Does your website use third-party services? Get GDPR compliant in minutes.
Try FlowConsentFree plan · 10-min setup
Awin is a global affiliate marketing network headquartered in Berlin, Germany. It connects advertisers with publishers through affiliate links and tracks conversions using cookies set via awin1.com, dwin1.com, and zenaps.com. Awin also operates bounceless server-to-server tracking and device fingerprinting for attribution in environments where cookies are blocked. Because affiliate tracking serves commercial purposes, prior user consent is required under the ePrivacy Directive and GDPR before Awin cookies or the MasterTag JavaScript are loaded on a visitor's device. Awin AG is subject to both GDPR and the German Bundesdatenschutzgesetz (BDSG).
Awin is one of the world's largest affiliate marketing networks, headquartered in Berlin, Germany, and operating as Awin AG. It connects thousands of advertisers (merchants) with publishers (affiliates) across multiple markets globally. Publishers promote advertiser products through affiliate links and earn commissions when referred visitors complete desired actions, typically purchases. Awin provides the technology infrastructure for tracking, attribution, reporting, and payment processing within this affiliate ecosystem.
Awin's primary tracking mechanism relies on cookies set via awin1.com, dwin1.com, and zenaps.com when a user clicks an affiliate link. These cookies store a unique click reference to enable conversion attribution when the user completes a transaction on the advertiser's site. Additionally, Awin offers a MasterTag JavaScript that advertisers embed on their confirmation pages to fire conversion pixels. Beyond cookie-based tracking, Awin operates a bounceless server-to-server (S2S) tracking solution and uses device fingerprinting techniques for attribution in environments where cookies are blocked or not available, such as certain mobile browsers and operating systems.
The ePrivacy Directive requires prior informed consent before placing cookies or accessing information on a user's terminal device, except for strictly necessary cookies. Awin's affiliate tracking cookies, MasterTag, and click-redirect tracking serve commercial marketing purposes and are not strictly necessary. European publishers and advertisers integrating Awin must therefore obtain valid opt-in consent before any Awin tracking is activated. This includes blocking the MasterTag until consent is given on advertiser confirmation pages, and ensuring that affiliate click redirects through awin1.com do not deposit cookies in the absence of consent.
Get GDPR compliant in 10 minutes
Free plan available · No credit card required
The legal basis for Awin affiliate tracking is consent under Art. 6(1)(a) GDPR. Awin's bounceless and fingerprinting-based tracking methods raise additional compliance questions. Device fingerprinting for identifying returning users without cookies is legally contested in the EU: the Article 29 Working Party (now EDPB) has indicated that fingerprinting may fall within the scope of the ePrivacy Directive where it is used to access or store information derived from the device. Publishers should assess whether consent is also required for fingerprinting-based attribution and document their legal basis for each tracking method.
Awin AG is a German company and its primary data processing infrastructure is within the EU. However, Awin has global operations and data may be processed in non-EEA countries. A Data Processing Agreement (DPA) with Awin AG is required under GDPR Art. 28. Awin provides a standard DPA for advertisers and publishers. Review the sub-processor list included in Awin's DPA to identify any third-country transfers and ensure that appropriate safeguards such as SCCs are in place.
To use Awin compliantly: implement a certified CMP and block the Awin MasterTag and all tracking cookies until consent is obtained; categorise Awin cookies as marketing in your cookie notice; sign a DPA with Awin AG; document Awin in your Records of Processing Activities; assess whether a DPIA is required given the fingerprinting risk; disclose Awin as a data recipient in your privacy policy including any international transfers; and review Awin's compliance documentation and sub-processor list periodically.
Websites using Awin must obtain user consent under GDPR regulations.
DPIA considerations
A DPIA is strongly recommended for Awin integration, particularly where the MasterTag is loaded site-wide and where bounceless/fingerprinting tracking is used. Awin's fingerprinting-based S2S attribution may constitute high-risk processing under GDPR Art. 35 as it involves systematic processing of device characteristics to identify individuals without cookie consent. Assess the scope of data sharing with Awin, the combination of tracking methods, and document the legal basis for each tracking mechanism separately.
Sample consent text
We use Awin affiliate tracking on this site. Awin may set cookies and use device fingerprinting to track referrals and attribute purchases to publishers. These technologies are used for marketing purposes and are only activated with your consent. [Accept] [Decline]
Third-party domains contacted
awin1.comdwin1.comzenaps.comCookies placed
| Name | Type | Duration | Purpose |
|---|---|---|---|
| aw | marketing | 30 days | Awin affiliate tracking cookie set via awin1.com on click of an affiliate link. Stores a click reference identifier used to attribute conversions to the correct publisher within the commission window. |
| awseg | marketing | Session | Awin session segmentation cookie used to track affiliate click sessions and support conversion attribution. |
Awin uses cookies for user preferences — inform visitors with a consent banner.
Awin sets affiliate tracking cookies via its domains awin1.com, dwin1.com, and zenaps.com when a user clicks an affiliate link. These cookies store a unique click reference used to attribute conversions (such as purchases) to the correct publisher within Awin's commission window. The Awin MasterTag JavaScript, embedded on advertiser confirmation pages, may also access or set cookies when triggered.
Yes. Awin's affiliate tracking cookies and MasterTag script serve commercial marketing purposes and are not strictly necessary. Under the ePrivacy Directive, prior opt-in consent is required before these are loaded on a user's device. You must block all Awin tracking until the user has actively consented through a compliant Consent Management Platform.
The legal basis is consent under Art. 6(1)(a) GDPR. Awin's affiliate and conversion tracking cannot rely on legitimate interest because of the significant privacy impact and the commercial nature of the tracking. A Data Processing Agreement with Awin AG under Art. 28 GDPR is also required. Document the legal basis separately for cookie-based tracking and fingerprinting-based attribution, as each may have different considerations.
Awin AG is headquartered in Germany and primarily processes data in the EU. However, Awin has global operations and may transfer data to non-EEA countries. Review Awin's DPA and sub-processor list to identify specific third-country transfers. Ensure that appropriate safeguards such as Standard Contractual Clauses are in place for any identified transfers, and document these in your Records of Processing Activities.
A DPIA is strongly recommended where Awin's bounceless/fingerprinting S2S tracking is in use, as this involves systematic processing of device characteristics to identify individuals without their cookie consent. This may constitute high-risk processing under GDPR Art. 35. Even for standard cookie-based tracking, a DPIA should be considered if Awin is deployed at significant scale or if tracking occurs across multiple sites or user journeys.
For compliance: implement a certified CMP and gate the Awin MasterTag and all affiliate click tracking behind consent for marketing cookies; categorise Awin cookies as marketing in your cookie policy; sign a DPA with Awin AG; disclose Awin in your privacy policy including any international transfers; document the legal basis for both cookie and fingerprinting tracking; audit which Awin scripts load on your site and when; and review Awin's compliance and sub-processor documentation regularly.
All major affiliate networks require similar consent under the ePrivacy Directive, as affiliate tracking inherently involves cookies or equivalent technologies. EU-based networks such as Tradedoubler (Sweden) and Partnerize also require opt-in consent for tracking. Server-to-server affiliate tracking setups without client-side cookies may reduce but not eliminate ePrivacy obligations depending on the implementation. The key compliance step is obtaining consent, regardless of the network used.
Add Awin to your cookie policy under a marketing or advertising cookies section. Include: the service name (Awin), the purpose (affiliate referral tracking and conversion attribution), the domains that set cookies (awin1.com, dwin1.com, zenaps.com), the approximate cookie duration, that Awin AG processes data as a data processor under a DPA, any international data transfers, and that these cookies are set only after the user has given consent.