that after the fact. We keep these roles separated in both the official-rules language and the underlying agency-client agreement.
Q: How does a client-approval-of-rules clause protect an agency?
A: Two ways. It requires the client to review and approve the official rules in writing before publication, and to represent that the rules comply with applicable law. And it creates the evidentiary record that the client, not the agency, made the substantive legal calls about the promotion's structure. If a regulator or participant ever asks who decided what, written approval is what lets an agency point to the client's decision instead of absorbing it as its own.
The indemnity clause only works if it's in the contract before the claim. Get the agreement that puts your client's promotion decisions where they belong.
We're lawyers, remember? Please read this important note:
Story LLP is a law firm, and Story's lawyers built Aegis to deliver better, standard legal services at scale so founders can choose between top-tier specialized lawyers and standardized process automations that replicate those lawyers according to their needs and budget. By definition, a standardized process may not be perfect for you. Please review our Policies page to better understand the difference, as well as how we use AI and how we manage conflicts, privilege, etc.
As a law firm, we must screen clients for conflicts of interest, and we treat all correspondence with clients seeking legal advice as privileged and confidential to the maximum extent possible in consideration of any conflicts. However, Story's law firm or our Attorney Allies do not represent you or your company as your lawyer, do not have an attorney-client relationship with you or your company, and do not provide you with legal advice absent a formal Engagement Letter signed between you and the Story LLP law firm. Please don't confuse the free knowledge we offer on this site with legal advice for you.
