Consent and cookies

Tracking stores only a click ID: the ID that links a later purchase to the click that led to it. It sits in a first-party cookie on your domain – not on ours – and there is no tracking across sites or devices.

What is stored

The tracking script (track.js) stores:

The script rewrites the cookie on every visit, but never beyond 90 days from the click. The program's own cookie period – between 14 and 90 days – is enforced on our server, based on when the click happened.

af_t lets your own server renew the cookie without extending it beyond the 90 days. The script never sets af_srv itself: it's only set when you let your own server store the click, and then the script no longer writes af_click and af_t.

The landing report

When a customer lands with a click ID, the script reports it to Affilyflow – again once the click has been stored, and if the customer actively declines marketing. The report contains only the click ID, your store ID and the state of consent – nothing about the visitor. The landing report itself stores nothing in the browser, so it is sent before there is consent too. It is the basis for Tracking coverage in Setup, which shows, among other things, how many customers from affiliates declined marketing or didn't respond.

The WooCommerce plugin sets af_click, af_t and af_srv from your own server (90 days). With Last click wins turned on, it also sets afw_last_network (90 days), which only holds the name of the network that had the customer's most recent affiliate click.

The cookies belong in your own cookie information. Our cookie policy describes them, so you can refer to it.

The cookie domain

The cookie is set on the broadest domain the browser allows – yourshop.com rather than www.yourshop.com – so the click survives if the order confirmation is on another subdomain. To choose the domain yourself, add data-cookie-domain:

<script src="https://app.affilyflow.com/track.js" data-store="DIN_BUTIK" data-cookie-domain="dinbutik.dk" async></script>

Waiting for consent

With data-consent="required", the script stores nothing in the browser – no cookie, nothing in localStorage or sessionStorage and no test cookie – until the visitor has consented to marketing:

<script src="https://app.affilyflow.com/track.js" data-store="DIN_BUTIK" data-consent="required" async></script>

The attribute is optional – without it, the script behaves as it always has. On a custom-built store it's controlled by the Cookie banner setting in Setup: the scan chooses Wait for consent when it finds Cookiebot, Cookie Information, or the built-in banner in DanDomain Classic or Smartweb, and our server adds the setting to the store's own script (/t/DIN_BUTIK.js), so the line on the site doesn't have to change. On the other platforms you add data-consent="required" yourself – it works on both /t/DIN_BUTIK.js and track.js.

If you choose Wait for consent under Cookie banner without the scan having found a banner the script can read on its own (the list below), Setup asks you to confirm that your developer calls affilyflow.consent(true) when the customer accepts marketing. Without that call, no click is stored and no sales are counted.

Until there is consent, the click ID is only held in memory, and a sale waits for the consent answer. Without consent nothing is attributed – not even on the same page.

How the script reads consent

The script reads these cookie solutions on its own:

• Cookiebot – consent to marketing.
• Cookie Information – the cookie_cat_marketing category.
• IAB TCF v2 – publisher consent to purposes 1 and 7.
• Shoporama's own cookie banner – consent to marketing.
• DanDomain Classic's built-in banner – CookiePolicy on the page, when marketing is allowed.
• Smartweb/HostedShop's built-in banner – the cookie_consent cookie with MARKETING.
• Google Consent Mode v2 – ad_storage: granted in dataLayer. This covers the banners that send Consent Mode (Cookiebot, Usercentrics, OneTrust, CookieYes, Complianz and others), even when the script doesn't know the banner itself.

If you use another solution, tell the script yourself:

// Den besøgende siger ja til marketing:
affilyflow.consent(true);

// Den besøgende siger nej eller trækker samtykket tilbage:
affilyflow.consent(false);

You can also set window.affilyflowConsent = true before the script loads.

A no deletes everything the script has stored (af_click, af_store, af_aff, af_t and af_sent) – and also af_srv and the click cookies your server has set. A no is only registered on an active choice by the visitor (the banner's event or a Consent Mode update with ad_storage: denied) – never because the banner hasn't read its own cookie yet.

Personal discount codes without consent

A personal discount code needs no storage in the browser. So if the customer declines marketing, the code can still earn the affiliate commission. Without a click, an order is only sent when it was placed with a personal code.

Shopify and WooCommerce

The Shopify pixel does not ask for consent itself. That belongs to the store's own cookie solution.

From version 1.12.0, the WooCommerce plugin follows a cookie banner that supports the WP Consent API (Complianz, Cookiebot, CookieYes and others): the click is only stored once the customer has accepted marketing. Without such a banner the plugin doesn't ask itself – then it belongs to your own cookie solution. See WooCommerce.

Safari and iPhone

Safari deletes cookies and localStorage set by JavaScript after about 7 days without a visit to the site – in some cases after 24 hours. The script rewrites both on every visit, but cannot and should not get around the limit. That's why the full cookie period counts on computers and Android, while in Safari and on iPhone it's typically about 7 days. A cookie set by the store's own server, like the WooCommerce plugin's, lasts longer. On a custom-built store, your own server can do the same – see Server-side tracking.