<b>Does GDPR actually apply to me as an affiliate?</b>

<b>Does GDPR actually apply to me as an affiliate?</b>

Q: I just send traffic. Is the data law really my problem?

A: If any of your users are in the EU or UK, yes — GDPR (the EU data-protection law) follows the person, not your company's location. The moment you place a tracking cookie, capture an IP, or hash an email, you're processing personal data.

Three obligations that actually touch affiliates:

— Lawful basis before tracking: for ad cookies that's consent, collected before the pixel fires, not after.
— Transparency: a reachable privacy notice saying who you are and what you collect.
— No quiet data resale: passing user data to third parties without disclosing it is the fast lane to a complaint.

The practical risk isn't a regulator knocking — it's your network terminating you because a complaint landed on them. Advertisers increasingly require consent strings (the encoded record of what a user agreed to) to pass through the click.

Short version: GDPR attaches to the user, not your address. If you track EU visitors, get consent first and disclose plainly.

Still stuck? Drop your case in the comments.