APMA Sets Out Case for UK Affiliate Tracking Reform

The Affiliate & Partner Marketing Association (APMA) has outlined its case for changes to UK affiliate tracking rules, arguing that the limited data used to confirm sales and pay publishers deserves specific consideration within privacy regulation.

In an update dated November 3, the association explains its ongoing work with policymakers and regulators. The update draws on a recent PI LIVE London session with Sheridans privacy lawyer Eitan Jankelewitz, covering existing exceptions and the process for seeking further reform.

Key Takeaways From APMA’s Call for UK Affiliate Tracking Reform 

• APMA is seeking a narrowly defined consent exemption for transactional attribution and commission payments.
• Cashback and rewards services can already qualify for an exception in specific circumstances.
• The ICO has highlighted privacy risks from tracking people across sites and devices, alongside opportunities for privacy-preserving attribution.
• A wider exemption would require further government action through the statutory process.

What APMA Wants Changed

In its earlier policy statement, APMA described its request as “a tightly defined exemption covering transactional billing and attribution data,” with use restricted to confirming transactions and paying commissions.

The association says its members have developed draft legislative wording and requested a ministerial meeting. It argues that the technical conditions proposed for an attribution exception would make it commercially unviable for much of the sector.

APMA cites £1.78 billion in UK advertiser investment during 2025, generating £20.7 billion in sales across 357 million transactions, from its State of the Affiliate Nation 2026 report. It presents those figures as evidence of the channel’s economic importance.

Its commercial concern is straightforward: a merchant can complete a sale while the publisher loses the commission if the attribution link fails. The association wants rules that recognize the data required to establish that payment entitlement.

For background on its wider work, Affiverse’s 2024 podcast with Kevin Edwards explored UK affiliate market trends, partner relationships, and publisher payments.

How Current ICO Guidance Applies

The ICO’s guidance on exceptions recognizes that some storage and access technologies can be essential when someone signs up for a cashback or rewards service. In those circumstances, the strictly necessary exception may apply.

That assessment depends on how the service operates, which technologies are used, the parties involved, and the purposes of the processing. An exception applicable to one service does not automatically extend to another service or additional uses of the same technology.

The distinction is material for affiliate programs. A cashback service’s need to identify a qualifying purchase does not establish a blanket exemption for every affiliate cookie used on a merchant’s website.

Separately, the ICO’s online advertising guidance states that using storage and access technologies for online advertising requires consent, including associated tracking and profiling. Businesses therefore need to assess the actual purpose and operation of their technology when considering whether an exception applies.

Where the Policy Positions Differ

In its summary of consultation responses, the ICO acknowledges differences between affiliate marketing and programmatic advertising. However, it says the underlying technologies can still create risks by tracking users across sites and devices.

The regulator also points to emerging privacy-enhancing technologies that could support attribution without identifying users across sites. It says some affiliate businesses would need to innovate to use an exception under its preferred approach.

Read together, these statements show the central policy question: which technical safeguards can protect users while allowing an attribution exception to work commercially? APMA emphasizes limited purposes and practical implementation; the ICO emphasizes the remaining tracking risks.

How Further Exceptions Could Be Introduced

The Data (Use and Access) Act 2025 provides a route for changing the exceptions under the Privacy and Electronic Communications Regulations (PECR).

Under regulation 6A, the Secretary of State can make regulations adding or changing exceptions after consulting the data regulator and other appropriate parties. A draft instrument must be approved by both Houses of Parliament.

APMA’s November update describes continuing engagement and evidence gathering. Any resulting legal change would need to complete the relevant statutory process.

Affiverse Take on Reviewing Affiliate Tracking

For program managers, the immediate task is to understand their current data flows. A review can record what information is stored or accessed, when this happens, who receives it, and whether it serves attribution, advertising, or another purpose.

Affiverse’s guide to the affiliate data stack explains why tracking, order, and payment records should be reconciled. That distinction can help teams separate missing tracking from attribution rules, rejected orders, and payment delays when investigating discrepancies.

Recording those causes separately would also give the industry clearer evidence for policy discussions. It would help show where attribution failures affect publisher payments and which specific data uses a proposed exception would need to address.