GDPR and Affiliate Tracking Cookies
Affiliate tracking cookies are advertising cookies. In the EU and UK they require opt-in consent before they can be set — a duty separate from disclosure.
Affiliate marketing runs on tracking cookies, and tracking cookies are regulated. Many affiliates focus entirely on disclosure and overlook a separate, equally enforceable obligation: in the European Union and United Kingdom, you generally need a visitor’s consent before you set an affiliate tracking cookie. This page explains why, and what it requires.
Why affiliate cookies are not “strictly necessary”
Under the EU ePrivacy Directive, consent is required before storing or accessing information on a user’s device, except where strictly necessary to provide a service the user has requested. Affiliate tracking cookies exist to attribute a sale to an affiliate for a commission and to track users for advertising purposes. That benefits the affiliate and the merchant — it is not a service the user requested — so affiliate cookies fall outside the exemption and require opt-in consent before they can be set.
The core point
An affiliate tracking cookie is an advertising cookie. In the EU and UK it may not be set until the user has given valid, informed, opt-in consent.
What valid consent looks like
Consent must meet the GDPR standard: freely given, specific, informed, and unambiguous, given by a clear affirmative action. In practice that means:
- Non-essential cookies (including affiliate tracking) are blocked until consent is given.
- The banner offers “Accept” and “Reject” with equal prominence.
- No pre-ticked boxes, no “continue browsing = consent,” no cookie walls that force acceptance.
- Granular category controls let users choose.
- A record of consent is kept, and users can withdraw as easily as they consented.
The Court of Justice of the EU confirmed in the Planet49 case that pre-ticked boxes do not constitute valid consent.
What an affiliate running EU or UK traffic must do
- Deploy a consent banner that blocks affiliate and analytics cookies until the user opts in.
- Disclose the affiliate and advertising purpose, and name the third parties or networks involved, in your cookie notice and privacy policy.
- Honor rejection — if the user declines, do not fire tracking cookies or pixels.
- Keep consent records and provide an easy way to change or withdraw consent.
Continue to the ePrivacy rules and consent mechanics, the UK PECR and the Data (Use and Access) Act 2025, and practical cookie consent management.
Authoritative sources
Last reviewed July 2026. This page is general educational information, not legal or tax advice.