Summary
Affiliate tracking exists to credit a sale to the publisher who sent the customer. Traditionally that is done with a cookie, but browsers increasingly restrict cookies. This article explains which methods exist (cookie, click ID, server-side postback, voucher code), where their limits lie and why "without cookies" does not mean "without consent". It is not legal advice.
How does affiliate tracking work?
The publisher places a link with an identifier on their page. When a visitor clicks, the system remembers that identifier, usually in a cookie in the browser. If the visitor buys later, the sale is matched to the identifier and the publisher earns commission. Attribution normally follows a last-click rule: the last click before the purchase counts.
The network Awin describes affiliate marketing as traditionally working with cookies, usually a first-party cookie, which typically stay active for 30 days [1]. The brand sets the duration. The same source notes that a JavaScript error can stop the cookie being stored, so the publisher receives no commission [1].
What does "without third-party cookies" mean for affiliate programmes?
Third-party cookies come from a different domain than the page being visited. According to WebKit, Safari blocks them by default with no exceptions [2]. Google decided in April 2025 to keep them in Chrome and not to introduce a new prompt [3]. For your programme this means that methods relying only on third-party cookies do not work in Safari, while in Chrome they work as long as users do not block them themselves.
The distinction from first-party cookies and tracking on your own domain matters. Limits apply there too: WebKit deletes cookies written by JavaScript after seven days without interaction with the site, and caps cookies created from click IDs in links at 24 hours [2]. How long attribution lasts therefore depends heavily on the browser.
Which tracking methods are there?
There are four common building blocks, often combined. The table shows how they work, their strengths and their limits.
| Method | How it works | Strength | Limit |
|---|---|---|---|
| First-party cookie | The identifier is stored in the browser on your domain | Simple, widespread, attribution over days | Browsers cap the lifetime and users can delete cookies [1][2] |
| Click ID | An identifier is attached to the link as a parameter and returned at purchase | Works without a third-party cookie | Has to be stored on the page, and Safari limits that [2] |
| Server-side postback | Your shop reports the sale with the identifier directly to the network | Independent of the browser at purchase | The identifier must have been stored somewhere beforehand |
| Voucher code | The code is assigned to a publisher | Attribution possible without a click | Depends on the programme terms [1] |
The consultant Marcel Richter recommends running cookie and postback in parallel and checking tracking regularly [4]. Awin also describes attribution by voucher code and notes that it depends on the advertiser's programme terms [1].
What is a click ID and why does it matter?
A click ID is a unique identifier created when someone clicks the publisher's link. It is attached to the destination address as a parameter, for example after a question mark. Your shop reads it from the address, stores it and returns it to the network at purchase. That lets the sale be matched to the right click even without a third-party cookie.
The weakness is storage. WebKit describes that such click IDs in links are detected, and cookies created by JavaScript on the landing page are then capped at 24 hours [2]. A click ID on its own is therefore not enough if customers buy only after several days. A method that keeps the identifier available on the server side helps here.
What is server-side tracking?
With server-side tracking, also called a server-to-server or postback call, your shop server reports the sale directly to the network, without the customer's browser playing a part. The message contains the click ID and the order value. This lowers the risk that an ad blocker or browser setting stops the message.
Server-side reporting does not replace the step before it: the identifier has to be captured at the click, in the browser or on your server. It also does not settle the legal question, because server-side methods can process personal data too [5]. On selecdoo Starter, tracking runs through a tracking pixel or the Shopify app, using last click or voucher code.
Do you need consent for affiliate tracking in the UK?
For brands with UK customers, PECR Regulation 6 applies rather than the German TDDDG. The ICO published its final guidance on storage and access technologies on 29 April 2026. According to the law firm A&O Shearman it covers cookies, tracking pixels and device fingerprinting, and includes an example of how tracking pixels apply to affiliate marketing consent [6]. Consent is the starting point and the exemptions are narrow, so do not assume your set-up is exempt. Whether consent is needed in your case depends on the exact method, and a specialist should check it.
What does German law say?
If you also sell to customers in Germany, the German view is strict. Dr. Datenschutz concludes that under the TDDDG, the question of consent for affiliate tracking with cookies can "simply" be answered with yes [5]. The same source writes that cookieless tracking can also fall under section 25 TDDDG and that the label "cookieless" says nothing about whether consent is needed [5].
The law firm SBS Legal noted in 2023 that affiliate cookies are only necessary for tracing the path from link to sale, not for using the website, and so do not fall under the exemption [7]. The lesson for either market: whether with or without cookies, do not adopt a blanket statement that no consent is needed.
Who is responsible under data protection law?
Shop, network and publisher can be joint controllers under Article 26 GDPR. Dr. Datenschutz describes a possible three-way joint responsibility and notes that it can be enough for the publisher to trigger the processing by placing a link [5]. SBS Legal also regularly sees affiliate and merchant as joint controllers [7].
In practice, agree with your partners who informs the people concerned and put it in writing. Have your privacy notice and consent process reviewed by a qualified adviser. This is not legal advice.
How do you choose the right method?
Choose by shop system, buying cycle and legal position, not by buzzword. On Shopify the app is the shortest route, on other systems the pixel. If customers deliberate for a long time you need attribution that lasts longer than 24 hours, and you should ask your provider how the identifier is stored.
Voucher codes are an additional route because they allow attribution without a click when the programme terms provide for it [1]. In every case, check with test orders that click and code arrive in the report, and repeat the test after changes to the shop.
Conclusion
Tracking without third-party cookies is possible but not automatic: every method has limits, and browsers behave differently. The legal side adds to this, and "without cookies" is no all-clear. You will find an overview on the page about cookieless affiliate tracking explained. selecdoo is now opening to UK brands. You can start free or talk through your shop's tracking in a Discovery Call. You can cancel with four weeks' notice to the end of a quarter. This article is not legal advice.
Sources
- Awin (17 August 2020, page without an update date): Affiliate-Tracking einfach erklärt (in German)
- WebKit (continuously maintained page, accessed 4 November 2026): Tracking Prevention in WebKit
- Didomi (29 April 2025, on Google's announcement of 22 April 2025): Google Chrome is keeping third-party cookies after all: What does it mean?
- Marcel Richter (4 February 2026): Perfektes Partnerprogramm-Tracking: So schaffst du die technische Basis (in German)
- Dr. Datenschutz (20 October 2026): Affiliate-Marketing und Datenschutz: So kann es funktionieren (in German)
- A&O Shearman (15 May 2026, on ICO guidance of 29 April 2026): ICO sets out approach to storage, access and online tracking
- SBS Legal (4 December 2023): Cookies verboten? Datenschutz im Affiliate-Marketing (in German)
Note: All sources were accessed on 4 November 2026. This article is not legal advice. The law can change, so check older sources accordingly.