Guide · Tracking and data protection
Affiliate tracking without third-party cookies: how it works and what UK GDPR and PECR require
Third-party cookies matter less every year, and many shops wonder how affiliate tracking still works and whether it fits UK GDPR and PECR. This page explains the common methods, outlines the legal position in general terms and shows which tracking routes selecdoo offers. It is not legal advice. selecdoo is now opening to UK brands.
How does affiliate tracking work without cookies?
Without cookies, tracking attributes a purchase to a publisher through other means: a click ID in the address that is reported back at purchase, a voucher code the customer enters, or a server-side confirmation of the order between shop and network. Each method has strengths and limits.
With a click ID, the publisher's link carries a unique identifier. When the purchase completes, the shop reports that identifier to the network along with the order, and the publisher earns the commission. What matters is how the identifier is carried from the first click to the checkout. If it gets lost on the way, the attribution is missing later.
A voucher code needs no link at all. The customer enters the code at checkout, and the order is attributed to the publisher who owns the code. This also works when the customer saw the publisher on one device and bought on another.
With server-to-server tracking, or S2S, your shop sends the order data from its own server to the network. The customer's browser plays no part in the confirmation. That makes the method robust and allows cancellations and returns to be reported later.
Why has cookie tracking become less reliable in affiliate marketing?
Browsers such as Safari restrict or block third-party cookies, customers delete cookies or use ad blockers, and many switch between devices. A cookie set at the click is often gone by the time of purchase. Sales are then attributed to no publisher, even though the publisher triggered them.
For publishers that means lost commission, and for shops a distorted picture: part of the sales appears as direct traffic although a publisher gave the nudge. If you want to judge affiliate marketing fairly, you need methods that do not rely on a browser cookie alone.
No alternative gives a guarantee either. Every method has its own gaps, and customers sometimes buy weeks later or by a detour. A realistic setup combines several routes, which narrows the gaps without closing them completely.
Is cookieless tracking automatically compliant with UK GDPR?
No. Tracking without cookies is not automatically compliant. UK GDPR applies as soon as personal data is processed, such as an IP address or an order with customer details. Separately, PECR regulates storing and accessing information on a user's device. You have to assess both on their own terms.
In the UK, UK GDPR and the Data Protection Act 2018 govern personal data, and the Privacy and Electronic Communications Regulations, known as PECR, govern storing and accessing information on a device. The Information Commissioner's Office (ICO) publishes guidance on both. The Data (Use and Access) Act 2025 changes parts of PECR, including limited exceptions for some low-risk uses, so check the current ICO guidance rather than older articles.
Whether a click ID in a web address falls under PECR depends on whether anything is stored on the device or read from it. That is a question about your actual setup, not about the type of tracking alone. For personal data you also need a lawful basis under UK GDPR and have to inform the people concerned.
This section is a general outline and not legal advice. Have your setup checked by a data protection adviser or solicitor before you go live. If you also sell in Germany, German rules (§ 25 TDDDG and the GDPR) apply to those customers in addition.
The tracking methods compared
The table sums up how the four common methods differ on consent, Safari and cancellation detection. The statements on consent are general and do not replace a check of your own setup.
| Method | Is consent needed? | Safari/ITP-proof? | Cancellation detection |
|---|---|---|---|
| Cookie-based | Usually yes where information is stored on or read from the device (PECR). UK GDPR applies as well. | Limited, Safari restricts cookies used for tracking | Not automatic, cancellations are entered afterwards |
| Click ID in the address | Depends on whether anything is stored on or read from the device. UK GDPR still applies to personal data. | Largely independent of cookies, but lost if the ID is not carried to the purchase | Only if the order is reported with the ID from the server |
| Voucher code | No access to the device needed. UK GDPR applies where order data is personal data. | Yes, attribution does not depend on the browser | As with any order, the code stays with the order |
| Server-to-server (S2S) | The report runs from the server, so PECR is usually not the point. Passing on order data needs a lawful basis under UK GDPR. How the click ID is carried to the purchase stays decisive. | Yes, confirmation does not depend on the browser | Yes, cancellations can be reported automatically (at selecdoo in Growth and Scale) |
General outline, as of November 2026. Not legal advice.
Which tracking methods does selecdoo use?
On Starter you track with a pixel or the Shopify app, by last click or voucher code, and orders are confirmed automatically after 30 days. Growth and Scale use API and server-to-server tracking with automatic cancellation detection. selecdoo does not promise tracking without consent: what you must obtain depends on your setup.
On Starter you install the pixel yourself by following the step-by-step guide. If you use Shopify, you can instead install the selecdoo app for your Shopify affiliate programme. Attribution follows the last-click principle, so the last publisher contact before the purchase counts, or it runs through a voucher code. The pixel has no automatic cancellation detection. On Starter you enter cancellations yourself before the 30 days to automatic confirmation run out.
With Growth you move to modern API and S2S tracking. Your shop and selecdoo then report orders from the server, and cancellations are detected automatically. That saves manual upkeep and makes commission payouts more reliable.
With every variant, check with your data protection adviser what is stored or read in your shop and whether you need consent for it. selecdoo gives no legal advice and does not promise that a setup can do without consent.
What belongs in your privacy notice?
That depends on your setup. It is usual to name affiliate tracking in your privacy notice: purpose, data processed, recipients and lawful basis. Which details exactly are required is something to settle with your data protection adviser or solicitor. selecdoo does not give legal advice.
As a rule of thumb, whatever you do in your shop you must be able to explain. That includes which data goes to the network on a click and on a purchase, what it is used for and how long it is kept. If you run a cookie banner, the affiliate tracking should match the description you give in your privacy notice.
The contract with the network is part of the review too, for example whether a data processing agreement is needed. You can read selecdoo's own notice under privacy. It does not replace the notice for your own shop.
Frequently asked questions about cookieless affiliate tracking
Set up tracking and get started
Starter begins with a pixel or the Shopify app: €0 a month (about £0), with a €500 deposit billed in EUR and offset against commissions. For API and server-to-server tracking with cancellation detection, Growth is the right route. In a discovery call you work out what fits your shop.