Affiliates, partners and ad networks place cookies and tags on the site or on visitors’ pages. When something goes wrong, the question is: who is responsible? The answer depends on the contract, each party’s role and the knowledge the company has of what is installed.
The essentials in a definition
Affiliate and partner cookies let you attribute sales to those who originated them, but involve several entities that process data. Defining who answers for what, which cookies are used, on what basis and how consent is obtained avoids risks. The ePrivacy Directive requires information and consent for non-essential cookies, EDPB guidelines explain roles, and the Unfair Commercial Practices Directive requires transparency in partnerships.
Who places what
Affiliate networks and partners may have tags on your site (to measure sales) and on their own page (to record the click). When a page loads, the browser may receive cookies from several domains. The company does not always know which, or for what purposes.
Each cookie or tag is a data-processing activity, with controllers and purposes.
Responsibility
Generally, whoever controls the site is responsible for informing visitors and obtaining consent when necessary, even for cookies placed by partners through its site. Partners also have responsibilities in their own environments. Contracts should clarify roles, purposes, security measures and what happens in case of an incident.
Without a clear contract, risk often falls on whoever controls the page.
Managing affiliate and partner cookies
- Inventory partner cookies and tags
- Require documentation and clear contracts
- Ensure consent before firing
- Review and remove what does not comply
What the company should do
Inventory partner tags and cookies on its site. Require documentation from each partner (purposes, data, duration, sub-processors). Ensure they fire only after consent, where necessary. Include the information in the cookie notice and privacy policy. Review periodically.
Remove partners that do not comply or no longer work with you.
Whoever opens the door of the site has to know who comes in.
When a problem arises
If a partner uses data for unagreed purposes, or if there is an incident, activate the response process: identify, contain, inform, correct. Record everything. In case of legal doubt, seek support. Use the episode to improve contracts and checks.
Preventing costs less than repairing.
Decision table
| Entity | Likely role | Responsibility |
|---|---|---|
| Advertiser | Responsible for the site and choices | Inform and obtain consent |
| Affiliate network | May process data on its own or the advertiser’s behalf | Written agreement on roles |
| Affiliate | Redirects traffic and may set cookies | Comply with rules and transparency |
| User | Data subject | Informed with effective choice |
Common mistakes to avoid
- Not knowing which cookies exist. Do the inventory and classification.
- No agreement between parties. Define roles and responsibilities in writing.
- Cookies firing without choice. Respect consent before activating.
How to measure the result
Periodically audit cookies and partner links, and track compliance with consent rules.
Limits and exceptions
Qualifying roles (controller, processor, joint controller) can be complex, and cookie practices change with browsers and rules. This content is informational and not legal advice. When in doubt, simplify the partner chain and seek specialist support.
Illustrative example
Illustrative example: a shop reviews its affiliate programme and finds some cookies are set before the user chooses. It changes the configuration to activate only after consent, updates the cookie policy with the list of entities and signs an agreement with the network. Complaints disappear, and the company is safer.
Frequently asked questions
Am I responsible for affiliates’ cookies on my site?
Generally you are responsible for informing and obtaining consent. Clarify in the contract and validate legally.
How do I find out which cookies exist?
With cookie-scanning tools and a tag inventory.
Can I demand documentation?
You should. It is good practice and, in many cases, necessary.
Who is responsible for affiliate cookies?
It depends on roles; define in writing who decides purposes and means, and consult legal support.
Do I need to list partners?
Inform clearly who receives data and why, in line with transparency rules.
Inventory affiliate and partner cookies, define roles in writing, obtain consent before activating them and be transparent with users.
Sources and recommended reading
- ePrivacy Directive (2002/58/EC)
- Unfair Commercial Practices Directive (2005/29/EC)
- EDPB: guidelines and recommendations
Last editorial review: October 2026. Informational content; always confirm current conditions in the official sources before deciding.