GDPR Compliant Quiz Maker: How to Collect Data the Right Way

The vast majority of quiz builders like to say they’re a GDPR-compliant. But only a small number can actually prove they’re a GDPR compliant quiz maker. And that’s a big business risk. Whenever you add a lead generation form, embed a YouTube video, or use tracking pixels, you’re dealing with personal data (PII).

That means your organization is the one responsible for where the data goes. With collected fines at 7.16 billion euros (as of Oct. 1, 2026), the EU’s GDPR is serious business – one embedded non-compliant quiz or poll can put brands, publishers, and media companies at legal risk.

In this guide, we explain what it really means to be a GDPR-compliant quiz maker – including interactive content like polls, surveys, and games – in simple, clear language that anyone can understand. Plus, we answer the questions your legal and privacy teams will most likely ask, and include a 12-point checklist you can use to evaluate any online quiz builder – even us.

The short version – choosing a GDPR compliant quiz maker

• The EU’s GDPR takes effect any time your quiz, poll, or other interactive content gathers personal data – including names and email addresses – from any users in the UK or EU.
• Important – YOU are responsible for the personal data, no matter if your quiz maker is storing it. In GDPR terms, they are the processor – but you are the controller.
• Be aware of the hidden risks. Using US-based CDNs (like Cloudflare), tracking pixels, embedded Vimeo or YouTube videos – these can all send your audience’s personal data outside the EU, all without your team being aware.
• Before selecting an online quiz maker, make sure you know what trackers they use, where the data is stored, and if they will complete a data processing agreement (DPA). We cover this in our handy 12-point checklist below.
• Why Riddle? Riddle is 100% EU-based and stores all data in Luxembourg and Germany. It adds zero cookies or US-based trackers, and has a DPA it can sign with any customer.

What does ‘GDPR-compliant’ actually mean?

The General Data Protection Regulation (GDPR) is the EU’s data privacy law. In simple terms, if you ever use or collect data that can identify a person (known as PII), you need a good reason to do it, you need to be transparent and open about how and why, and you are responsible for securing that data correctly. Being ‘GDPR-compliant’ means you take these steps seriously – not just a tick box exercise.

Who does the GDPR apply to?

The scope of the GDPR is massive – covering any organization that handles the personal data of people who live in the EU. Whether you’re a U.S. publisher with users in Germany or a Japanese media company reaching an audience in France, the GDPR applies to you. And making things more wide-ranging, after Brexit, the UK launched its UK GDPR – which works in a similar fashion.

The 7 principles of the GDPR

The seven principles are set out in Article 5 of the GDPR:

• Lawfulness, fairness and transparency: You need to have a legal reason for processing personal data, and be clear and open with the people you collect it from.
• Purpose limitation: Don’t collect PII for one reason, and then use it for anything else (e.g. gather emails as part of a quiz contest, but then add them to a marketing newsletter list).
• Data minimization: Instead of a ‘kitchen sink’ approach, you must gather and process only the personal data that is needed to meet that purpose.
• Storage limitation: You should not store personal data any longer than necessary.
• Accuracy: You are required to ensure the personal data you collect is up to date and accurate.
• Integrity and confidentiality: You must keep any personally identifiable information secure.
• Accountability: Your company or organization must be able to show you are complying when required.

As a quick aside, Riddle does not collect PII with cookies or trackers in your Riddles – this makes meeting these 7 principles much easier for your team.

Why is the GDPR so important if you use an online quiz maker?

Taking effect in May 2018, the GDPR was a major revolution in privacy and data protection regulations. Any site that collects personal information (name, email, even IP addresses) from EU visitors faces huge fines of up to 20 million euros ($23,000,000) or 4% of global annual revenue, whichever is higher – whether based in the EU or not.

Online quizzes are especially high-risk. They are proven winners at engaging site visitors – especially to collect emails and qualify potential customers. But collecting emails and personal data means you need to stay compliant with the latest data privacy rules.

We prepared this guide as a summary of the key areas to focus on if you want to create GDPR-compliant interactive content with Riddle’s quiz maker. In 2026, GDPR compliance is more important than ever, with Google being fined €403 million and Meta €360-€430 million – and over €7.1 billion in fines since 2018.

Read on to explore our GDPR quiz maker checklist below. It covers key questions every website should ask their online quiz maker to make sure they comply with the GDPR. From servers to opt-ins and data protection, we cover the 12 factors you should look at to make sure your quiz maker is safe.

GDPR also inspired other privacy regulations around the world – including Canada’s PIPEDA, California’s CCPA, China’s PIPL, and many others.

The good news is that these countries use GDPR as a model. By complying with GDPR, you should then automatically comply with these other regulations as well.

But, as with all things privacy-related, we encourage you to talk to your data protection officer or your legal team.

Why is it crucial to use a GDPR-compliant quiz maker?

Online quiz makers are powerful tools for marketers and content teams – with quizzes, polls, mini-games, and other formats boosting dwell time by turning passive browsers into active, clicking, engaged users.

But all of this interactivity comes with some risks under the GDPR. Collecting zero-party and first-party data through quizzes and integrated lead generation forms means you’re collecting personally identifiable information (PII). Embedding content in a quiz such as YouTube or Vimeo videos, or Google Fonts, means your audience can be tracked.

This is more than just theoretical. The EU demands transparency for collecting and using personal data. Intersport was fined €3.5 million for transferring loyalty members’ data to social networks, while Solocal Marketing Services was fined €900,000 for sending data collected by publishers’ contests to other parties without consent.

Sending PII to the US is also risky – the June 2026 Supreme Court decision diminishing the Federal Trade Commission’s independence could mean the existing EU/US data privacy framework will be overturned by the EU.

Controller vs processor: who’s responsible for what?

This is the fundamental question when it comes to GDPR compliance. Riddle’s quiz builder keeps it simple – as the creator of the interactive content, you are the controller while Riddle is the processor.

Being the controller, you need to decide how and when personal data is collected from your audience – and equally important, on what lawful basis. That data is then processed by Riddle according to your instructions.

A plain English example:

1. As the controller, you decide to create a quiz and include a lead generation form as part of an automated contest on Riddle.
2. Riddle collects data using its software.
3. You further decide to send the PII to your own CRM (like Salesforce) – and choose to not save it to Riddle’s servers.

You’re in full control, deciding where, when, and how data is collected – Riddle simply executes your wishes.

What is a DPA (Data Processing Agreement)?

The EU also requires that controllers and processors have a written contract describing how personal data will be handled. Riddle has a robust DPA signed ‘as is’ by thousands of publishers, brands, and sports organizations. But you can use your own data processing agreement as part of Riddle’s Enterprise plan.

Audience requests about their data

Collecting personal data is great from a marketing perspective, but you have certain responsibilities under the GDPR. Any time someone asks to see, delete, or correct their data, that falls to you as the controller. The clock is running – you have a month to handle most requests, with up to two more for high volume or complicated asks.

The good news? Riddle’s quiz maker makes this super easy. Every lead has its own opt-in flag and timestamp, giving you full insight into when that user gave consent. You can also delete PII within Riddle with just a click.

Data breaches – reporting requirements

You’re also on the hook if there is a data breach involving your audience’s PII – you’ll need to notify your data protection authority in under 72 hours. That means your processor will need to act quickly, so you have enough time to react.

Riddle has never had a data breach since its launch in 2014. And being fiercely GDPR-compliant, you can rely on prompt notification.

Collecting email and personal data

You have to pay special attention when dealing with personal data:

• Ask for permission. Check out our templates for some sample legal language to remain GDPR compliant, and the UK ICO’s guidance on what valid consent looks like.
• Use double opt-in (DOI) either via email or via a one-time code to stay compliant with GDPR. Plus, use an opt-in checkbox that is never pre-checked.
• Save lead data to Riddle or to an integration like Brevo.com, which is also GDPR compliant. The “Save to Riddle” option is easy for people who don’t want to send data to another email tool or marketing software.
• Save lead data to your tool. If you save your lead data using another method, ensure it is GDPR compliant. (Most popular U.S.-based companies are probably problematic.) (List of GDPR-compliant tools)
• Meta (Facebook) Pixel. Using FB Pixel is controversial in GDPR terms. We recommend against using it.

Embeds, fonts, cookies and CDNs

Adding multimedia, such as videos, makes your online content much more effective. However, there are pitfalls to avoid since many services will collect personal data from your audience.

In particular, you should avoid these three services:

1. YouTube
2. Vimeo
3. X (Twitter)

If you are using these services, it’s crucial to ask the user for permission to load the content, as these tools will load a cookie.

To make this easy for you, Riddle lets you create and show a permission screen before content from these networks is loaded. Check out this help article to learn how to use this feature.

Google Fonts are also a tricky area – serving them on your site from Google runs the risk that they collect data on your users. Riddle self-hosts our Google Fonts, avoiding this issue entirely.

Want to use videos in your Riddle?

We recommend uploading MP4 video files, as they will be hosted on our Riddle servers (included with Riddle’s Business or Enterprise plans). Riddle will not set any cookies or trackers because we value your and your quiz takers’ privacy, ensuring GDPR compliance in your multimedia content.

(Plus they also look much better – without YouTube, Vimeo, or Twitter adding their own branding and controls to your Riddle.)

If you need to keep your videos on your own servers, you can integrate your media library directly within Riddle. An option under Riddle’s Enterprise plan, videos are served directly from your servers, which helps with licensing agreements for publishers and media companies.

12-point GDPR checklist for quiz makers

Key steps to comply with GDPR

1. Use GDPR-compliant vendors and sub-contractors.
2. Encrypt all personal data you collect and store.
3. Check whether you need a designated data protection officer (DPO) – you will need one if you’re a public organization or if you handle large amounts of sensitive data.
4. Store data ONLY in the EU whenever possible. True, the 2023 EU-U.S. Data Privacy Framework currently allows transfers to the U.S., but remember – the EU’s top court struck down the two agreements before it (Privacy Shield and Safe Harbor). Maintaining your data in the EU means you’ll be compliant no matter what decisions are made by future courts or political leaders.
5. Don’t rely on changes like 2023’s EU-U.S. Data Privacy Framework.

Quiz makers and GDPR – what to look out for

1. Does your quiz maker fully comply with GDPR? You should screen them thoroughly. Most quiz makers claim they are GDPR compliant, but they are not.
2. Is there a clear opt-out process if you don’t want the quiz maker to collect data?
3. Does all personal data collected by your quiz maker have to stay in the EU?
4. Can you sign a data processing agreement (DPA) with the quiz provider?

Your responsibilities as a business owner

1. You must erase a user’s data if they ask, without “undue delay.”
2. You must promptly respond to inquiries from EU users about using their data.
3. You must report data breaches in under 72 hours.

What are the most common questions from privacy and legal teams around GDPR-compliant quizzes and interactive content?

Deciding to use Riddle as your quiz maker for your engagement and data collection objectives is just the start of the process. The next step is to ensure your legal and data privacy colleagues are comfortable with Riddle’s information security and privacy setup, especially in the face of the EU’s GDPR.

Let’s tackle them one by one:

Who’s the data processor – and who is the controller?

This is the most critical question for GDPR compliance. Riddle makes it easy – in this case, you are the controller and Riddle is the processor. You can read more about this above.

Riddle is also a controller for the billing and account details of our quiz maker creators – just like any other vendor.

Where is Riddle’s data stored?

Ahead of the launch of the GDPR in 2018, we made a key strategic decision – we would only use our own servers, based in the European Union, and never cloud-based options like US-owned AWS or Google Cloud. The risk that data might leave the EU was simply too great.

Riddle is ISO 27001-certified and operates our primary servers in Tier 1, banking-grade data centers – with our primary location in Germany and mirrored backup servers in Luxembourg.

In addition, we operate our own EU-based CDN (content delivery network) – that means we do not need to use Cloudflare or any other U.S. CDNs.

We even went as far as creating our own invoicing software, so that all of our customers’ billing and invoice details would remain entirely in the European Union.

Does Riddle use any sub-processors? Are there any transfers to the U.S.?

We have a very short list of four EU-based processors – the most important is Brevo (formerly known as Sendinblue) – for our support chat software. The integration is framed – meaning that the service is a direct window to Brevo’s online offering. All of the resulting chatbox communication takes place via a Brevo/Sendinblue GmbH server – and Brevo exclusively processes all data (privacy policy), with no data being passed on to Riddle.

The other three include Telehouse and Luxconnect – our server providers, and Probe Networks, our IT service provider.

And rounding things off – this strict limiting of sub-processors means zero transfers are made to the U.S.

What about cookies? Would we need to add Riddle to our cookie banner?

Riddle does not drop any cookies or place trackers in audience-facing Riddle content. Instead, we give the option to use local storage – which means Boolean flags are stored on a person’s device, indicating if they have already completed the ‘how to play’ onboarding for these three Riddle formats (Order It, Swiper, Flashcard).

Besides that, we only use local storage if you have enabled our ‘one vote per browser’ security feature or the ‘remember user’ option. The remember user option may store personally identifiable information on a device, which will allow in-Riddle forms to be automatically filled out.

The short summary? If you would prefer to not save any data to local storage, follow these steps:

• Keep “Remember user” disabled
• Do not use any of the following block types: Order It, Swiper, Flashcard
• Keep “One vote per browser” disabled

To help with compliance, you can also use Riddle’s project presets (or global project presets) to automatically apply these settings – and our detailed user roles to prevent users from overriding them.

Will our data be used to train AI models?

The short answer? No… absolutely not. Any audience data from Riddle’s customers is never used to train AI.

We do use AI when helping our customers, as well as for some marketing. This might include contact information, plus support chat and email information, as well as basic metadata such as the marketing channel, date, and time.

Why? AI helps us identify customer support issues that occur more than once, sort product inquiries into our CRM software, as well as operate our marketing communication software.

The legal basis for this? For support, this is covered by contract performance (Art. 6(1)(b)) while legitimate interest (Art. 6(1)(f)) covers other users. Finally, certain email marketing comes under Art. 6(1)(a), where the law requires your consent. (More info in the AI section of our privacy policy.)

Specialist providers do provide some AI work, which falls under Article 28 agreements. In the event data does leave the EU/EEA, Riddle uses EU SCCs (standard contractual clauses) as well as any necessary supplemental measures. All details can be provided on request.

Finally, we do not use AI to make decisions about you based entirely on automated profiling or processing. All matters with real consequences are decided by a Riddle employee.

What InfoSec and privacy documentation is available?

Riddle is ISO 27001-certified and 100% GDPR-compliant.

We have a full information packet for InfoSec/privacy teams – including data handling, a detailed security FAQ, plus network architecture, our security white paper, ISO certification, and more.

Please ask us on support chat or by email (hello@riddle.com) – and we would be happy to send that to you for your review.

Fact table: How Riddle handles GDPR

You can view a comprehensive breakdown on our Data privacy and GDPR compliance page.

How does the GDPR compare to the CCPA?

California may be just one of 50 U.S. states – but it’s the 4th largest economy in the world. It passed its own data privacy law in 2018. Here’s a quick rundown of the key similarities and differences with the GDPR.

Take our GDPR quiz

There’s a great deal to see and remember about GDPR. We created this quick quiz to test your understanding of the key concepts – so you can feel more confident about using a quiz maker to engage and collect zero-party data from your audience.

Frequently asked questions

Last reviewed: October 26, 2026 by Boris Pfeiffer, Riddle’s Founder and CEO.