Skimlinks

What Skimlinks is

Skimlinks is a US based affiliate monetization service owned by Taboola and Connexity that helps publishers earn commission from outbound links to merchants. It works across publisher sites through its own domains, including skimlinks.com, skimresources.com, redirectingat.com and go.skimresources.com. For the operator it is a high impact third party because it actively rewrites links and tracks user behaviour across the outbound journey rather than just measuring page views.

How it works

Skimlinks loads a script that scans the page for outbound merchant links and automatically rewrites them so that clicks pass through its redirect infrastructure. When a user clicks, the service records the click, attributes any resulting purchase, and shares the relevant data with merchant and affiliate networks so commission can be paid. This means the service performs heavy third party tracking and routes user interactions through US based systems.

What data and cookies it collects

Skimlinks typically sets attribution and tracking cookies and processes data such as the links clicked, referring pages, device and browser signals, and conversion events. This information can build a picture of a user across publishers and merchants for the purpose of commission attribution. Operators should review the exact cookies in their own deployment, since the precise set can change over time and by configuration.

GDPR and ePrivacy implications

Skimlinks sets non essential marketing cookies and engages in cross context behavioural tracking, so it falls squarely within the GDPR and the ePrivacy Directive. Under ePrivacy the tracking cookies may only be set after consent, and under the GDPR the sharing of personal data with affiliate networks needs a valid legal basis and transparency. Because the data flows to the US and to multiple partners, the risk profile is high and the accountability obligations are significant.

Consent requirements and data transfers

Consent must be collected through a consent management platform before the Skimlinks script runs, and the link rewriting and tracking should be blocked until the user accepts marketing cookies. Data is transferred to the United States, so operators should rely on standard contractual clauses or another valid transfer mechanism and reflect this in their privacy notice. The sharing with affiliate networks worldwide should also be disclosed clearly.

Practical compliance steps

To use Skimlinks compliantly, block the script by default and load it only after marketing consent, then stop it and clear its cookies when consent is withdrawn. Document the legal basis, complete a DPIA given the tracking and transfers, and put the appropriate data processing and transfer terms in place. List Skimlinks and its domains in your cookie policy and be transparent that outbound links may be monetized and tracked.