Taco Bell Hacking Incident Reminds Companies to Carefully Draft Sweepstakes Rules

I recently wrote this piece for the Gunster Blog. Click here to learn more about my work at Gunster.

The recent hacking of the website for a Taco Bell sweepstakes should remind companies sponsoring sweepstakes to carefully draft sweepstakes rules to help protect them in the event of similar incidents.

In January, Taco Bell launched its “Unlock the Box” sweepstakes. This sweepstakes, which is to run through mid-March, allows participants the chance to win a Playstation® Vita handheld gaming device. One method of entering this sweepstakes on the sweepstakes website—entering a code obtained from certain product packaging or by a mailed request—was undermined by hackers.

On January 30, numerous participants entered their codes on the sweepstakes website and were told that they were winners. However, Taco Bell later determined that most of these individuals had not actually won prizes. Instead, hackers had “illegally accessed” the sweepstakes website and caused it to treat non-winning codes as winning codes. In a statement issued on February 21, Taco Bell stated that these non-winning “entrants viewed these messages as a result of others who attempted to gain illegal entry and defraud the system.” As a consolation to these disappointed entrants, Taco Bell entered all of them in a separate drawing to win a Playstation® Vita.

This incident serves as a reminder that sweepstakes rules should anticipate potential technical issues, including hacking. This reminder is particularly relevant for online sweepstakes. For example, the rules for the Taco Bell sweepstakes contain, among other things, a provision allowing Taco Bell to “at its sole discretion, . . . modify, cancel, terminate or suspend this [sweepstakes] should any . . . unauthorized human intervention or other causes beyond Sponsor’s control corrupt or affect the administration, security, fairness, integrity or proper conduct of [this sweepstakes].” Although there is little case law indicating the level of protection afforded by a provision such as this from lawsuits by disgruntled individuals who are wrongly informed that they are winners, a prudent sweepstakes sponsor will include a similar provision in its sweepstakes rules.

Taco Bell’s sweepstakes rules also seek to deter potential hackers with a reminder that “any attempt by an entrant to deliberately . . . undermine the legitimate operation of this . . . sweepstakes is a violation of criminal and civil laws” and “should such an attempt be made, sponsor reserves the right to seek damages from any such individual to the fullest extent permitted by law.”

At the end of the day, though, even the best-drafted sweepstakes rules will not prevent individuals who are told they are winners but are later informed that they have not won from being disappointed. Describing his feelings upon reading that he had won a Playstation® Vita, one of the individuals affected by the Taco Bell sweepstakes mishap told a Sacramento television station that “I was excited, I’ve never won anything like that”. Upon later learning that he was not, in fact, a winner, this participant was disgruntled: “[i]t’s absolutely foul what they’re doing to me and the rest of these people who are getting screwed,” he said.

That is, an additional lesson from Taco Bell’s experience is that it takes more than well-drafted rules to administer an online sweepstakes well. Companies sponsoring sweepstakes with online methods of entry should consult with technology specialists to confirm that they are taking the necessary precautions against hacking. Taking the necessary technical steps to minimize the chance that incidents such as the Taco Bell sweepstakes debacle will happen in the first place will both help avoid disgruntled participants and may, although this has not been tested in court, provide an additional argument as to why a sweepstakes sponsor should not be held liable in the event that disgruntled participants bring a lawsuit.

This incident should also remind companies to hire qualified counsel when they sponsor sweepstakes. Sweepstakes law can be complicated and varies from state to state. Qualified counsel can assist companies in drafting appropriate sweepstakes rules and dealing with the myriad issues that can arise in connection with offering a sweepstakes in today’s online world.