Affiliate Cookies Without Consent?
The UK Data (Use and Access) Act 2025 marks a turning point for affiliate marketing. As the first country to do so, the UK is introducing a targeted cookie exemption for the statistical attribution of transactions – without requiring user consent.
What does the Data Act 2025 mean for affiliate marketing?
Starting from June 2025 (with full implementation by June 2026), certain affiliate tracking cookies may be set without prior user consent, if the following conditions are met:
- They do not enable profiling or advertising
- They are used solely for statistical attribution
- The data is collected in an anonymised and aggregated way
- A clear opt-out option is provided
➡️ This applies primarily to low-risk scenarios like standard click-to-purchase tracking.
When is affiliate tracking allowed without consent?
Scenario: Click on an affiliate link → anonymous purchase → cookie stores attribution data for commission tracking Consent required? ❌ No
Scenario: Cookie tracks user behaviour beyond the purchase (e.g. remarketing or retargeting) Consent required? ✅ Yes
This new exemption is similar to the existing cashback/loyalty rule, which has allowed cookies without consent since October 2024 – provided the user is actively registered and the cookie is necessary to fulfil the promised service.
Legal context: PECR vs. TDDDG
While the UK allows this exemption under PECR, the TDDDG (Telecommunications and Digital Services Data Protection Act) still applies in Germany, Austria, and Switzerland.
There, explicit consent remains mandatory for all non-essential cookies – including affiliate tracking – regardless of the purpose.
Opportunities for advertisers and publishers
For advertisers in the UK, this opens the door to higher conversion rates and simpler tracking setups:
- Fewer consent-related drop-offs
- Accurate attribution despite privacy compliance
- Easier integration with affiliate networks
For publishers, it provides the chance to track effectively without complex CMP setups – as long as the technical standards are met.
But caution is advised
This exemption does not apply to all affiliate models. Anyone planning to use consent-free tracking must ensure:
- Strict purpose limitation is technically enforced
- Transparency through privacy policies and user-facing communication
- A clear opt-out mechanism is available
- Clean interfaces with networks and advertisers are in place
Conclusion: Consent-free affiliate tracking – but with clear rules
With the Data Act 2025, the UK is pursuing a privacy-conscious but affiliate-friendly approach. The exemption proves that data protection and performance do not have to conflict – when boundaries are respected and technical implementation is sound.
➡️ For advertisers focused on the UK market:
Now is the time to review your tracking setup and seize the opportunity to boost conversions without regulatory risk.
