Become an affiliateStart your program

Law, tax and regulation

GDPR

Also called General Data Protection Regulation, EU data protection regulation, EU GDPR, persondataforordningen.

Short answer

The GDPR is the EU’s General Data Protection Regulation, which since 25 May 2018 has governed all processing of personal data about people in the EU. In affiliate marketing it covers click data, IP addresses, conversions and payout details.

Definition of GDPR.

The GDPR applies when information about an identified or identifiable natural person is processed. The threshold is lower than many assume: an IP address, a click ID and a device ID are personal data when they can be used to single out a person – even if a name never appears. Pseudonymised data is still personal data; only truly anonymous data falls outside.

Every processing activity needs a legal basis – in an affiliate context typically consent or legitimate interest – and a purpose defined in advance. On top of that come the principles of data minimisation and storage limitation: only what the purpose requires may be collected, and it may only be kept for as long as the purpose lasts.

The roles must be settled before data flows. Whoever decides the purposes and means is the controller; whoever processes on behalf of others is a processor and must have a data processing agreement. In an affiliate program, the store, the network and the affiliate are not automatically in the same role, and who is what depends on who actually decides over which information.

Data subjects have rights that must be possible to honour in practice: access, rectification, erasure, objection and data portability. In Denmark, the Danish Data Protection Agency (Datatilsynet) is the supervisory authority. Fines can reach EUR 20 million or 4 % of global annual turnover, and in Denmark fine cases are as a rule decided by the courts after a police report – only uncomplicated cases where the responsible party pleads guilty can be closed with a fixed-penalty notice.

Consent under the cookie rules and a legal basis under the GDPR are two different things

In Denmark, the requirement for consent before information is stored or read on the user’s device comes from the Danish cookie order (cookiebekendtgørelsen), not from the GDPR. It covers everything that accesses the device – cookies, localStorage, pixels and fingerprinting – whether or not the information is personal data. If the user says no, tracking must not start.

Once the information has been collected, the GDPR takes over: the processing needs a legal basis, a purpose and a deletion deadline, and the user must be able to read about it in a privacy policy. Two sets of rules, two questions – consent to one does not replace the legal basis for the other.

What it means for an affiliate setup

Write down what information is actually stored for a click and for a conversion, how long it is kept, and who can see it. Order value, order ID, timestamp and a click ID are enough to settle a sale. The customer’s name, email and order lines rarely are, so they should not be passed on to either the network or the affiliate.

Set a retention period you can justify. Click data needs to live longer than the longest attribution window plus the approval period, and bookkeeping records have their own deadlines – but neither justifies keeping raw data for years. This text describes the rules in broad terms and is not legal advice.

How it goes wrong

  • 01

    Treating a hashed email as anonymous

    A hashed email can still link two datasets and single out a person. That is pseudonymisation, not anonymisation, so the information is still covered by the GDPR.

  • 02

    Tracking runs before consent

    If the tracking cookie is set the second the page loads, the consent banner is decoration. The order must be the other way round: the choice first, tracking afterwards.

  • 03

    Nobody has settled the roles

    Without a written agreement on who is the controller for what, nobody knows who must answer an access request or delete data. It only comes to light when the request arrives.

Frequently asked questions

Does affiliate tracking require consent?

Yes, when the tracking stores or reads information on the user’s device – that covers cookies, localStorage and pixels. In Denmark the consent requirement comes from the Danish cookie order, and the subsequent processing of the information also needs a legal basis under the GDPR.

Is an IP address personal data?

Yes, when it can be used to identify a person, directly or combined with other information. That also applies to dynamic IP addresses and similar identifiers such as click IDs and device IDs.

Who is the data controller in an affiliate program?

It depends on who decides the purposes and means of each processing activity. The store is typically the controller for its customer data, while the network is the controller for the information it collects itself in order to settle sales. The roles should be agreed in writing rather than assumed.

How long can click data be kept?

For as long as the purpose lasts, and no longer. At a minimum, the purpose lasts until the attribution window and the store’s approval period have expired, and bookkeeping records have their own deadlines. Set a specific deletion deadline and state it in the privacy policy.

Read on