Affiliate program compliance: FTC disclosure and GDPR consent for partner tracking

Affiliate program compliance is the set of legal duties a company owes when partners promote it, and the duties come down to two.

Under the Federal Trade Commission's Endorsement Guides (16 CFR 255.1(d)), partners disclose their commission beside each link and you guide, monitor and correct them.

Under Article 5(3) of the ePrivacy Directive (2002/58/EC), a tracking link that carries an identifier usually needs the visitor's consent before tracking starts, and the General Data Protection Regulation (GDPR) governs the data you keep.

Both duties fall on the company paying the commission, even when a partner or a vendor does the work.

The FTC penalty ceiling is $53,088 per violation in 2026, and GDPR fines reach €20 million or 4% of turnover, per EUR-Lex.

What does affiliate program compliance cover?

Affiliate program compliance is a stack of 5 rule sets, listed in the table: the FTC Endorsement Guides, the CAN-SPAM Act, the ePrivacy Directive, the GDPR and the California Consumer Privacy Act.

The FTC rules protect US audiences, CAN-SPAM protects email recipients, and the two EU instruments protect EU visitors. Penalty ceilings vary widely.

The Endorsement Guides carry no penalty alone, CAN-SPAM reaches $53,088 per email, and the GDPR reaches €20 million or 4% of turnover. The FTC left its penalty amounts unchanged for 2026.

First identify which audiences the program reaches, second map the rules to those audiences, and third assign each duty to the company, the partner or the vendor.

What are the FTC disclosure rules for affiliate links?

A disclosure is a plain statement of the commission relationship, placed beside the link. The Endorsement Guides were revised in 2023, and violations can cost up to $53,088 each under a rule or order.

16 CFR 255.5 requires a clear and conspicuous disclosure of any connection to a seller that could change how much weight people give a recommendation and that the audience would not expect.

Payment, free or discounted products, early access and prizes count, and example 11 covers a blogger whose affiliate links earn a share of each sale.

For example, a link to a SaaS product that pays the blogger 20% of each sale is a material connection.

The Endorsement Guides Q&A supplies the wording. A sentence like "I get commissions for purchases made through links in this post" works, and so does "Paid link" beside the link.

"Affiliate link" alone may not be understood, "commissionable link" is probably unclear, and a "buy now" button is inadequate.

What wording and placement works by format?

Wording and placement depend on the format, as the table shows.

A blog post needs a statement beside the link, a social post needs Ad: or #ad at the start, and a video needs a spoken and on-screen disclosure at the start of the endorsement.

A platform tool is an addition to the partner's own words, never a replacement.

The format guidance comes from Disclosures 101 for Social Media Influencers and the Endorsement Guides Q&A, and 2 of the 5 formats, video and live stream, need the disclosure spoken.

YouTube's paid promotion button adds a label at the start of a video, yet YouTube says creators and partners stay responsible for the law.

Partners abroad count too: the FTC's Disclosures 101 says US law reaches overseas posts that foreseeably affect US consumers, and YouTube names the Advertising Standards Authority in the United Kingdom, the DGCCRF in France and the Medienanstalten in Germany.

What do you answer for if a partner skips disclosure?

16 CFR 255.1(d) holds an advertiser liable for misleading endorsements and for failing to disclose unexpected material connections with endorsers, and lists 3 duties. First, guide endorsers. Second, monitor endorsers. Third, act to remedy non-compliance.

Good faith is no safe harbor, though good faith should lower the odds of enforcement. The Q&A says to keep monitoring for a reasonable time after a contract ends, such as a few months.

The Q&A offers no standard for how much to check and suggests pre-approving posts when regular monitoring is too much.

The Guides lack the force of law, but departures can bring enforcement under Section 5 of the FTC Act.

Civil penalties come when a rule or order is violated, or when a company that received a Notice of Penalty Offenses repeats the practices it describes.

The Federal Trade Commission sent that notice about endorsements to more than 700 companies on October 13, 2021, when the ceiling was $43,792 per violation.

The ceiling is now $53,088 under Sections 5(l), 5(m)(1)(A) and 5(m)(1)(B), set by a January 17, 2025 Federal Register adjustment and left unchanged for 2026 by a September 15, 2026 notice.

How do ePrivacy, GDPR and US state law apply to affiliate tracking?

Why can a tracking link need consent?

Article 5(3) allows storing information on a device, or gaining access to information already stored there, only with the user's consent, apart from what is strictly necessary for a service the user requested.

In Planet49 (case C-673/17, October 1, 2019), the Court of Justice of the European Union held that the rule applies whether or not the data is personal, that a pre-ticked checkbox is not consent, and that users must be told how long cookies last and whether third parties can access them.

The European Data Protection Board's Guidelines 2/2023, version 2.0, reach past cookies. Paragraphs 49 to 51 treat a tracking link, where an identifier is appended to the web address, like a tracking pixel, and use affiliate marketing as the example.

Delivering the link counts as storage, at least through the browser cache, and collecting the identifier counts as gaining access, so Article 5(3) applies. Paragraph 56 adds that exemptions are assessed case by case.

Article 5(3) turns on what sits on the device, whatever domain set it. Commission attribution falls outside the strictly necessary exemption, since the visitor never asked for it, so a first-party cookie gets no pass.

What does valid consent look like?

GDPR Article 4(11) defines consent as a clear affirmative act, and recital 32 says silence, pre-ticked boxes and inactivity are not consent.

The European Data Protection Board's Guidelines 05/2020, version 1.1, add that scrolling or swiping never counts (paragraph 86) and that a cookie wall hiding content until visitors accept is not freely given (paragraphs 39 to 41).

Article 7 requires you to show that consent was given (7(1)) and makes withdrawal as easy as giving it (7(3)).

In practice you need a banner that offers marketing cookies as a separate choice and lets visitors decline as easily as accept, tracking that loads only after a yes, and a consent log you can produce.

A failure of the consent conditions risks fines up to €20 million or 4% of turnover, according to Article 83.

A visitor who declines can't be credited by a cookie. A buyer who types a partner's code at checkout puts nothing on their device, so coupon code tracking keeps working.

Tracking without third-party cookies and first-party link tracking cover what else survives.

Who holds which role under the GDPR, and what are the fines?

Article 4(1) names an online identifier as something that can make data personal, and recital 30 lists cookie identifiers.

You are the controller of the tracking on your site, and a vendor that processes it for you is a processor, which Article 28 requires you to bind by contract.

A partner who only sends traffic processes nothing for you, and a partner who collects leads into your CRM does. Where you and a partner jointly set the purposes and means, Article 26 makes you joint controllers.

Article 83 caps fines for breaching the consent conditions in Articles 5 to 7 at €20 million or 4% of worldwide annual turnover, whichever is higher, and for processor duties in Articles 25 to 39 at €10 million or 2%.

At €600 million in turnover the higher tier reaches €24 million, and below €500 million the €20 million figure is higher. Breaches of Article 5(3) are fined under each member state's law.

Transfers outside the EU sit in the €20 million tier, so ask a US vendor whether the EU-US Data Privacy Framework or Standard Contractual Clauses apply.

What do California opt-out signals require?

The California Consumer Privacy Act (CCPA) is a state privacy law with 3 coverage tests.

The CCPA applies to for-profit businesses with over $25 million in annual revenue, businesses that buy, sell or share the personal information of 100,000 or more California residents or households, and those that earn 50% of revenue from selling it.

The attorney general's CCPA page says covered businesses must honor Global Privacy Control as an opt-out of sale or sharing. Global Privacy Control is a browser signal telling a site not to sell or share the visitor's data.

Whether partner tracking counts as sharing is a question for counsel, and the attorney general enforces the law. For example, a business with 120,000 California households clears the 100,000 test.

Which dates shaped today's affiliate compliance rules?

The rules in force today are the product of 10 dated events, shown in the table. The ePrivacy consent requirement dates from the Directive 2009/136/EC amendment of November 25, 2009.

The GDPR applies from May 25, 2018, and the Court of Justice decided Planet49 on October 1, 2019. The European Data Protection Board published Guidelines 2/2023, version 2.0, in October 2024.

On the US side, the FTC raised the penalty ceiling to $53,088 on January 17, 2025 and left the figure unchanged on September 15, 2026.

Read the table from the top: the EU consent rules come first, the US penalty changes come last, and the Digital Omnibus proposal remains unconfirmed.

What does TrackRev handle and what stays with you?

TrackRev is SaaS affiliate software for indie hackers and small SaaS teams.

The click redirect we built records each click on the server, appends a visitor ID as a _vid parameter and, for a browser with none, sets a 1-year vid cookie.

None of that waits for consent, and partner referral links use the same redirect, so show the redirect to a lawyer with the Board's paragraphs above if you serve EU visitors. I can't tell you it is exempt.

With data-requires-consent="true" on its script tag, the pixel holds its cookie and events until your consent tool calls window.trk.grantConsent(). TrackRev shows no banner, so you need a consent management platform.

In our privacy policy, you are the controller and TrackRev is the processor, with workspace data in the US on AWS us-east-1.

Our own security page offers a data processing agreement on request, so read the agreement's transfer terms before relying on the agreement for EU traffic.

What does the TrackRev Affiliate Program cover?

The TrackRev Affiliate Program is the partner side of the product, and in the program we built, each program can review applicants: the apply form asks "Where will you promote?" and you approve or reject before the link works.

TrackRev does not scan partner content for disclosures or store your partner terms, so draft them with what to include in an affiliate agreement.

Affiliate programs need a paid plan, from Indie at $29 a month with no limit on tracked revenue (pricing), and the free plan covers link tracking only.

Which partner terms carry these rules?

Your lawyer drafts the wording, and the fraud prevention guide covers penalties for banned tactics. How to create an affiliate program and how to pay affiliates cover commission and payouts.

How do you run a quarterly audit of partner content?

A quarterly audit is a logged review of partner content for disclosure and consent problems. The FTC sets no schedule, so set your own. The figures below are starting values for a program with 60 active partners.