How Affiliate Marketing Works (and Where Compliance Attaches)
A neutral primer on affiliate links, tracking cookies, and commissions — and how each mechanic maps to a specific compliance obligation.
Understanding the mechanics of affiliate marketing makes the compliance obligations easier to see, because each moving part — the tracking link, the cookie, the commission — corresponds to a specific legal duty. This page is a brief, neutral primer for readers who want the technical context before diving into the rules.
The basic model
An affiliate promotes a merchant’s product using a unique tracking link. When a visitor clicks that link and completes a qualifying action — usually a purchase, sometimes a signup or lead — the affiliate earns a commission. The relationship is typically managed through an affiliate network (such as a large marketplace program or an independent network) that handles tracking, reporting, and payment.
How tracking works
When a reader clicks an affiliate link, the merchant or network sets a tracking cookie — a small file that records which affiliate referred the visitor. If the visitor buys within the cookie’s window (often 24 hours to 30 or more days), the sale is attributed to that affiliate. This tracking mechanism is precisely why affiliates have data-privacy obligations: tracking cookies are advertising cookies, and in the EU and UK they require consent before they can be set. See GDPR and affiliate cookies.
Where the compliance duties attach
| Mechanic | Corresponding obligation |
|---|---|
| The tracking link earns you money | Creates a material connection → disclosure required near the link. |
| The link is a paid/affiliate link | Should carry rel="sponsored" (or nofollow) for search engines. |
| The cookie tracks the user | Requires consent under EU/UK ePrivacy and GDPR/PECR. |
| The commission is income | Taxable business income; reporting and record-keeping duties apply. |
| The content ranks in search | Must add genuine value to avoid thin-affiliate spam penalties. |
Common program types
- Pay-per-sale — the dominant model; commission on completed purchases.
- Pay-per-lead — commission for a qualified signup or form submission.
- Pay-per-click — rarer today; payment for traffic regardless of conversion.
- Two-tier — commission on sales plus a share of revenue from affiliates you recruit.
With the model in view, continue to the glossary of key terms or begin the US rules with the FTC Endorsement Guides.
Last reviewed July 2026. This page is general educational information, not legal or tax advice.