Four checks for post-Brexit affiliate tracking between the UK and EU

What to take away

Four checks cover post-Brexit affiliate tracking UK EU: lawful data transfer, VAT on cross-border commissions, PECR cookie consent and tracking accuracy.
UK GDPR and PECR still govern cookies and identifiers used to attribute EU publisher sales, and the ICO enforces both.
The EU and UK treat each other as third countries for data, so transfers need an adequacy route or your own safeguards on file.
VAT on cross-border commissions turns on where the publisher is established and whether it is in business, not on where the click happened.
Link integrity and attribution windows drift fastest across borders, so test EU publisher links monthly and keep the evidence.

Check one: lawful data transfer between the UK and EU after Brexit

The first check is whether personal data in your tracking chain can lawfully move between the UK and the EU. Click identifiers, IP addresses, device data and commission records that name a publisher contact all count as personal data.

Since Brexit the UK and the EU are third countries to each other. The EU's adequacy decision for the UK lets data flow from the EU to the UK without extra paperwork, but it is not permanent and can be withdrawn. UK controllers sending data the other way rely on their own transfer mechanism.

Your tracking stack usually sends data in both directions at once. A UK programme drops a cookie, an EU publisher's site fires a postback, a network in another member state logs the click, and a reporting tool in London pulls it together. Each hop is a transfer.

What to put in place

Map every system that touches click or commission data and mark which country it sits in.
Identify the lawful transfer route for each EU to UK and UK to EU hop, such as adequacy or the International Data Transfer Agreement.
Record the transfer risk assessment for any route that is not adequacy.
Put the same terms in publisher and network contracts so responsibility is not split.
Review the map when you add a network, a tracker or a new EU market.

The UK GDPR sets the consent and lawful basis rules that apply to cookie data used in affiliate tracking, so the transfer check and the consent check overlap. The UK General Data Protection Regulation is the text your programme's privacy notices and publisher terms should point to.

The Data (Use and Access) Act 2025 changed parts of UK data law, including provisions around automated decision-making and the ICO's structure. If your privacy notice or legitimate interest assessment predates it, revisit both. The Data (Use and Access) Act 2025 is the reference to cite when you update them.

For a wider view of how consent, contracts and transfers fit together in UK programmes, see our guide to affiliate marketing data protection.

Check two: VAT treatment on cross-border affiliate commissions

VAT on affiliate commissions is a place of supply question. A commission paid to an EU publisher for introducing a UK sale is a business-to-business service, and the general rule puts the supply where the customer is established.

In practice that means a UK programme buying promotion from an EU publisher usually accounts for the VAT itself under the reverse charge, and the publisher invoices without VAT. The publisher still needs your VAT number on the invoice.

If the publisher is not in business, or is an individual earning commission as a consumer, the supply can sit where the publisher belongs and VAT may be due there. Consumer publishers in the EU are the awkward case, and they are common in content and cashback models.

Northern Ireland and goods

Northern Ireland sits under different rules for goods because of the Windsor Framework. If your programme involves distance sales of goods into the EU, the reporting and payment route differs from the rest of the UK.

The government's guidance on how to check how to report and pay VAT on distance sales of goods from Northern Ireland to the EU sets out the mechanism.

HMRC expects the VAT treatment of commission payments to be documented. Keep the publisher's VAT number, their country, the invoice and your reverse charge entry together, because a mismatch between the invoice and the return is what triggers questions.

Commission paid to a UK publisher is straightforward domestic VAT. The complexity starts at the border, and it scales with the number of EU publishers you pay.

Publisher VAT number collected and validated
Publisher country recorded against each commission line
Reverse charge applied where the publisher is in business in the EU
Consumer publisher commissions reviewed separately
Invoices reconciled to the VAT return each quarter

Check three: cookie consent and PECR duties for EU publisher tracking

PECR governs cookies and similar storage on UK users' devices, and it sits alongside UK GDPR rather than replacing it. The ICO's Guide to Privacy and Electronic Communications Regulations | ICO is the working reference for consent, cookies and electronic marketing.

Affiliate tracking cookies are not exempt. The exemption for storage that is strictly necessary to provide a service the user requested rarely covers attribution, because the user did not ask to be tracked for commission purposes.

That means consent before the cookie is set, a clear explanation of what it does, and an easy way to refuse. Pre-ticked boxes and continued browsing do not meet the standard.

The ICO's Guidance on the use of storage and access technologies | ICO covers how consent should be collected for tracking technologies, including the point that refusing must be as easy as accepting.

Where EU publishers change the picture

An EU publisher tracking UK visitors must meet UK PECR for those visitors. If the same publisher tracks visitors in its own member state, the ePrivacy rules of that country apply too, and they are not identical to PECR.

Your consent management platform may only be configured for one regime. Ask EU publishers which platform they run and whether it geolocates consent banners, because a single banner served across markets is a common gap.

Consent signals also need to reach your tracker. If the tag fires before consent is recorded, the consent state is decorative. Test it rather than trusting the configuration.

Our article on affiliate marketing rules and ethics looks at where consent, disclosure and the CAP Code meet for UK programmes.

Check four: tracking accuracy and link integrity across borders

Cross-border tracking fails quietly. A link that works in London can drop its parameters when it passes through an EU publisher's redirect chain, and the sale lands as direct traffic.

Start with the link itself. Long tracking URLs get truncated by content management systems and email clients, and the parameters that carry the publisher ID are usually at the end.

Then check the redirect chain. Each hop is a chance to strip a query string or rewrite a subdomain, and EU publishers often run more hops than UK ones because of consent and localisation layers.

A worked example

A UK retailer runs a programme with a publisher in the Netherlands. The publisher's link passes through a consent gate, then a localisation redirect, then the retailer's tracker.

The consent gate rewrites the URL and drops the sub-ID parameter. Clicks are recorded, sales are not attributed, and the publisher's reported commission is roughly a third of what the network shows.

A monthly test that follows the full chain from an EU IP address would have caught it in the first cycle. Without it, the discrepancy ran for a quarter before anyone reconciled the two reports.

What to test

Click the publisher link from a browser in the publisher's own country.
Follow every redirect and confirm the publisher ID survives each hop.
Complete a test transaction and check the commission records against the network report.
Repeat on mobile, where consent gates and app browsers behave differently.
Compare network clicks with your own analytics to spot systematic gaps.

Attribution windows are the other cross-border variable. A 30-day cookie that a consent tool resets, or a server-side model with a shorter lookback, will disagree with the publisher's own numbers. Agree the window in the contract and test that it holds. Our comparison of affiliate marketing attribution methods explains how the main models differ in practice.

Check	What can go wrong	Evidence to keep
Data transfer	Missing transfer route for one hop	Transfer map and risk assessment
VAT	Wrong place of supply on consumer commissions	Publisher VAT numbers and invoices
Cookie consent	Tag fires before consent	Consent test screenshots
Tracking accuracy	Parameter dropped in redirect chain	Monthly test transaction log

How to document the four checks for audit and network review

Documentation is what turns four checks into something you can defend. Networks, the ICO and HMRC all ask for evidence, and they ask for it after the fact.

Keep one file per check rather than one file per campaign. The transfer map, the VAT reconciliation, the consent test results and the tracking test log are four separate artefacts with four separate owners.

Steps to build the file

Name an owner for each check and put the name in the document.
Set a review cadence: transfers and VAT quarterly, consent and tracking monthly.
Store test evidence with the date and the person who ran it.
Log every change to a tracker, network or publisher contract against the relevant check.
Review the whole file before any network audit or contract renewal.

Transfer map current and signed off
Transfer risk assessments on file for non-adequacy routes
VAT reconciliation complete for the last quarter
Consent test evidence dated within the last month
Tracking test log complete for all EU publishers
Owners named and review dates set

If you report to a network or a client, the same file answers most of their questions. It also shortens the next audit, because the evidence is already assembled.

For the reporting side of this, including how to present cross-border numbers so they survive scrutiny, see our guide to affiliate marketing measurement.

Common questions

Does EU adequacy cover affiliate tracking data sent from the EU to the UK? Yes, while the adequacy decision stands, personal data can flow from the EU to the UK without extra safeguards. It is reviewed periodically and can be withdrawn, so keep the transfer map current.

Do I charge VAT on commission paid to an EU publisher? Usually not. A business-to-business commission is generally outside the scope of UK VAT under the reverse charge, and the publisher accounts for VAT where they are established. Consumer publishers need separate treatment.

Do affiliate cookies need consent under PECR? Yes, in most cases. Attribution is not strictly necessary for a service the user requested, so the cookie needs consent before it is set, with refusing as easy as accepting.

How often should I test EU publisher links? Monthly at minimum, and after any change to a consent tool, redirect or tracker. Cross-border chains break more often than domestic ones because they carry more hops.

What happens if my tracking data does not match the network's? Reconcile before paying. A gap usually points to a dropped parameter, a consent gate rewriting the URL or a mismatched attribution window, and the test log will show which.

Who enforces these rules for a UK programme? The ICO enforces UK GDPR and PECR. HMRC handles VAT, and the ASA and CAP Code cover how offers and tracking are presented to consumers.