Affiliate and referral programs run on attribution — a cookie that remembers who referred a visitor, so the right partner gets credited if they convert, sometimes weeks later. It's a different purpose than ad retargeting or analytics, which leads a lot of site owners to assume it's exempt from consent requirements. It isn't.
Why it gets treated as "different"
An affiliate-tracking cookie (set by tools like FirstPromoter, PartnerStack, Impact, Tapfiliate, or a custom implementation) doesn't feel like "tracking" in the advertising sense — no ad is shown, no behavioral profile is built for marketing purposes. But GDPR's test isn't "is this for advertising," it's "is this cookie strictly necessary for the service the visitor requested." A referral-attribution cookie fails that test the same way an analytics cookie does: the site works completely fine for the visitor without it. It exists for the business's own commercial purpose (crediting a partner), not the visitor's.
The common failure pattern
Affiliate tracking scripts tend to get installed by whoever runs the partner/affiliate program — often marketing or business development, not whoever owns the CMP configuration — and loaded site-wide so that a referral is captured regardless of which page a visitor lands on first. That site-wide, "needs to always run" requirement is exactly what makes it easy to mark as "necessary" in the CMP, or skip the CMP integration step entirely since it doesn't feel like a marketing pixel.
What to check
- Does your affiliate-tracking script wait for consent the same way your analytics does, or does it fire on every page load unconditionally?
- Is it categorized correctly in your CMP (as "Marketing"/"Functional" rather than "Necessary")?
- If a visitor declines cookies, does referral attribution still work via some other mechanism (e.g., a short-lived first-party cookie only, or server-side tracking with its own basis), or does it just silently fire anyway?
A practical note for anyone running an affiliate program themselves
If you run a partner/affiliate program for your own product, this cuts both ways — it's worth checking your own affiliate-tracking setup with the same scrutiny you'd apply to a client's ad pixels, not just assuming it's exempt because it serves a different business purpose than advertising.
Bannerproof checks for unconditionally-firing scripts of every kind, including referral and affiliate-attribution cookies, as part of every scan. The first scan is free.
This article is informational, not legal advice. Bannerproof is an independent scanning tool, not a law firm or a data protection authority — see our Terms of Service for details.
