Affiliate marketing data protection: roles and consent

What to take away

Who is responsible for affiliate marketing data protection?

Responsibility follows the data, not the contract label. If your brand sets the purpose and means of processing, it is likely the controller. A network that decides how conversions are matched may also be a controller for that step. Publishers usually control their own audience data. The Data Protection Act 2018 sits alongside the UK GDPR and gives the ICO its enforcement powers, so the Act matters when you allocate responsibility.

Record that split in your affiliate marketing commercial contracts, so each party knows what it may do with personal data and how it answers requests. Large networks such as Awin, CJ, Impact, Partnerize, Rakuten Advertising and Tradedoubler each publish their own data processing terms, so compare them before you sign. Without that clarity, an England team can end up with two organisations claiming the same basis for the same cookie.

Put that allocation in a record of processing, with the purpose and retention for each flow. Check that the ICO holds a current registration for each controller. Teams that cannot show this document tend to lose arguments during audits and buyer due diligence.

Which lawful basis applies to tracking and payouts?

For analytics cookies and cross-site tracking, consent is the usual route under the UK GDPR and the Privacy and Electronic Communications Regulations. For paying a publisher, contract may be the basis. Keep the two apart, because one consent string cannot honestly cover both.

Consent also has to survive withdrawal. If a shopper can switch tracking off in one click, your records should show when that happened and which downstream partners were told.

A data protection impact assessment is worth running before you add a new tracking method, a new network or a new audience segment. It forces the purpose, the lawful basis and the retention period onto one page that a reviewer can check.

The Information Commissioner's Office expects consent to be specific and informed. Where electronic signatures or seals approve publisher terms or payout approvals, the ICO's Guide to eIDAS explains how trust services sit alongside data protection duties. The trust service proves who signed and when, which matters if you need to show a valid contract or valid consent later.

How do you keep disclosures honest?

Affiliate links must be identifiable as advertising. The Competition and Markets Authority treats hidden affiliate relationships as misleading, and the Advertising Standards Authority applies the CAP Code to publisher and influencer content.

The Interactive Advertising Bureau legal affairs resources cover advertising law and compliance issues that often overlap with data notices. Align your disclosure wording with your privacy notice, so a reader meets one consistent story across the page, the email and the checkout.

What does a workable compliance sequence look like?

Step four is where most programmes fail an internal audit. If withdrawal is harder than consent, the consent is not valid.

How does UK-wide data protection apply to affiliate campaigns?

Data protection and consumer protection are UK-wide frameworks. The UK GDPR, the Data Protection Act 2018 and PECR apply across England, Scotland, Wales and Northern Ireland. Enforcement priorities and local practice can differ, so check the ICO's guidance for your market before you expand.

For a programme selling across the UK, build to the UK-wide baseline and check local differences before you expand. The affiliate marketing UK rules and compliance guide for 2027 sets out the wider framework this data work sits inside.

Common questions

These are the questions affiliate teams ask most often before a campaign goes live.

Do affiliate networks need a data processing agreement?

Usually yes, where the network processes personal data on a brand's behalf. The agreement should state the subject matter, duration, purpose and security measures, and it should allow audits.

Can we rely on legitimate interests for affiliate tracking?

Sometimes, but it is a weak fit for cross-site tracking where consent rules apply. Document any balancing test and keep it under review.

How long should we keep click and conversion records?

There is no single retention period. Keep records only as long as needed for payment, fraud checks and legal claims, then delete or anonymise them.

Does eIDAS change our consent duties?

No. eIDAS governs electronic signatures, seals and timestamps. It sits alongside data protection law rather than replacing it.

Do we need to register with the ICO?

Yes, if you process personal data as a controller, you generally need to register with the ICO, unless an exemption applies. Check your registration before a campaign starts.

This article is general guidance only. Individual cases need a qualified adviser.