The set of requirements that affiliate programs operating in the EU and UK must meet under the General Data Protection Regulation (GDPR) and UK GDPR. Key requirements: (1) Cookie consent: non-essential cookies (including affiliate tracking cookies) require explicit user opt-in before placement; brands must implement compliant consent management platforms that present cookie choices clearly, default to declined, and record consent. (2) Data processing agreements (DPA): affiliate networks processing EU/UK user data must have signed DPAs with brands they serve; major networks (Awin, Impact) have GDPR-compliant infrastructure and standard DPA templates. (3) Privacy policy disclosure: brands must disclose affiliate tracking practices in their privacy policy; publishers must disclose affiliate link use in their privacy policies. (4) Publisher agreement requirements: include GDPR compliance obligations in publisher agreements for publishers reaching EU/UK audiences. Impact on attribution: GDPR cookie consent requirements mean some EU/UK conversions are unattributed when users decline cookies; server-side tracking (S2S postback) is more resilient to consent-based attribution loss than cookie-only tracking.
Related Resources