Affiliate tracking processes personal data such as click IDs and IP addresses. Therefore, the GDPR and – as soon as something is stored or read on the user’s device – § 25 TDDDG apply. In practice, this means: affiliate cookies usually need consent, tracking belongs in the consent management platform and the data protection declaration, and a contract is concluded with the network for order processing. Cookieless Tracking makes the measurement more robust, but does not replace consent.
This article provides a general overview of the legal status of October 2026 and does not replace legal advice. Have your specific setup checked by your data protection officer or a law firm.
What rules apply?
In affiliate marketing, three sets of rules interlock. They concern different questions – and are therefore often confused:
| Rules | What it is | Importance of Affiliate Marketing |
|---|---|---|
| DSGVO | Any processing of personal data requires a legal basis, transparency and security. | Applies to click IDs, IP addresses, order data and their comparison – regardless of whether cookies are in play. |
| § 25 TDDDG | Storing and reading information on the device, such as cookies or local storage. | For affiliate cookies and stored click IDs, consent is usually required. |
| UWG | Fair competition, including the labelling of advertising. | Publishers must make affiliate links and recommendations recognizable as advertising. |
The TDDDG was called TTDSG until May 2024. In terms of content, nothing has changed in the cookie rule in § 25. The basis for this is the European ePrivacy Directive, which is why similar rules apply in other EU countries. The mandatory labelling is a separate topic, which we explain in the Guides on affiliate links.
What data is involved in affiliate tracking
To understand where consents are needed, a look at the path of a click to the commission helps:
- 01Click
The user clicks on a affiliate link at the publisher. The network registers the click with time stamp and IP address.
- 02Click ID
The network generates a unique identifier and attaches it to the destination URL in the shop.
- 03Storage
The shop or tracking script stores the click ID, usually in a cookie.
- 04Order
When purchasing, the click ID with order number and shopping cart value is reported to the network.
- 05Reconciliation
The network assigns the sale to the publisher and calculates the Commission.
Names, addresses or email addresses of the buyers do not need the network for this. Nevertheless, click IDs and IP addresses are considered personal data because they can be assigned to a person or a device. The GDPR is therefore always applicable. Whether § 25 TDDDG additionally applies depends on step 03: Is something stored or read on the user's device?
Do affiliate cookies need consent?
As a rule, yes. § 25 TDDDG allows the storage and reading of information on the terminal device without consent only if it is absolutely necessary for a service to work that the user expressly wants to use – for example for the basket or the login. The German data protection supervisory authorities interpret this exception very narrowly. Tracking, which serves for billing with advertising partners, is not included in the majority of opinion: The shop works for the customer even without an affiliate cookie.
Occasionally, it is argued that commission settlement is indispensable for the business model and therefore allowed without consent. You should not rely on that. Anyone who sets affiliate cookies without consent risks warnings and fines – according to the TDDDG up to 300,000 euros, according to the GDPR significantly more.
Since the judgments of the ECJ (Planet49, 2019) and the BGH (Cookie Consent II, 2020), clear requirements apply for effective consent:
- Active and voluntary: Preselected boxes or "Continuation is considered consent" are not enough.
- Before setting: The affiliate script may only load after the user has consented.
- Informed: The userityityity must be able to recognize that data is processed for partner programs – ideally in its own category or with the network as the named provider.odcip togethercipcipationsure aufap aheadodap too.
- Equivalently rejectable: Rejecting must be as simple as agreeing. A clearly visible “reject” button on the first level is the safe way.
- Revocable: The settings must be open and changeable at any time, for example via a link in the footer.
Is Cookieless Tracking the Solution?
When Cookieless or server-to-server tracking, the shop reports the order together with the click ID directly to the network, instead of relying on a cookie in the browser of the network. This makes tracking more robust against ad blockers and browser restrictions. Legally, however, it is not a free pass: As soon as the click ID is stored in the browser – also as a first-party cookie or in the local storage – § 25 TDDDG applies as with any other cookie.
| Methodology | Stored on the device? | Consent according to TDDDG |
|---|---|---|
| Third-party cookie of the network | Yes | Usually necessary |
| First-party cookie or local storage with click-ID | Yes | Usually necessary |
| Click ID only on the server side, for example in the shop session | Depending on the implementation | Check on a case-by-case basis |
| Coupon code at the checkout | No | Not necessary |
| Fingerprinting | Read device information | Necessary – and viewed particularly critically by supervisory authorities |
Coupon codes are the only common method that manages without saving on the device. Here too, however, data is processed: order and code are assigned to a publisher. The legal basis for this is usually the legitimate interest by nature. 6 par. 1 lit. f GDPR, and the process belongs in the data protection declaration.
What browsers additionally restrict
Regardless of the law, browsers also limit how long and whether tracking information is preserved:
- Safari
- Blocks third-party cookies completely. First-party cookies set via JavaScript expire after seven days at the latest, in some cases after 24 hours.
- Firefox
- Separates cookies by website by default. Third-party cookies of a network are thus not recognized across pages.
- Chrome
- Has not implemented the announced exit from third-party cookies, but restricts them in individual modes. Nobody should rely on that.
- Ad-blocker
- Block known tracking domains. Server-to-server tracking is hardly affected.
The consequence for advertisers: A clean setup combines consent, first-party storage and a server-side message via Postback. This records every sale for which consent has been given – and not only those for which the browser plays randomly.
Who is responsible?
Data protection law determines who determines the purpose and means of processing. In affiliate marketing, the following picture usually emerges:
Responsible for tracking in your own shop. He obtains the consent, informs in the data protection declaration and keeps the processing in the list of processing activities.
Depending on the contract model, processors by type. 28 GDPR, jointly responsible by art. 26 GDPR or independently responsible person. The model must be clearly regulated in the Treaty.
Responsible for your own website or channel. He does not receive customer data from the shop – he only sees anonymizedidau salesidauidauauauauauau commissions.
If the network works as a processor, you need a contract for order processing (AVV). Also, pay attention to where the data is processed: For servers outside the EU, the rules for third-country transfers are added. Adlesa works as a processor according to art. 28 GDPR and hosts all data in data centers in Frankfurt am Main – more on the platform page.
Checklist for Advertisers
With these seven steps you implement affiliate tracking in compliance with data protection:
- Documenting tracking setup. Record which scripts, cookies and server messages are used for affiliate tracking and which data flows.
- Check the contract with the network. Clarify the role distribution and complete an AVV when processing orders. Check the server location.
- Incorporate tracking into the consent management platform. Create the network as a provider, assign it to a category such as "Marketing" or "Partner programs" and describe the purpose clearly.
- Load scripts only after consent. Control the affiliate script via the consent management platform or tag manager. Test with rejected consent that really nothing is set.
- Transfer consent status to the network. Thus, the network can handle sales correctly without consent, instead of tacitly processing them.
- Supplement the privacy policy.Specific purpose, legal basis, recipient, storage duration and the cookie duration of the affiliate tracking – also for voucher codes.
- Keep the processing directory and deletion periods. Enter the tracking and specify when click and order data will be deleted.
What Publishers Need to Consider
For publishers, the effort is much smaller, because the actual tracking happens at the network and in the shop. However, a few points apply:
- Privacy Statement: Mention that your site contains affiliate links and users are forwarded to the network and shop when clicking.
- Own tracking tools: For analysis tools, click tracking or embedded creatives with their own scripts on your website, you usually need your own consent.
- Pure links are uncritical: A simple text link does not set cookies on your page. Tracking begins only after clicking on the network.
- Labeling: Regardless of privacy, you must label affiliate links as advertising.
More consents, fewer lost commissions
Any sale without consent is a lost commission for publishers – and for advertisers a reason why partners promote their program less. The consent rate can be improved without pushing users:
“We measure through which partners you come to us so that they are paid fairly” convinces more than a legal block of text.
Length of texts, order of categories and placement affect the rate. Test variants without complicating rejection.
Codes assign sales even without consent in cookies. They are particularly suitable for creators and newsletters.
Explain to publishers your tracking setup. Anyone who understands why numbers fluctuate remains faithful to the program.
Frequent errors
- Tracking loads before consent. The most common error: The script is permanently installed in the shop and runs independently of the cookie banner.
- Classify affiliate tracking as “necessary”. This circumvents consent – and that is exactly what supervisory authorities view critically.
- Confuse "cookieless" with "free of consent". First-party cookies and local storage are also covered by § 25 TDDDG.
- Lack of contract with the network. Without AVV or clear role distribution, the basis for data transfer is missing.
- Forgot coupon codes. The assignment via codes is also a processing of personal data and belongs in the data protection declaration.
- Banner without reject button. A hidden or cumbersome way to refuse makes consent vulnerable.
You want to know how a partner program is set up cleanly from the beginning? Read on in the Guideline for building your own partner program.