Connexity

Connexity sets third party cookies on the connexity.net domain to store a user identifier and a click identifier used for attribution. Typical cookies include cnx_uid for user identification (up to one year), cnx_click for the most recent click (around thirty days), and a session cookie used by the tracking script. Additional cookies may be set by Taboola owned domains when those services are bundled.

Yes. Connexity tracking is non essential marketing activity. Article 5(3) of the ePrivacy Directive and national transpositions (TTDSG in Germany, CNIL guidelines in France, LSSI in Spain) require prior, informed and freely given consent before any Connexity tag fires or any cookie is read or written. Default to no tracking until the user opts in through your CMP.

For setting and reading cookies the only safe basis is Art 6(1)(a) GDPR consent, mirroring the ePrivacy requirement. Legitimate interest under Art 6(1)(f) is not appropriate for marketing cookies. It may support narrow downstream attribution analytics on data already lawfully collected, but it cannot replace consent for the cookie storage step.

Yes. Connexity is a US company and now part of Taboola, with primary hosting in the United States. Transfers rely on the EU US Data Privacy Framework when Taboola/Connexity is certified, otherwise on Standard Contractual Clauses with a transfer impact assessment. The transfer must be disclosed in the privacy notice and documented in the records of processing.

A DPIA is recommended and often required where Connexity is deployed at scale across multiple retailer properties, because the activity involves systematic monitoring and large scale processing for behavioural attribution within the meaning of Article 35(3)(b) GDPR. Document the purposes, data flows, lawful basis, retention periods, third country transfers and mitigations including CMP gating.

Load the Connexity pixel through your tag manager and gate it behind a certified CMP. Use Google Consent Mode v2 or equivalent so the tag only fires when ad_storage and ad_user_data are granted. Provide a reject all option that is as prominent as accept all. Log proof of consent, refresh it at least every twelve months, and document the choice of legal basis, retention and transfer mechanism.

Alternatives include Skimlinks and Sovrn Commerce for content monetisation, Awin for traditional affiliate marketing, and first party affiliate tracking using UTM parameters with a server side measurement endpoint you control. None of these remove the need for consent when third party cookies are involved, but first party UTM based tracking can reduce the reliance on cross domain identifiers.

Update the cookie policy whenever you add or remove Connexity, when cookie names, durations or purposes change, when Connexity updates its sub processors or transfer mechanism, and at least annually as part of a documented review. Notify users of material changes and refresh consent in your CMP so previously collected choices are revalidated.