Affiliate tracking, cookies and consent

In the EU: consent before storing or reading

The ePrivacy Directive allows storing information on a person's device, or reading information already stored there, only with their consent, given after clear and comprehensive information¹. The exception is what is strictly necessary for a service the person explicitly asked for¹.

It covers links and pixels, not only cookies

The European Data Protection Board describes tracking links that tell an online shop which partner should be paid a commission, and names this affiliate marketing². It considers that the rule applies to tracking links and tracking pixels², and to information kept in the browser, such as local storage, once it leaves the device². The Board's guidelines say what is covered; they leave it to national authorities to decide when consent is not needed².

In the UK: advertising is never "strictly necessary"

The UK regulator, the ICO, says storage and access for online advertising needs consent, cannot rely on any exception, and names ad affiliation among those purposes⁴. Its guidance works through an affiliate example, a partner's details stored at the click and read by a pixel on the order confirmation page, and concludes that the rule applies³.

In May 2026 the ICO suggested to the UK government that some advertising purposes, including measurement and billing, could be exempted in future. It is advice, and the government decides; until the law changes, the guidance above stands⁵.

In France: billing needs consent, cashback may not

The CNIL, France's regulator, says trackers used to bill affiliate operations are not exempt from consent⁶. It also says, citing a 2022 decision of the Conseil d'État, that trackers for a cashback or reward service the person signed up for do not need it, because the person asked for that service⁶. (The CNIL's page is in French; this is our summary.)

In the US: Global Privacy Control

Global Privacy Control is a signal a browser sends, as the header Sec-GPC: 1, asking sites not to sell or share the person's personal information⁷. At least these four states treat it, or signals like it, as an opt-out:

State	What it requires
California	A business that sells or shares personal information must treat a qualifying opt-out signal as a valid request to opt out8; the Attorney General names Global Privacy Control as one9
Colorado	From 1 July 2024, businesses within the Colorado Privacy Act's thresholds must accept Global Privacy Control10
Connecticut	From 1 January 2025, businesses under the Connecticut Data Privacy Act must treat browser signals as opt-outs11
Oregon	From 1 January 2026, controllers must accept universal opt-out mechanisms12

Do Not Track is different: California's Attorney General left it to each business to decide whether to honor it¹³.

What can still credit a partner

A partner's discount code needs nothing stored on the visitor's device: the buyer types it at checkout, and your checkout reports it. So a code can still credit a partner when a visitor says no to tracking. Whether that is enough for your case is a question for your lawyer.

A short checklist

1. Load the tracking script only after the visitor agrees, where your banner asks.
2. Treat Global Privacy Control as an opt-out.
3. Give every partner a code, so a visitor who declines can still credit them.
4. Say in your privacy policy what affiliate tracking stores, and why.
5. Ask a lawyer about the countries you sell in.

This article summarizes what regulators have published. It is not legal advice, and the rules differ by country and state.