Amazon Associates

What is Amazon Associates?

Amazon Associates is Amazon's affiliate marketing programme, one of the largest and longest-running affiliate networks in the world. Publishers, bloggers, and content creators sign up to generate special affiliate links pointing to Amazon product pages. When a visitor clicks one of these links and makes a purchase on Amazon within the attribution window, the publisher earns a commission. Amazon provides tools such as the SiteStripe browser toolbar and the OneLink script to help publishers create and manage affiliate links across different Amazon storefronts internationally.

Cookies and Tracking Technologies Used

When a user clicks an Amazon Associates affiliate link, Amazon sets tracking cookies on the user's browser via domains including amazon-adsystem.com and assoc-amazon.com. These cookies store the affiliate tag and a session or referral identifier to attribute any resulting purchase to the publisher within Amazon's attribution window (typically 24 hours for standard product links, longer for certain categories). Additionally, publishers who embed OneLink JavaScript on their pages load a script from Amazon's servers, which may itself set cookies or access previously set cookies when the page loads, before any click occurs.

ePrivacy Directive and Consent Requirements

Under the ePrivacy Directive (2002/58/EC), storing cookies or accessing information from a user's device requires prior informed consent unless the cookie is strictly necessary for a service explicitly requested by the user. Amazon Associates affiliate tracking cookies are not strictly necessary: they serve commercial attribution purposes. Therefore, European publishers must obtain valid user consent before loading OneLink scripts or allowing affiliate click-tracking cookies to be set. Consent must be freely given, specific, informed, and unambiguous, and must be obtained through a compliant Consent Management Platform (CMP) before any Amazon tracking occurs.

GDPR Legal Basis and Data Transfers to the US

The legal basis for processing personal data through Amazon Associates tracking is consent under Art. 6(1)(a) GDPR. Data is transferred to Amazon.com Inc. in the United States. Amazon relies on Standard Contractual Clauses (SCCs) and the EU-US Data Privacy Framework (DPF) as safeguards for these third-country transfers. Publishers acting as data controllers must disclose Amazon Associates tracking in their privacy policy and cookie notice, including the identity of Amazon as a data recipient, the purpose of tracking, the retention period of cookies, and the applicable transfer mechanism.

Risk Assessment for European Publishers

The compliance risk of Amazon Associates for European publishers is rated high. This reflects the combination of cross-site tracking cookies, commercial profiling potential, data transfers to the US, and the historical enforcement actions by EU data protection authorities regarding affiliate and advertising cookies. Several EU DPAs have issued guidance clarifying that affiliate tracking requires opt-in consent. Publishers should be aware that Amazon may combine affiliate tracking data with its own advertising and consumer profiles, which amplifies the data protection risk.

Practical Compliance Steps for European Publishers

To use Amazon Associates compliantly in Europe: implement a certified CMP and gate all Amazon tracking scripts and affiliate links behind user consent for marketing/affiliate cookies; do not use OneLink or embed Amazon widgets on pages without prior consent; disclose Amazon Associates in your cookie policy and privacy policy including the US transfer; document the consent mechanism and retain consent records; review Amazon's Associates Programme Operating Agreement for any DPA provisions; and consider whether a DPIA is warranted given the scale of your audience and the nature of the profiling risk.