The Information Commissioner’s Office (ICO) has updated its advice on strictly necessary cookies, exempting reward companies from requiring consent under data privacy laws if they meet certain criteria.
A source of contention for some time, cashback and loyalty sites have argued that because their users have consented to be tracked in order to receive a reward, their cookies should be classified as strictly necessary.
Responding to the question, “Can the use of cookies for providing a reward service qualify the cookies as ‘strictly necessary’, exempting them from the consent requirement under PECR?”, the ICO has said two criteria should be met:
- The cookie is for the sole purpose of carrying out the transmission of a communication over an electronic network; or
- Where storage or of access to a cookie is strictly necessary for the provision of a service that has been requested by the user or subscriber.
They then cite that if a company can demonstrate that their users have explicitly signed up to a service – such as those offered by APMA members TopCashback and Reward Gateway – and the cookie is required to deliver the service, then “it could be seen to be strictly necessary, and therefore consent would not be required from the user before setting the cookie”.
The law
PECR stands for Privacy and Electronic Communications Regulations, which regulates the use of personal data in electronic communications and extends to obtaining consent from users to be tracked online. Given the varying nature of cookies, they are broadly bucketed by the function they perform.
For affiliate marketers, it is not always obvious how to classify their cookies and there has been tension within the industry given how brands interpret them. Poor implementation within cookie consent banners can have a devastating impact on affiliate earnings.
The APMA believes this is a welcome clarification for the industry and encourage brands to speak to their networks, platforms and impacted publisher partners to ensure they are classifying their cookies correctly.
The APMA published its own guidance on cookie classification earlier this year.
The ICO clarification can be found at the bottom of this page.
