The Affiliate and Partner Marketing Association (APMA) has launched a new quarterly policy briefing for members that explains how the new UK data bill could impact affiliate marketing.
Exclusively for APMA members, the four-page briefing document takes a deep dive into the new law, explaining how it potentially opens the door for a more proportionate approach to affiliate marketing business models where there is a lower risk to people’s privacy.
The Data (Use and Access) Act (DUAA) officially became UK law on 19 June 2025, updating – but not replacing – existing data protection and privacy legislation such the UK GDPR, Data Protection Act 2018, and the Privacy & Electronic Communications EC Directive Regulations 2003 (PECR).
The new legislation aims to enhance flexibility while promoting digital innovation. Post-Brexit, it marks a significant step in the UK’s evolving data governance outside the European Union (EU), aiming to balance innovation with regulatory oversight.
The four-page policy document is available to members and can be downloaded from the member area.
If you’re interested in membership, drop the team an email to find out
A business-friendly approach?
Much has been made of how the new data bill could be good news from affiliate marketers.
The bill introduces a more “risk-based” approach to data processing, and routine affiliate tracking (e.g., click IDs, pseudonymous data) may face fewer checks, provided it’s low-risk and proportionate.
Legitimate interest as a legal basis has also been expanded, allowing some tracking and attribution activity to occur without consent. This in turn, could ease the pressure on cookie banners, particularly when the activity is considered light touch.
No free pass for affiliate marketing
However, there is no explicit reference to affiliate marketing in the legislation and, while the law offers a more flexible and business-friendly regime in principle, affiliate marketers should not shirk their legal obligations.
Consent and transparency will remain core compliance priorities, and there’s no doubt brands will demand that their suppliers adopt policies fully in line with the law. Fundamentally, the bill doesn’t override PECR, the UK’s ePrivacy rules and cookie consent still applies for tracking technologies.
New ICO consultation
On 7th July, the Information Commissioner’s Office announced a new request for views on how it can support digital innovation by enabling new advertising models that respect user privacy while maintaining revenue streams.
The ICO is exploring how publishers can deliver privacy-preserving advertising to users who have not given consent, where the risks are low.
The APMA is considering its approach and how to respond to the request.
