Does your website use third-party services? Get GDPR compliant in minutes.
Try FlowConsentFree plan · 10-min setup
Partnerize is a UK-based partnership and affiliate marketing platform that enables brands to manage, track and optimise affiliate and influencer partnerships. It tracks conversions through click redirects via prf.hn and partnerize.com domains, sets tracking cookies, and may use device fingerprinting. Because Partnerize is used for marketing purposes and involves non-essential cookie storage, prior explicit consent is mandatory under the ePrivacy Directive and GDPR. Data is transferred to global infrastructure including the US, requiring SCCs or DPF as a safeguard.
Partnerize is a UK-founded partnership and affiliate marketing platform that helps brands recruit, manage, track and pay affiliate partners, influencers and content publishers. When a user clicks an affiliate link, the click is redirected through Partnerize's prf.hn domain (a URL shortener and redirect service), which records the referral event before sending the user on to the merchant's website. On the merchant's confirmation or conversion page, a Partnerize tracking tag fires to record the conversion and attribute it to the correct partner. Partnerize also provides analytics and reporting to help brands optimise their affiliate programme.
Partnerize's primary tracking mechanism is a cookie set on the user's browser when they click an affiliate link through the prf.hn redirect. This cookie stores a click ID that is later matched to a conversion event on the merchant's site. Partnerize may also employ device fingerprinting techniques to track conversions in cookieless environments (e.g. Safari ITP or Firefox ETP), collecting browser and device attributes such as screen resolution, installed fonts, user-agent string and IP address to generate a probabilistic user identifier. Both cookie-based tracking and fingerprinting fall squarely within the scope of the ePrivacy Directive and require prior consent.
Partnerize is a marketing and tracking service, not a service the user has explicitly requested. Under Art. 5(3) of the ePrivacy Directive, prior informed consent is required before any non-essential tracking cookie or fingerprinting mechanism is activated. Under the GDPR, the legal basis is Consent (Art. 6(1)(a)). This means Partnerize tracking must be blocked by default and may only fire after the user has actively consented via a compliant CMP. Legitimate Interests cannot justify cross-site affiliate tracking for EU users: the European Data Protection Board and multiple national DPAs have confirmed that tracking for advertising purposes requires consent.
Get GDPR compliant in 10 minutes
Free plan available · No credit card required
Partnerize's operations span the UK and global (including US) infrastructure. The UK benefits from an EU adequacy decision, so data transferred to Partnerize's UK infrastructure is covered. For US and other third-country transfers, Partnerize relies on Standard Contractual Clauses (SCCs) or the EU-US Data Privacy Framework (DPF). Website operators should obtain and retain a copy of Partnerize's DPA, verify the current transfer mechanism in effect, and disclose the data transfers in their privacy notices with reference to the applicable safeguards.
If Partnerize is used at significant scale, potentially tracking millions of users across multiple websites and combining cookie and fingerprint data, a DPIA may be required under Art. 35 GDPR. The cross-site profiling element and the use of fingerprinting in particular should be assessed in the DPIA. If your supervisory authority has published a list of processing activities requiring a mandatory DPIA, cross-site advertising tracking is likely included. Document your assessment in your Art. 30 records even if you conclude a full DPIA is not mandatory.
Configure your CMP to categorise Partnerize under marketing or advertising cookies and block it until consent is received. Add Partnerize and the prf.hn domain to your cookie notice with a clear description of affiliate tracking. Sign the DPA with Partnerize and document the transfer mechanism. Implement a conversion tracking fallback that does not use cookies or fingerprinting (e.g. server-side conversion posting with hashed order IDs) so that non-consenting users can still contribute to your affiliate reporting in an aggregated, non-personal way. Review your CMP category configuration and Partnerize DPA annually.
Websites using Partnerize must obtain user consent under GDPR regulations.
DPIA considerations
A DPIA should be considered if Partnerize is used at scale to track and profile large numbers of users across multiple sites, particularly where fingerprinting techniques are employed in addition to cookies. The combination of cross-site affiliate tracking and potential device fingerprinting raises profiling concerns. Document the processing in your Art. 30 records. Ensure your DPA with Partnerize addresses the transfer of personal data to the US and the applicable safeguards (SCCs or DPF). Consider whether the fingerprinting element, if present, constitutes high-risk processing requiring a DPIA under your supervisory authority's list.
Sample consent text
We use Partnerize, an affiliate marketing tracking service, to track referrals from our partners and measure conversions. This involves setting cookies on your device and sharing your visit data with Partnerize (UK/US). We will only activate Partnerize tracking with your consent. [Accept marketing cookies] [Decline]
Third-party domains contacted
prf.hnpartnerize.comCookies placed
| Name | Type | Duration | Purpose |
|---|---|---|---|
| Affiliate click ID cookie | persistent | 30 to 90 days | Stores the unique click identifier set when a user follows an affiliate link via prf.hn. Used by Partnerize to attribute purchases or conversions to the correct affiliate partner for commission payment. |
| Conversion tracking cookie | persistent | 30 to 90 days | Set on the merchant's confirmation page to record conversion events (purchases, sign-ups) and match them to the originating affiliate click ID for reporting and partner remuneration. |
| Partnerize session cookie | session | Session | Maintains the affiliate tracking session state during the user's journey from affiliate click to conversion, ensuring click ID integrity. |
Partnerize uses cookies for user preferences — inform visitors with a consent banner.
Partnerize primarily sets a persistent tracking cookie when a user clicks an affiliate link that redirects through prf.hn. This cookie stores a unique click identifier used to attribute a subsequent purchase or conversion to the referring affiliate partner. Partnerize may also read or set cookies on the merchant's site to confirm conversion events. In browsers where cookies are blocked (e.g. Safari with ITP), Partnerize may fall back to device fingerprinting techniques. Cookie lifetimes vary; a typical affiliate tracking cookie persists for 30 to 90 days to cover deferred conversions. Always run a live cookie scan on your checkout flow to identify the exact current cookies.
Yes. Consent is mandatory. Partnerize is an affiliate marketing tracking service that stores tracking cookies and may perform device fingerprinting for purposes that are not strictly necessary for any service the user has requested. Under Art. 5(3) of the ePrivacy Directive, prior explicit consent must be obtained before any such tracking begins. Partnerize must be blocked by your CMP until the user actively accepts marketing or advertising cookies. Consent must be granular, informed and freely given, meaning a cookie wall or bundled consent does not satisfy the standard.
The legal basis is Consent (Art. 6(1)(a) GDPR). Affiliate tracking is a marketing activity and does not meet the threshold for the strictly-necessary exemption. Neither Legitimate Interests (Art. 6(1)(f)) nor Contract (Art. 6(1)(b)) can justify Partnerize tracking for EU users. The EDPB and multiple national DPAs have confirmed that tracking for advertising and affiliate purposes requires opt-in consent. Consent records must be retained, and withdrawal of consent must be as easy as giving it.
Yes. Partnerize operates across the UK (adequacy decision) and global infrastructure including the US. US transfers require Standard Contractual Clauses (SCCs) or rely on the EU-US Data Privacy Framework (DPF). You should obtain Partnerize's Data Processing Agreement (DPA), confirm the transfer mechanism in place, and disclose this in your privacy notice. State specifically that user data may be transferred to the US and identify the applicable safeguard.
A DPIA should be considered if you use Partnerize at scale or if Partnerize employs device fingerprinting in addition to cookies. Cross-site affiliate tracking that creates profiles of individuals' purchasing behaviour across websites is a form of systematic profiling. Many EU supervisory authorities include cross-site advertising tracking on their mandatory DPIA lists. Conduct a DPIA if your use case involves tracking large numbers of EU users or if fingerprinting is confirmed to be active. Document any assessment in your Art. 30 records.
Configure your CMP to block Partnerize (including the prf.hn redirect and any on-page conversion tags) under the marketing/advertising category until the user consents. Update your cookie notice to name Partnerize, describe affiliate conversion tracking, state the cookie lifetime and note the UK/US data transfer. Sign Partnerize's DPA. For users who decline consent, implement a server-side conversion posting mechanism (where available) using hashed identifiers so that aggregate conversion data can still be reported without individual tracking. Review your implementation whenever Partnerize updates its tracking technology.
Alternative affiliate platforms with a strong EU compliance posture include Awin (Germany, GDPR-first design, limited cookie window options), Tradedoubler (Sweden, EU-based), and Impact (US, with DPA and SCCs). All affiliate platforms that track conversions via cookies face the same ePrivacy consent requirement; the key differentiators are data storage location, DPA quality and whether server-side or cookieless tracking alternatives are available. Evaluate alternatives based on the availability of server-side tracking APIs and EU data residency options.
Your cookie notice should list Partnerize by name under the marketing or advertising category. Describe the purpose as affiliate conversion tracking. State that a tracking cookie is set when users click affiliate links via prf.hn. Include the typical cookie lifetime (e.g. 30 to 90 days). Name Partnerize as the third-party cookie controller. Disclose the transfer of data to the UK and US and reference the applicable safeguard (UK adequacy, SCCs or DPF). Review and update the cookie notice whenever Partnerize changes its cookie set or when DPA guidance changes.