GDPR Compliance for Affiliate Marketing: Roles, Legal Basis, and Cookie Consent
Affiliate marketing runs on tracking. A click on a publisher’s site, a cookie that follows the visitor to the advertiser’s checkout, a network that reports the sale back so a commission can be paid. Every step in that chain processes personal data, which means every step sits under GDPR, and the industry has never fully agreed on who is responsible for what.
Príomhghnéithe
• In affiliate marketing, the advertiser is always a data controller because only the advertiser decides why the marketing activity happens. Networks and publishers are either processors or joint controllers, depending on how much independent decision-making they exercise over tracking data.
• GDPR’s lawful basis rules and the ePrivacy Directive’s cookie consent rules are separate. Even where a network relies on legitimate interest for GDPR purposes, cookie consent is still required to set the tracking cookie in the first place, unless that cookie is strictly necessary for a service the user requested.
• A Data Processing Agreement is needed wherever an affiliate or network acts as a processor. Where the relationship is genuinely a joint controllership instead, GDPR requires an arrangement setting out each party’s responsibilities rather than a standard DPA.
Who Is the Data Controller in an Affiliate Marketing Relationship?
The advertiser is always a controller in affiliate marketing, because only the advertiser decides why the processing happens, for example choosing to run a cost-per-acquisition campaign and reward publishers for driving sales. Under GDPR’s controller and processor definitions, a party is a controller if it determines the purposes or means of processing, and a processor if it processes data purely on the controller’s documented instructions without making its own decisions about it.
Where affiliate networks and publishers land on this spectrum varies. Some networks position themselves as pure processors, meaning they process data strictly on the advertiser’s instructions and require the advertiser to approve any new use of that data in advance. Others, including Awin, have published a joint controller position, arguing that because the network independently decides its economic model and how its tracking technology works, it is factually making its own decisions about the data rather than simply following instructions, which places it alongside the advertiser as a joint controller rather than beneath it as a processor.
What Legal Basis Do Affiliate Networks Typically Rely On?
Consent and legitimate interest are the two bases most commonly discussed in affiliate marketing, and the choice matters because it determines what obligations follow. Awin’s published GDPR position illustrates how a major network approaches this: it relies on legitimate interest for its tracking data, having carried out a documented balancing test concluding that tracking pseudonymous, non-sensitive, largely technical data, such as truncated IP addresses, advertiser and publisher IDs, and click references, carries a low risk to individuals’ rights and freedoms, provided that data is not reused to build behavioural profiles or for other marketing purposes.
The EDPB’s draft Guidelines 1/2024 on legitimate interest, published for consultation in October 2024, set out a three-part cumulative test any organisation relying on this basis needs to satisfy: the interest must be lawful, clearly articulated, and genuinely present; the processing must be necessary, with no less intrusive alternative reasonably available; and the interest must not be overridden by the individual’s own rights and freedoms. A network or publisher building behavioural profiles for targeted advertising, rather than simple transaction attribution, faces a considerably harder case to make under this test than one limited to pseudonymous click and conversion tracking.
Do Affiliate Cookies Require Separate Consent From GDPR’s Lawful Basis?
Yes, and this is one of the most commonly missed distinctions in affiliate compliance. GDPR governs the lawful basis for processing personal data. The ePrivacy Directive, implemented differently across EU member states and as PECR in the UK, separately governs the act of setting a cookie on a user’s device, and requires consent for that specifically, unless the cookie is strictly necessary to deliver a service the user actually requested.
This means an affiliate network can have a valid GDPR basis, such as legitimate interest, for processing the data its tracking cookie collects, while still needing separate cookie consent to set that cookie in the first place. Cashback and rewards publishers sometimes have a narrower argument that their tracking cookie is strictly necessary for the cashback service itself, which can exempt it from cookie consent requirements, but this exemption does not extend to standard affiliate tracking used purely for commission attribution.
Our explainer on the difference between GDPR and PECR covers how these two frameworks interact in more detail, and our guide to cookie consent breaks down what a compliant banner needs to capture before an affiliate tracking cookie can legally fire.
What Does an Affiliate Network Owe Publishers and Advertisers Contractually?
Where a network or publisher acts as a processor, Article 28 requires a written Data Processing Agreement covering the processor’s obligations, security measures, and data handling on termination. Where the relationship is genuinely a joint controllership instead, GDPR requires a different kind of arrangement under Article 26, setting out which party is responsible for which obligations, such as handling data subject requests or managing a breach, though this arrangement has more flexibility in form than a standard DPA.
What Should Advertisers and Publishers Check Before Launching an Affiliate Campaign?
A practical pre-launch checklist includes confirming which legal basis the network and advertiser are relying on for tracking data, and whether that basis genuinely fits the campaign’s activity, particularly where behavioural targeting or remarketing is involved rather than simple attribution. It also means confirming a data processing or joint controller arrangement is actually signed with every network and affiliate involved, since an unsigned or missing agreement is a common compliance gap even where the underlying data handling itself is reasonable. Cookie consent needs its own separate check: confirming the tracking cookie is covered by the site’s consent mechanism and does not fire before valid consent has been captured, where consent is required. Finally, privacy policies need to actually disclose that affiliate links set tracking cookies and name the networks involved, which is a disclosure many standard privacy policy templates omit entirely.
Conclúid
Affiliate marketing’s GDPR exposure rarely comes from a single dramatic failure. It comes from unclear roles: who is the controller, what basis actually applies, and whether cookie consent has been separated correctly from the underlying data processing basis. Awin’s published position shows that even major networks land in different places on these questions, which means advertisers and publishers working across multiple networks cannot assume one network’s compliance model automatically applies to another. Getting the roles and legal basis documented per relationship, rather than assumed, is what closes the gap most affiliate programmes actually have.
Frequently Asked Questions
Is a signed contract with an affiliate network enough to be GDPR compliant?
Not on its own. The contract needs to correctly reflect the actual relationship, whether that is controller-processor or joint controllership, and needs to include the specific obligations GDPR requires for that relationship. A contract that mislabels the relationship, for example calling a factually joint controller a processor, does not change the underlying legal analysis.
Do small affiliate publishers need their own privacy policy for tracking cookies?
Yes. Any website using tracking cookies, including affiliate tracking cookies, needs to disclose this in its privacy policy and, where consent is required under the ePrivacy Directive or PECR, obtain that consent before the cookie is set, regardless of the publisher’s size.
Can an advertiser avoid GDPR responsibility by blaming the affiliate network for tracking failures?
Not generally. As the party that determines why the marketing activity happens, the advertiser is a controller and carries its own GDPR obligations independent of what the network does. Where damage results from a joint processing operation, GDPR’s joint and several liability rules mean an affected individual can pursue either party regardless of which one is most directly at fault.
Disclaimer: This blog post is intended solely for informational purposes. It does not offer legal advice or opinions. This article is not a guide for resolving legal issues or managing litigation on your own. It should not be considered a replacement for professional legal counsel and does not provide legal advice for any specific situation or employer.
About the Author
Zlatko Delev
Country Manager & Head of Commercial — GDPRLocal
Zlatko specialises in data protection compliance, ISMS strategy, and AI law. With a legal background and hands-on experience supporting organisations globally, he helps businesses navigate GDPR, the EU AI Act, and international privacy frameworks.
About the Author
Head of Commercial & Country Manager
Zlatko Delev is Head of Commercial and Country Manager at GDPRLocal, where he leads the company’s commercial strategy and market presence. He brings international experience across sales, marketing, and customer success, along with a legal background from his studies at Iustinianus Primus Law School in Skopje, Macedonia.
Zlatko sits at the front line of GDPRLocal’s client relationships, guiding organisations through the first stages of their compliance journey and helping them understand where they stand and where they need to go on GDPR, information security, and the emerging landscape of AI regulation. His role bridges commercial strategy with practical data protection knowledge, ensuring clients get clear, actionable direction from their very first conversation with GDPRLocal.
Alongside his commercial focus, Zlatko has trained extensively in project management and organisational leadership, including risk management, stakeholder communication, agile methodology, and digital marketing, a broad skill set that supports his structured, delivery-focused approach to growing GDPRLocal’s business internationally.