Does your website use third-party services? Get GDPR compliant in minutes.
Try FlowConsentFree plan · 10-min setup
Amazon Associates is Amazon's affiliate marketing programme that allows publishers and content creators to earn commissions by linking to products on Amazon. When visitors click affiliate links, Amazon sets tracking cookies via domains such as amazon-adsystem.com and assoc-amazon.com to attribute the referral for up to 24 hours. The SiteStripe toolbar and OneLink scripts may also be loaded on publisher pages. Because these cookies and scripts serve commercial tracking purposes rather than essential site functionality, prior user consent is required under the ePrivacy Directive and GDPR before they are placed.
Amazon Associates is Amazon's affiliate marketing programme, one of the largest and longest-running affiliate networks in the world. Publishers, bloggers, and content creators sign up to generate special affiliate links pointing to Amazon product pages. When a visitor clicks one of these links and makes a purchase on Amazon within the attribution window, the publisher earns a commission. Amazon provides tools such as the SiteStripe browser toolbar and the OneLink script to help publishers create and manage affiliate links across different Amazon storefronts internationally.
When a user clicks an Amazon Associates affiliate link, Amazon sets tracking cookies on the user's browser via domains including amazon-adsystem.com and assoc-amazon.com. These cookies store the affiliate tag and a session or referral identifier to attribute any resulting purchase to the publisher within Amazon's attribution window (typically 24 hours for standard product links, longer for certain categories). Additionally, publishers who embed OneLink JavaScript on their pages load a script from Amazon's servers, which may itself set cookies or access previously set cookies when the page loads, before any click occurs.
Under the ePrivacy Directive (2002/58/EC), storing cookies or accessing information from a user's device requires prior informed consent unless the cookie is strictly necessary for a service explicitly requested by the user. Amazon Associates affiliate tracking cookies are not strictly necessary: they serve commercial attribution purposes. Therefore, European publishers must obtain valid user consent before loading OneLink scripts or allowing affiliate click-tracking cookies to be set. Consent must be freely given, specific, informed, and unambiguous, and must be obtained through a compliant Consent Management Platform (CMP) before any Amazon tracking occurs.
Get GDPR compliant in 10 minutes
Free plan available · No credit card required
The legal basis for processing personal data through Amazon Associates tracking is consent under Art. 6(1)(a) GDPR. Data is transferred to Amazon.com Inc. in the United States. Amazon relies on Standard Contractual Clauses (SCCs) and the EU-US Data Privacy Framework (DPF) as safeguards for these third-country transfers. Publishers acting as data controllers must disclose Amazon Associates tracking in their privacy policy and cookie notice, including the identity of Amazon as a data recipient, the purpose of tracking, the retention period of cookies, and the applicable transfer mechanism.
The compliance risk of Amazon Associates for European publishers is rated high. This reflects the combination of cross-site tracking cookies, commercial profiling potential, data transfers to the US, and the historical enforcement actions by EU data protection authorities regarding affiliate and advertising cookies. Several EU DPAs have issued guidance clarifying that affiliate tracking requires opt-in consent. Publishers should be aware that Amazon may combine affiliate tracking data with its own advertising and consumer profiles, which amplifies the data protection risk.
To use Amazon Associates compliantly in Europe: implement a certified CMP and gate all Amazon tracking scripts and affiliate links behind user consent for marketing/affiliate cookies; do not use OneLink or embed Amazon widgets on pages without prior consent; disclose Amazon Associates in your cookie policy and privacy policy including the US transfer; document the consent mechanism and retain consent records; review Amazon's Associates Programme Operating Agreement for any DPA provisions; and consider whether a DPIA is warranted given the scale of your audience and the nature of the profiling risk.
Websites using Amazon Associates must obtain user consent under GDPR regulations.
DPIA considerations
A DPIA may be advisable if Amazon Associates scripts or tracking pixels are loaded at scale on high-traffic sites, particularly where profiling or cross-site tracking occurs. Consider whether Amazon may combine affiliate tracking data with its own advertising profiles. Document the data flows, the US transfer mechanism (SCCs/EU-US DPF), and assess the risk to data subjects. Publishers should review Amazon's privacy policy and DPA terms.
Sample consent text
We use Amazon Associates affiliate links. When you click these links, Amazon may set cookies to track your referral and attribute any purchases you make. These cookies are used for commercial purposes and are only placed with your consent. [Accept] [Decline]
Third-party domains contacted
amazon-adsystem.comassoc-amazon.comamazon.comCookies placed
| Name | Type | Duration | Purpose |
|---|---|---|---|
| session-id | marketing | 24 hours | Amazon affiliate session cookie that tracks the referral tag when a visitor clicks an affiliate link. Used to attribute purchases to the publisher within the commission window. |
| ubid-main | marketing | 1 year | Amazon unique browser identifier cookie used for tracking and advertising attribution across Amazon properties and affiliate referrals. |
| oadk | marketing | Session | Amazon advertising tracking cookie set by amazon-adsystem.com to track ad clicks and affiliate attribution. |
Amazon Associates uses cookies for user preferences — inform visitors with a consent banner.
Amazon Associates affiliate tracking uses cookies set via domains including amazon-adsystem.com and assoc-amazon.com. These cookies store the affiliate tag and a referral identifier to attribute purchases to the publisher within Amazon's attribution window (typically 24 hours). If OneLink JavaScript is embedded on your page, it may also access or set cookies when the page loads, before any user click occurs.
Yes. Under the ePrivacy Directive, consent is required before placing affiliate tracking cookies or loading Amazon tracking scripts such as OneLink. These are not strictly necessary cookies. You must present users with a clear opt-in choice before any Amazon tracking occurs on your site.
The legal basis is consent under Art. 6(1)(a) GDPR. Affiliate tracking serves commercial purposes and cannot rely on legitimate interest given the significant impact on user privacy. Publishers must obtain freely given, specific, and unambiguous consent before any tracking takes place, and must be able to demonstrate that consent was obtained.
Yes. Amazon Associates tracking data is processed by Amazon.com Inc. in the United States. Amazon uses Standard Contractual Clauses (SCCs) and participates in the EU-US Data Privacy Framework as transfer safeguards. Publishers must disclose this US transfer in their privacy policy and cookie notice.
A DPIA should be considered if you use Amazon Associates on a high-traffic site, particularly if the OneLink script is loaded on all pages, as this enables cross-site behavioural tracking at scale. Evaluate whether Amazon may combine affiliate attribution data with its advertising profiles. If systematic tracking of users across pages or sessions occurs, a DPIA is recommended.
To comply: implement a certified CMP and block all Amazon affiliate scripts and tracking until the user has given consent for marketing cookies; do not load OneLink before consent; categorise Amazon Associates cookies as "Marketing" or "Advertising" in your cookie policy; disclose Amazon as a data recipient and the US transfer; retain consent records; and periodically audit which Amazon scripts are loading on your pages.
Yes. EU-based affiliate programmes and networks include Awin (Germany), Tradedoubler (Sweden), Webgains (UK), and Partnerize. These networks offer EU data residency options and GDPR-compliant infrastructure, though all affiliate tracking still requires user consent under the ePrivacy Directive regardless of the provider's location.
Your cookie policy should list Amazon Associates as a third-party service used for affiliate marketing. Include: the cookie purpose (referral attribution for commission), the domains that set cookies (amazon-adsystem.com, assoc-amazon.com), the approximate duration of the cookies, that data is transferred to Amazon in the US under SCCs and the EU-US DPF, and that these cookies are placed only after the user has given consent.