Why you typically don't need to ask for cookie consent for the Reditus cookie

Typically, no cookie consent is needed for the Reditus cookie. It only records whether a signup came via an affiliate, and it builds no visitor profile. This is based on the opinion of a Dutch lawyer and may not apply in every country (for example Germany), so check your own local regulations.

Below is the reasoning behind it.

How the Reditus cookie works

The cookie we use can be considered an affiliate marketing cookie, but it works differently from other providers you may know. When a visitor arrives through an affiliate link, our tracking script sets a first-party cookie that records that the visit came via an affiliate, so the signup can be credited to the right affiliate.

Important: we do not build a tracking profile.

You decide how long the cookie counts: each program sets its own cookie window, anywhere from 1 to 365 days, and new programs start at 60 days.

Current cookie law in the Netherlands

The use of cookies in the Netherlands is regulated by the cookie law, Article 11.7a of the Telecommunications Act (Telecommunicatiewet). Under this law, consent is required for cookies used for tracking purposes or to gain analytical insights.

Consent is not needed for technical or functional cookies, or for analytical cookies that pose minimal invasion of visitor privacy. This exemption applies primarily in the Netherlands.

Legal consultation by ICTRecht (IT law specialists)

ICTRecht, a Dutch IT-law firm, advised us that affiliate cookies and similar techniques, such as tracking scripts, are essential to make affiliate marketing work as a revenue model. They are what lets you track which advertisement led to a successful referral and paid subscription, and determine which affiliate is responsible and should be paid.

Cookies typically require consent, but there are exceptions, including for affiliate cookies, provided specific conditions are met.

When an affiliate cookie is exempt

In the legislative history of the Telecommunications Act, affiliate cookies are recognized as exempt from the consent requirement when they meet three conditions.

1. The cookies are used exclusively for affiliate purposes, for example determining if the affiliate should be paid.
2. No tracking profile is created for the website visitor.
3. The cookie's lifetime is limited to what is necessary for affiliate purposes.

If these conditions are met, the privacy invasion is minimal and, under Dutch law, no consent is needed. If an affiliate cookie creates a tracking profile or is used for other purposes, consent becomes mandatory.

Consent or not, websites must always inform visitors about the use of cookies.

What this means for your website

• In the Netherlands: under current Dutch cookie law, consent for affiliate cookies is not mandatory as long as they are used solely for affiliate purposes, meaning measuring numbers and determining affiliate payouts.
• Elsewhere: rules differ per country, and the exemption above applies primarily in the Netherlands. Check your own local regulations, and ask your own counsel if you're unsure.
• Always: tell visitors which cookies you use, for example in your cookie policy. Our cookie policy lists the cookies the Reditus tracking script can set on your website.
• If you use a consent banner: when it holds back the Reditus script until a visitor accepts, the cookie isn't set for visitors who decline, so their signups can't be credited to an affiliate.
• If a tracking profile is built, or cookies are used for additional purposes, consent from the website visitor is always required.

Questions about cookies or privacy? Email privacy@getreditus.com. More in our privacy summary and how Reditus handles data privacy.