The UK's Information Commissioner's Office has told cashback operators that their cookie-based affiliate tracking falls within the "strictly necessary" exemption, a classification that removes the typical consent prompt from the user journey. The clarification, as reported by Affiverse, lands at the intersection of PECR, the post-Brexit UK GDPR regime, and the performance-marketing attribution stack that funds most UK cashback and loyalty publishers.

What does "strictly necessary" actually cover?

Under PECR and the ICO's own cookie guidance, the category is narrow. It covers cookies required to deliver a service the user has explicitly requested: shopping cart contents, session logins, load-balancing. Cookies used to track referrals for commission payouts have, in most prior readings, sat outside that box and required prior consent through a CMP banner or equivalent.

The ICO's apparent reclassification pulls cashback referral tracking inside the exemption on the grounds that the cookie is technically required to credit the user with their rebate. Without it, the service — as marketed — does not function. The user does not see a different price; they receive money back only if the referrer cookie is present and matched at transaction time.

Why this matters for CPL, CPA, and revshare programs

Cashback sites operate on a revshare-aligned model: the publisher earns a commission when the user completes a qualifying purchase, and the user receives a rebate of part of that commission. The relationship depends on persistent first- or last-party cookies that survive navigation from the cashback domain to the merchant checkout.

If those cookies no longer require a consent gate, conversion attribution for cashback publishers becomes both more reliable and harder to dispute. Networks that have historically lost cashback-sourced transactions to consent-banner drop-off stand to recover a measurable share of that leakage. Program managers running hybrid CPL/CPA + revshare deals should expect cashback partners to renegotiate payout assumptions upward, since the attribution path is now regulator-blessed rather than regulator-tolerated.

What the headline does not tell us

The source material available to RevShare Report is limited to a single headline. We could not independently confirm whether the ICO issued a formal guidance update, an email clarification, or an informal advisory opinion; whether the position applies to all UK cashback operators or to a specific complainant; and whether the exemption extends beyond cashback to other reward, loyalty, and incentive publishers using similar tracking mechanics. The cookie window length, attribution model, and fee structure of any affected program are not disclosed in the source.

Networks and compliance teams should request the underlying ICO correspondence before adjusting consent CMPs, internal attribution logic, or publisher terms. A headline-level reading is not a substitute for the regulator's actual text, and the line between "strictly necessary" and "performance" cookies remains contested across other affiliate verticals including comparison sites and voucher publishers.

Compliance context for publishers

FTC and ASA disclosure obligations on cashback rebates are unaffected. The UK clarification governs data-protection consent, not advertising transparency. Cashback sites must still surface the rebate rate prominently enough that the user understands the commercial arrangement, and program terms must still disclose how long the cookie is held, whether the commission is shared, and how the user claims unpaid rebates.

Publishers operating US, EU, or cross-border traffic should also map the UK position against their own jurisdictional defaults. EU member-state DPAs have generally taken a stricter line on affiliate cookies under the ePrivacy Directive, and the UK divergence does not automatically export.

The forward question

The open question is scope. If the ICO extends the same logic to voucher codes, loyalty wallets, and browser-extension cashback tools, the commission economics of UK-focused affiliate programs will shift toward the publisher side. Until the regulator publishes the underlying text, treat the clarification as a directional signal rather than a structural reset, and price UK cashback traffic accordingly.