Become an affiliateStart your program

Law, tax and regulation

Cookie consent

Also called cookie banner, consent banner, cookie notice, ePrivacy consent.

Short answer

Cookie consent is the user's active acceptance that a website may store or access information on the user's device for anything beyond what is strictly necessary – including affiliate tracking. Consent must be obtained before the cookie is set.

Definition of Cookie consent.

In Denmark, cookie consent is governed by the Danish Cookie Order (cookiebekendtgørelsen), which implements the ePrivacy Directive and is administered by the Danish Business Authority (Erhvervsstyrelsen). The rule covers all storage of and access to information on the user's device – not only cookies, but also localStorage, session storage and reading the device's characteristics. Only what is strictly necessary to deliver the service the user has explicitly requested is exempt.

The consent itself must meet the GDPR definition: freely given, specific, informed and unambiguous. In practice this means the user must take an active step, rejecting must be as easy as accepting, purposes must be described separately, and consent must be as easy to withdraw as it was to give.

Tracking for affiliate purposes normally falls outside the exemption. The click ID exists because a third party needs to be paid commission, not because the user asked to see a page. In practice, affiliate cookies are therefore placed in the same category as marketing cookies and may only be set once the user has said yes.

Who is responsible – the affiliate or the store

The obligation follows the domain. If your blog sets a cookie when someone clicks an affiliate link, it is your banner and your documentation. If the online store sets a cookie when the visitor lands with a click parameter in the URL, it is the store's. Neither party can point to the other.

The network is the third party in the chain. That does not change who has to ask, but it does mean that both the affiliate and the store must be able to describe what is stored, how long it is kept and who it is shared with. That is exactly the information a valid consent requires.

What rejection costs in measurement

If the user rejects, the cookie may not be set, and a conversion that could only be matched via that cookie cannot be attributed. The share of traffic that rejects is therefore a direct deduction from what an affiliate program can measure. It does not mean the sales did not happen.

It is also why a click ID in the URL is more robust than the cookie alone: if the information is carried in the link and matched on the server at conversion, measurement depends less on what may be stored in the browser. The legal assessment of when that requires consent still lies with whoever runs the site.

How it goes wrong

  • 01

    The script fires before the choice

    The most common mistake is technical, not legal: the banner is shown, but the tracking script has already loaded in the page head and set its cookie before the user has touched anything. Check it in your browser's developer tools rather than trusting the setup.

  • 02

    Rejecting is harder than accepting

    A big green accept button next to a grey link with three clicks to say no does not meet the requirement of freely given consent. Accept and reject must sit at the same level and cost the same number of clicks.

  • 03

    Consent is never maintained

    The cookie list and the description of purposes go out of date as soon as a new tool is added. If the banner is not updated, the consent no longer covers what is actually being set.

At Affilyflow

Cookie consent in practice

Affilyflow's measurement rests on a click ID carried in the link and a cookie on the store's own domain. We do not do fingerprinting, we build no identity graph, and we do not try to recognise the same person across devices. That is a choice about what we want to know about other people's customers, not a shortcoming.

What your cookie banner should look like is something you decide together with your adviser. What we can do is describe exactly what is set, when it is set and how long the click lives, so the description in the banner can be accurate.

Frequently asked questions

Do I need cookie consent for affiliate links?

Yes, if anything is stored on or read from the user's device as part of the tracking. The link itself does not require consent, but the tracking that is activated by the click normally does.

What happens to my commission if the user rejects cookies?

If the click cannot be matched to the order, no commission arises. If the click ID is carried in the URL and matched on the server, the sale can still be recorded in the cases where the parameter makes it all the way to the purchase.

Who is responsible for the cookie banner – me or the store?

Whoever sets the cookie on their own domain. Your blog is responsible for what is set on the blog, and the online store is responsible for what is set in the store. The responsibility cannot be passed on to the network.

Is consent valid if the box is pre-ticked?

No. Consent requires an active and unambiguous action by the user. Pre-ticked boxes, continued scrolling and closing the banner do not count as acceptance.

Read on