Does your website use third-party services? Get GDPR compliant in minutes.
Try FlowConsentFree plan · 10-min setup
Impact.com (Impact Tech, Inc.) is a US-based partnership automation and affiliate marketing platform. It tracks clicks, conversions and commissions for affiliate, influencer and partner programmes via redirect domains including sjv.io, pxf.io and ojrq.net, using first-party and third-party cookies, device fingerprinting and server-side tracking. As an advertising and tracking service, it requires explicit prior consent from EU visitors. Data is transferred to the US and requires Standard Contractual Clauses or EU-US Data Privacy Framework certification as a transfer mechanism.
Impact.com, operated by Impact Tech, Inc., is a US-based partnership automation platform that enables brands to manage affiliate, influencer, brand ambassador, and B2B partnership programmes in one place. It tracks partner-driven traffic and conversions through a combination of redirect click-tracking domains (including sjv.io, pxf.io, and ojrq.net), first-party and third-party cookies, device fingerprinting, and server-side event tracking. Impact.com competes with Tradedoubler, Awin, and CJ Affiliate and is widely used by global e-commerce brands for sophisticated affiliate attribution.
Impact.com uses multiple tracking methods simultaneously. When a user clicks a partner link, they are redirected through an Impact tracking domain (such as sjv.io or pxf.io), which sets cookies to record the click and the partner source. On the advertiser''s site, a conversion tracking tag or server-side API call confirms the purchase or lead. Impact also supports device fingerprinting as a fallback tracking method when cookies are not available, which raises additional compliance concerns because fingerprinting is considered a form of digital identifier subject to the ePrivacy Directive even without a traditional cookie being set.
All non-essential tracking methods used by Impact, including affiliate cookies and device fingerprinting, require prior informed consent from EU visitors under Article 5(3) of the ePrivacy Directive. The GDPR provides the legal basis: consent under Article 6(1)(a) is required. Legitimate interests cannot override the ePrivacy consent requirement for the tracking layer. Your consent management platform must block all Impact tracking (clicks, pixels, fingerprinting) until the user has actively consented to marketing cookies. Server-side tracking that processes order confirmation data may be structured around a contractual basis, but must be scoped carefully to avoid processing beyond what is necessary for order fulfilment.
Get GDPR compliant in 10 minutes
Free plan available · No credit card required
Impact Tech, Inc. is based in the United States. Data collected from EU visitors is transferred to US servers, which constitutes a third-country transfer under GDPR Chapter V. The EU-US Data Privacy Framework (DPF), adopted in July 2023, provides an adequacy-based mechanism for transfers to certified US companies. Impact.com should be verified against the DPF list; if certified, transfers may rely on the DPF. As a fallback or supplement, Standard Contractual Clauses (SCCs) should also be in place. Monitor DPF validity (it has been legally challenged in the past) and maintain SCCs as a backup safeguard.
The combination of multiple tracking methods (cookies, fingerprinting, server-side), large-scale monitoring of affiliate traffic, and US data transfer makes a DPIA advisable before deploying Impact.com on EU-facing websites. The DPIA should assess: the necessity and proportionality of each tracking method, the legal basis and transfer mechanism, data minimisation opportunities (e.g. limiting fingerprinting), and whether consent mechanisms are technically enforced before any Impact script or redirect fires. Fingerpinting in particular should be disclosed explicitly in your cookie notice as it may not involve a traditional cookie.
To deploy Impact.com compliantly on an EU website: block all Impact tracking tags, redirect domains and fingerprinting scripts via your CMP until marketing consent is given; disclose Impact.com, its tracking methods (including fingerprinting), and the US transfer in your privacy policy and cookie notice; verify Impact.com''s DPF certification and maintain SCCs as a backup; sign a Data Processing Agreement with Impact Tech; consider whether server-side-only tracking (without client-side cookies or fingerprinting) could meet your attribution needs with a lower consent burden; and document your processing in your Article 30 records.
Websites using Impact must obtain user consent under GDPR regulations.
DPIA considerations
A DPIA is recommended given the combination of multi-method tracking (cookies, fingerprinting, server-side), US data transfer, and large-scale affiliate programme monitoring. Key considerations: consent mechanism for cookies and fingerprinting, validity of transfer mechanism (DPF certification or SCCs), data minimisation in server-side tracking, and ensuring conversion data is not used for purposes beyond affiliate attribution without additional consent.
Sample consent text
We use Impact.com to manage our affiliate and partner programme. When you click a partner link or complete a purchase, Impact may set cookies or use similar technologies to attribute the conversion to the referring partner. Data is sent to Impact Tech, Inc. in the United States. Please accept to enable affiliate tracking.
Third-party domains contacted
impact.comsjv.iopxf.ioojrq.netCookies placed
| Name | Type | Duration | Purpose |
|---|---|---|---|
| Affiliate Click Attribution Cookie | persistent | Up to 30 days (configurable per programme) | Records affiliate or partner link clicks routed through Impact tracking domains (sjv.io, pxf.io, ojrq.net). Used to attribute conversions (purchases or leads) to the correct referring partner for commission calculation. Non-essential marketing cookie; requires prior consent. |
| Conversion Tracking Cookie | persistent | Session to 30 days | Set on the advertiser's website when a conversion event (purchase or lead) is detected. Used to confirm and record the conversion for partner attribution and reporting within the Impact.com platform. Non-essential marketing cookie; requires prior consent. |
| Device Fingerprint Identifier | functional | Session (in-memory or short-lived) | Impact.com uses device fingerprinting as a fallback tracking method when cookies are blocked or unavailable. Fingerprinting collects browser and device characteristics to generate a probabilistic identifier. Subject to ePrivacy Directive consent requirements; must be disclosed separately from cookie-based tracking. |
Impact uses cookies for user preferences — inform visitors with a consent banner.
Yes. When a visitor clicks an affiliate or partner link that routes through an Impact.com tracking domain (such as sjv.io, pxf.io, or ojrq.net), Impact sets first-party and third-party cookies to record the click, the referring partner, and a timestamp. These are non-essential marketing cookies. Additionally, Impact.com supports device fingerprinting as a fallback tracking mechanism, which is also subject to ePrivacy consent requirements even though it does not use a traditional cookie.
Yes. Impact.com's affiliate tracking cookies and device fingerprinting are non-essential technologies that require prior informed consent from EU visitors under Article 5(3) of the ePrivacy Directive and Article 6(1)(a) GDPR. Your consent management platform must block all Impact.com scripts and redirects until the user has actively accepted marketing cookies. Implied or pre-ticked consent is not valid under EU law.
Consent under Article 6(1)(a) GDPR is the required legal basis for the tracking layer (cookies and fingerprinting). For server-side conversion events that process order data, a contractual basis (Art. 6(1)(b)) may apply narrowly to fulfilment-related data, but this must be scoped carefully and cannot extend to marketing attribution without consent. You cannot rely on legitimate interests to justify the cookie or fingerprinting layer.
Yes. Impact Tech, Inc. is headquartered in the US, and EU visitor data is processed on US servers. This is a third-country transfer under GDPR Chapter V. Impact.com may be certified under the EU-US Data Privacy Framework (DPF); verify this on the official DPF list. Standard Contractual Clauses (SCCs) should also be in place as a supplementary or fallback mechanism. Disclose the US transfer in your privacy policy.
A DPIA is recommended given the combination of multi-method tracking (cookies, device fingerprinting, server-side API), large-scale affiliate traffic monitoring, and US data transfer. The DPIA should assess: each tracking method's necessity and proportionality, the consent mechanism's technical effectiveness, the validity of the transfer mechanism (DPF or SCCs), and whether device fingerprinting can be limited or disabled for EU visitors.
Configure your CMP to block all Impact.com tags, redirect domains (sjv.io, pxf.io, ojrq.net) and fingerprinting scripts until marketing consent is granted. Update your privacy policy and cookie notice to disclose Impact.com, its tracking methods including fingerprinting, and the US data transfer. Verify DPF certification and maintain SCCs. Sign a Data Processing Agreement with Impact Tech. Consider server-side-only tracking for non-consenting visitors to preserve some attribution capability without cookie consent.
For EU-based programmes, networks such as Awin, Tradedoubler, and CJ Affiliate offer European infrastructure and comparable affiliate management. For brands seeking reduced tracking reliance, server-side tracking combined with aggregate reporting (without individual user cookies) is an emerging approach. Self-hosted affiliate management solutions using first-party data only also avoid third-country transfer issues entirely.
Your cookie notice should list Impact.com under the Marketing or Advertising category and disclose: the tracking technologies used (cookies and device fingerprinting), the tracking domains (sjv.io, pxf.io, ojrq.net, impact.com), the approximate cookie duration, the purpose (affiliate and partner attribution), and that data is transferred to the US. Link to Impact's privacy policy. Update your disclosures if Impact changes its tracking mechanism, and ensure your CMP reflects all current tracking methods.