Is Your Affiliate Tracking Pixel Firing Before Consent? Here's How to Check

What's Actually Changed, and What Am I Not Going to Overclaim?

I'm not a solicitor, and none of this is legal advice, if you run an affiliate programme and want to know exactly how recent ICO guidance affects your specific liability, that needs confirming by someone qualified to give it. Here's what I can say with confidence: the direction of travel on consent liability has been moving towards the business running the programme, not the network providing the technology, and that's consistent with how the ICO has treated other third-party tracking arrangements.

That's consistent with how the ICO has treated other third-party tracking arrangements, including Meta's pixel and LinkedIn's Insight Tag. Whatever the exact wording of the current guidance turns out to mean in your case, the practical question doesn't change: does your affiliate tracking pixel fire before or after a visitor consents to marketing cookies?

That question is one you can answer yourself, today, without a solicitor. It's inspectable and verifiable using tools you already have access to. In my experience auditing tracking setups for clients, the pixel firing order is very rarely something anyone has actually checked since the original developer pasted the network's integration snippet in.

How Do Affiliate Tracking Pixels Typically Fire, and Why Is That the Real Risk?

Most affiliate tracking pixels fire on page load, before any consent interaction, because they were installed as a static script tag and never revisited. Affiliate networks like Awin, Impact, and CJ Affiliate work on a simple mechanism: a tracking pixel or postback script confirms the sale and attributes the commission back to the affiliate who sent the traffic, usually firing on the order confirmation or thank-you page.

The problem is when that pixel fires, not whether it fires at all. In most setups I've seen, the network's pixel loads as part of the page itself, through a script tag sitting in the page's head or footer, and it doesn't wait for anything or check whether the visitor has accepted marketing cookies, it just fires, because that's how it was set up when someone (probably a developer, following the network's integration guide) pasted the snippet in years ago.

This matters because affiliate tracking pixels are functionally marketing or advertising cookies, not strictly necessary ones. If your cookie banner has a marketing or advertising category, and your affiliate pixel isn't gated behind it, you've got a mismatch between what your consent banner promises and what your site actually does.

You can check this yourself in ten minutes using Google Tag Manager's preview mode or your browser's network tab. Load your site fresh with cookies cleared, watch what fires before you interact with the consent banner at all, and if the affiliate network's script or a redirect to their tracking domain shows up in that list, you have your answer.

Is Your Affiliate Programme Actually Exposed?

Your programme is exposed if any of four specific checks come back wrong, and running through all four takes about half an hour, not a legal review. Before you assume you're fine, or panic and assume you're not, work through each one properly.

1. You'll know your exposure once you've watched the network tab on a fresh page load. Open Google Tag Manager in preview mode (or your browser's network tab if you're not on GTM) with cookies cleared, and note every request that goes to a known affiliate network domain, Awin, Impact Radius, CJ Affiliate, Rakuten, or your specific network's tracking domain, before you click anything on the consent banner.

2. The tag is only safe if it requires a consent signal before firing. In GTM, check the tag's built-in consent settings or its triggering conditions to see whether it requires ad_storage (Google's consent signal for advertising cookies) or a custom consent state to be granted first. If there's no consent check on the tag at all, it fires regardless of what the visitor chose.

3. Your network's terms will tell you where responsibility actually sits. Read your network's terms of service on compliance responsibility, most networks are explicit that the client business is responsible for cookie consent and data protection compliance on their own site, and the network is not doing this for you.

4. A generic "marketing" toggle doesn't automatically cover your affiliate tag. Check whether your cookie banner's categories actually connect to the affiliate script specifically, because a lot of consent banners have a generic toggle that visitors decline while the affiliate script keeps firing anyway, since nobody wired the banner's consent signal to that particular tag.

If any of those four checks come back wrong, you're not compliant with your own stated cookie policy, regardless of what the April guidance does or doesn't change.

Why Isn't "The Network Handles It" a Safe Assumption?

"The network handles it" isn't safe because affiliate networks control the tracking pixel, not your consent infrastructure, that's your website, your cookie banner, and your GTM container. This is the assumption I want to push back on directly, because it's the one that gets businesses into trouble.

Affiliate networks provide the tracking pixel and write the integration documentation, but what they don't do is control how or where you implement that pixel on your own site. Responsibility for consent capture sits with the site owner because the site owner controls the environment the visitor is in, the network can build the most sophisticated attribution system in the world, but if you paste their script above your consent banner, the compliance gap is yours, not theirs.

I'd put this at the same level as any other third-party pixel question: Meta's pixel, LinkedIn's Insight Tag, or an affiliate network's postback script. The technology vendor is not the data controller for your site's consent, you are.

What's the Fix for Consent-Gated, First-Party Affiliate Tracking?

The fix is architectural: gate the affiliate tag in Google Tag Manager behind a consent state, so it only fires once the visitor has explicitly accepted the relevant consent category. Rewriting your cookie policy doesn't change what the pixel actually does on page load, the tag's triggering needs to be tied to a consent state, granted or denied, rather than firing unconditionally.

This is the same consent-gating architecture I use for Enhanced Conversions and Customer Match on the ad platform side, applied to a different pixel. The underlying principle is that any third-party tracking pixel on your site should answer to the same consent gate, not each be treated as a separate special case.

Where possible, I'd also look at whether the affiliate network supports server-side or first-party tracking methods, which reduce reliance on third-party cookies firing directly in the browser and give you more control over exactly when attribution data leaves your site. Not every network supports this well yet, so check what your specific network offers before assuming it's an option.

This isn't a one-off fix you make once and forget, it's infrastructure. The same consent architecture that governs your Google Ads and Meta tracking should govern your affiliate tracking, because it's the same underlying question: does data leave your site before or after someone has agreed to it leaving.

What Does This Mean for Commission Attribution Accuracy?

Gating your affiliate pixel behind consent will reduce your recorded conversions, and you need to be ready to explain that to whoever looks at your affiliate reporting. If your affiliate pixel was previously firing on every page load regardless of consent, some of your recorded conversions were attributed from visitors who never actually consented to tracking.

Once you gate that pixel behind consent, you'll likely see fewer attributed conversions than before, not because affiliates are suddenly performing worse, but because you're no longer counting sales you shouldn't have been counting in the first place. This is a data accuracy issue as much as a legal one: the old numbers weren't more generous, they were less true.

Your affiliates might see lower reported commissions and ask why. The honest answer is that the tracking is now only counting people who actually agreed to be tracked, which is the number you should have had all along. Get ahead of this conversation before an affiliate raises it, and explain the change proactively rather than letting them think you've quietly cut their commissions.

Compliance Checklist Before You Next Review Your Programme

Check item	What to look for	Who to involve
Pixel firing order	Use GTM preview mode or network tab, does the affiliate pixel fire before any consent interaction?	Developer / whoever manages GTM
Consent gating	Is the affiliate tag's trigger tied to a consent state, or does it fire unconditionally?	Developer / GTM admin
Cookie banner categories	Does your banner have a category that actually covers affiliate/marketing tracking, and is it named clearly?	Marketing lead / whoever built the banner
Network terms of service	Read the compliance responsibility clause in your specific network's terms	You / legal
First-party or server-side option	Does your network support a consent-respecting alternative to a raw browser pixel?	Network account manager
Attribution reporting expectations	Have you told affiliates that numbers may shift once gating is fixed?	You / affiliate manager
Specific legal exposure	Does the April 2026 guidance change your liability in your specific circumstances?	Solicitor