Check affiliate marketing data protection before your next campaign

What to take away

• Decide in writing who controls each data flow, brand, network or publisher, before you switch tracking on.
• Match every lawful basis and consent signal to the specific processing it covers, not to a broad privacy notice.
• Check eIDAS trust services if electronic signatures, seals or timestamps appear in publisher contracts or payout approvals.
• Keep consumer-facing disclosures accurate, because Consumer protection rules on GOV.UK apply to affiliate advertising as much as to any other promotion.

Who is responsible for affiliate marketing data protection?

Responsibility follows the data, not the contract label. If your brand sets the purpose and means of processing, it is likely the controller. A network that decides how conversions are matched may also be a controller for that step. Publishers usually control their own audience data.

Record that split in your affiliate marketing commercial contracts, so each party knows what it may do with personal data and how it answers requests. Without that clarity, an England team can end up with two organisations claiming the same basis for the same cookie.

Put that allocation in a record of processing, with the purpose and retention for each flow. Teams that cannot show this document tend to lose arguments during audits and buyer due diligence.

Which lawful basis applies to tracking and payouts?

For analytics cookies and cross-site tracking, consent is the usual route under the UK GDPR and the Privacy and Electronic Communications Regulations. For paying a publisher, contract may be the basis. Keep the two apart, because one consent string cannot honestly cover both.

Consent also has to survive withdrawal. If a shopper can switch tracking off in one click, your records should show when that happened and which downstream partners were told.

A data protection impact assessment is worth running before you add a new tracking method, a new network or a new audience segment. It forces the purpose, the lawful basis and the retention period onto one page that a reviewer can check.

The Information Commissioner's Office expects consent to be specific and informed. Where electronic signatures or seals approve publisher terms, the ICO's Guide to eIDAS explains how trust services sit alongside data protection duties.

How do you keep disclosures honest?

Affiliate links must be identifiable as advertising. The Competition and Markets Authority treats hidden affiliate relationships as misleading, and the Advertising Standards Authority applies the CAP Code to publisher and influencer content.

The Interactive Advertising Bureau legal affairs resources cover advertising law and compliance issues that often overlap with data notices. Align your disclosure wording with your privacy notice, so a reader meets one consistent story across the page, the email and the checkout.

What does a workable compliance sequence look like?

1. List every data flow: click, cookie, conversion, payout and reporting.
2. Name the controller and processor for each flow.
3. Choose and document a lawful basis per flow.
4. Check consent capture, withdrawal and records.
5. Review contracts, including audit and breach terms.
6. Publish matching consumer disclosures.
7. Set a review date and assign an owner.

Step four is where most programmes fail an internal audit. If withdrawal is harder than consent, the consent is not valid.

Where does England law end and wider UK law begin?

Consumer protection and data protection are UK-wide frameworks, but enforcement priorities and court practice can differ. Cases heard in England follow England's procedural rules, while Scotland and Northern Ireland have their own court structures.

For a programme selling across the UK, build to the UK-wide baseline and check local differences before you expand. The affiliate marketing UK rules and compliance guide for 2027 sets out the wider framework this data work sits inside.

Common questions

Do affiliate networks need a data processing agreement?

Usually yes, where the network processes personal data on a brand's behalf. The agreement should state the subject matter, duration, purpose and security measures, and it should allow audits.

Can we rely on legitimate interests for affiliate tracking?

Sometimes, but it is a weak fit for cross-site tracking where consent rules apply. Document any balancing test and keep it under review.

How long should we keep click and conversion records?

There is no single retention period. Keep records only as long as needed for payment, fraud checks and legal claims, then delete or anonymise them.

Does eIDAS change our consent duties?

No. eIDAS governs electronic signatures, seals and timestamps. It sits alongside data protection law rather than replacing it.

This article is general guidance only. Individual cases need a qualified adviser.