Does your website use third-party services? Get GDPR compliant in minutes.
Try FlowConsentFree plan · 10-min setup
Rakuten Advertising (formerly Rakuten Marketing, originally LinkShare) is one of the largest global affiliate marketing networks. It connects advertisers, publishers, and influencers, and tracks affiliate clicks and conversions across web and mobile. On a publisher site, Rakuten Advertising fires affiliate click redirects (linksynergy.com) and conversion pixels that drop persistent cookies to attribute sales to the referring publisher. The platform is part of the Rakuten Group (Japan), with US operations and EU subsidiaries.
Rakuten Advertising is the digital marketing arm of the Rakuten Group (Tokyo, Japan), formed from the acquisition of LinkShare (one of the original affiliate marketing networks). It runs one of the largest affiliate marketing networks worldwide, with advertisers, publishers, influencers, and a programmatic display offering. Headquartered in San Mateo, California, with significant European operations through Rakuten Marketing UK Limited and Rakuten Marketing Europe BV, it powers affiliate programmes for many EU advertisers.
On affiliate link click: the click is redirected through linksynergy.com (or a Rakuten-branded subdomain), which logs the referring publisher, the destination URL, the visitor IP, the user agent, and drops an attribution cookie. On conversion: the advertiser fires a Rakuten conversion pixel that posts back the order ID, the order value, the SKUs (in some integrations), and possibly a hashed customer email. The platform stitches these events to attribute commission to the publisher.
The attribution cookie is a third-party persistent identifier and the conversion pixel introduces a cross-context data flow. Both qualify as non-essential under ePrivacy and TTDSG and require consent. The data processing relies on Art. 6(1)(a) consent. Special care is needed when hashed emails or order-level personal data are passed: even hashed identifiers can be personal data when combined with the visitor IP and the order context.
Get GDPR compliant in 10 minutes
Free plan available · No credit card required
Rakuten Advertising operates globally. EU data residency exists for publisher and advertiser dashboards through the European subsidiaries, but global reporting and reconciliation involve US processing. Japan, the home of Rakuten Group, benefits from an EU adequacy decision under Art. 45 GDPR, simplifying intra-group transfers. US transfers rely on Standard Contractual Clauses and on the EU-US Data Privacy Framework.
Sign the Rakuten Advertising DPA, gate all Rakuten pixels and click redirects behind your CMP, integrate with TCF v2 for IAB-aligned signalling, document the data flows (click capture vs. conversion postback) in your RoPA, hash personal data before sending it as conversion identifiers, document the global data flows including Japan and the US, and inform visitors clearly in the privacy notice.
Websites using Rakuten Advertising must obtain user consent under GDPR regulations.
DPIA considerations
Rakuten Advertising captures clicks on affiliate links, drops attribution cookies on click and on conversion, and reconciles the data across publishers and advertisers. Key DPIA considerations: (1) the attribution cookie is a third-party persistent identifier with cross-site tracking potential, requiring consent under ePrivacy and TTDSG; (2) the conversion data sent to Rakuten typically includes the order ID, the order value, and (depending on the implementation) the customer email hash, which can constitute personal data; (3) the data is reconciled across the global Rakuten network, with reporting in the US; (4) Japan benefits from an EU adequacy decision, but US transfers still require SCCs and DPF; (5) the publisher/advertiser relationship may make the data flow controller-to-controller, controller-to-processor, or joint controllership, which must be documented.
Sample consent text
Our website participates in the Rakuten Advertising affiliate network. When you click on an affiliate link or complete a purchase from a Rakuten ad, Rakuten Advertising drops a cookie to attribute the action to the referring publisher. Data is processed by Rakuten Marketing globally, with EU residency where contractually agreed and US reconciliation for reporting. Transfers rely on Standard Contractual Clauses, the EU-US Data Privacy Framework, and the EU-Japan adequacy decision.
Third-party domains contacted
rakutenadvertising.comwww.rakutenadvertising.comlinksynergy.comclick.linksynergy.comrakutenmarketing.comtags.rmp.rakuten.comtrack.linksynergy.comCookies placed
| Name | Type | Duration | Purpose |
|---|---|---|---|
| rmstore | Marketing / Attribution | Up to 90 days | Third-party cookie set on the linksynergy.com domain when the visitor clicks an affiliate link. Records the referring publisher (Site ID and Merchant ID) so that a subsequent purchase can be attributed to the right partner. |
| ranSiteID_* | Marketing / Attribution | Up to 90 days | Numeric site identifier of the affiliate publisher, used together with rmstore to assign the commission once the visitor completes a purchase on the advertiser site. |
| rmref | Marketing / Attribution | Up to 90 days | Stores the referring URL or campaign code passed at the time of the affiliate click, used for sub-affiliate or campaign-level reporting. |
| mid | Marketing / Attribution | Up to 90 days | Merchant identifier set during the affiliate click redirect on linksynergy.com. |
| Rakuten Smart Pixel (first-party) | Marketing / Conversion | Up to 90 days | When the advertiser deploys the first-party Rakuten Smart Pixel, an equivalent attribution cookie is set under the advertiser domain to mitigate third-party cookie restrictions in modern browsers. |
Rakuten Advertising places tracking cookies for advertising — comply with GDPR using FlowConsent.
Rakuten Advertising sets third-party cookies on linksynergy.com and other Rakuten Marketing domains during the affiliate click redirect (typically rmstore, mid, ranSiteID with up to 60-90 days persistence) and a conversion cookie when a purchase is recorded. Some advertiser deployments also use first-party cookies via the Rakuten Smart Pixel.
Yes. The attribution cookies and the conversion pixel are non-essential under ePrivacy and TTDSG and require consent. The affiliate tracking should be gated behind a Consent Management Platform, ideally integrated with the IAB TCF v2 framework.
Consent (Art. 6(1)(a) GDPR) for the attribution cookies and the cross-context conversion tracking.
Yes. Even with EU residency for dashboards, the global reporting and reconciliation involve US processing. Transfers rely on Standard Contractual Clauses and the EU-US Data Privacy Framework. Intra-group transfers to Japan benefit from the EU-Japan adequacy decision.
Yes for any publisher or advertiser with significant volumes. The cross-site tracking, the cross-context conversion data, and the multi-jurisdiction processing all warrant DPIA documentation.
Sign the Rakuten Advertising DPA, gate all tags and click redirects behind your CMP, integrate with IAB TCF v2, document data flows (click capture vs conversion postback) in your RoPA, hash personal data before passing as identifiers, and clearly inform visitors about the affiliate program in the privacy notice.
Other affiliate networks with EU presence include Awin (Germany/UK), CJ Affiliate (US, EU operations), Impact (US, EU residency available), TradeDoubler (Sweden), Effiliation/Adverline (France), Webgains (UK), Daisycon (Netherlands), and Tradedoubler (Sweden).
List the Rakuten attribution cookies (third-party on linksynergy.com and related domains) with name, purpose, duration. Mention Rakuten Marketing as the controller, the global data flows (EU residency, US reconciliation, Japan group), and the SCCs/DPF transfer mechanisms. Provide a CMP toggle to refuse the affiliate tracking.