GDPR and affiliate tracking: cookies, IP addresses and personal data

An affiliate programme handles personal data: of people who click, people who buy and the affiliates themselves. This is a practical summary, not legal advice; check your own case with whoever supports you on data protection.

Which data tracking collects

• From people who click: IP address, device type, country and the referring page.
• From people who buy: usually just an order identifier and the amount. The affiliate platform doesn't need the customer's name or email.
• From affiliates: contact and payment details.

Cookies and consent

Postback tracking ties the sale to the click through a click ID the advertiser stores, with no third-party cookies. A pixel depends on the browser and on cookies, which is where consent rules weigh most. See postback vs pixel.

Good practice

1. Collect the minimum: don't send customer names or emails in postbacks.
2. Protect IP addresses: store them pseudonymised and delete them after a short period.
3. Set retention periods for clicks and conversions.
4. Have a data processing agreement with the platform, which handles the data on your behalf.
5. Answer requests: you must be able to export and delete one person's data.

What to ask the platform

• Where is the data stored and who can access it?
• Are IP addresses stored in full?
• Is each customer's data isolated from the others?
• Is there 2FA and an audit log?

In RastroAff

IP addresses are stored only as a hash and in truncated form; the truncated form is deleted after 30 days by default. Each network's data is isolated in the database, affiliates' payment details are encrypted, administrators use 2FA and sensitive actions go to an audit log. Each user can export their data and request deletion of their account.