Tracking Influencer Campaigns Under the UK's Cookie Rules

Most influencer campaigns are measured with tools that store or read something on the visitor's device: analytics cookies, advertising pixels and affiliate tracking. In the UK, that falls under the Privacy and Electronic Communications Regulations (PECR), which the Information Commissioner's Office (ICO) enforces. The ICO finalised its guidance on storage and access technologies on 29 April 2026, and it settles several questions that matter for creator campaigns, including what the new analytics exception does and doesn't cover.

This is general guidance for planning, not legal advice. For a significant campaign, check your setup with someone qualified in UK privacy law.

Quick answer

Under the ICO's 2026 guidance, first-party analytics used only to improve your website can run without consent if you meet the statistical purposes exception's conditions, including clear information and a simple, free way to object. The exception doesn't cover anything related to online advertising, so measuring whether people clicked an advert, sharing conversions with ad platforms, and affiliate tracking that stores information and passes it to a third party generally need consent. Creator-specific discount codes and post-purchase surveys don't rely on device storage and keep working whatever visitors choose.

What the rules cover

PECR's rule is about storing information on a user's device, or accessing information already there. The ICO's guidance applies it to cookies and to similar technologies, including tracking pixels, web storage, fingerprinting and link decoration, which is the practice of adding extra information to the URL in a link someone clicks. The guidance's position is that link decoration matters under PECR when it involves storing or accessing information on the device, and that the purpose it's used for is the key consideration.

In practice, the UTM tags on a creator's link are a piece of link decoration. What engages PECR is usually what happens next: an analytics tool or pixel on your site reads the tags and stores an identifier in a cookie.

The analytics exception and its limits

PECR now includes an exception for statistical purposes. According to the ICO's guidance on the exceptions, you don't need consent where the sole purpose of the storage or access is to collect statistical information about how your service is used, with a view to improving it. The conditions are strict:

• Sole purpose: the technology is used only to improve your website or service, not for anything else.
• Aggregate information: the guidance describes aggregate statistics about how the service is used, not about who is using it.
• Clear information: you tell users what the technology does and why.
• A simple, free way to object: for example a toggle that's on by default and can be switched off. If someone objects, you stop.
• Third-party analytics providers: they can be covered only as a processor acting for you, not a joint controller, and must not combine the data with other information they hold.

The important line for influencer marketing is that the guidance says the exception does not apply to purposes related to online advertising. It gives examples that need consent, including information on whether a user viewed or clicked an advert to measure its performance, and connecting a visitor's activity, such as purchases, to advertising partners. A sponsored creator post is advertising under UK rules, so measuring creator posts through device storage sits close to that line. Don't assume the analytics exception covers creator-campaign measurement without checking it against your own setup.

What this means for each tracking method

Affiliate programmes need particular care

Many creator programmes pay commission through affiliate links, which typically store an identifier when someone clicks and read it at purchase to credit the creator. The ICO's guidance gives affiliate marketing as an example of storing information on a device and later accessing it to share with a third party, which brings it within PECR. If commission depends on that tracking, consent rates directly affect what creators can be credited for. Give affiliate creators a code as well as a link, so a sale isn't lost when a visitor declines tracking.

Measuring creator campaigns with less tracking

• One discount code per creator, with an end date. Codes keep working whatever visitors choose about cookies.
• A one-question survey after purchase or sign-up, listing creators or 'a creator on Instagram or TikTok'.
• Creator-specific landing page paths, so you can count visits and orders by page in your own data.
• Consented analytics for the detail, read as a sample rather than a total.
• Before-and-after comparisons of branded search and direct visits around creator posting dates.

Expect consented analytics to show fewer creator visits and conversions than actually happened, and report that openly instead of presenting the tracked figure as the whole result. Influencer UTM tracking explains why tagged numbers come in lower than creator-reported clicks, and measuring influencer campaign ROI covers how to report a range rather than a single number.

A setup checklist for UK campaigns

• List every technology on the pages creators link to: analytics, pixels, affiliate scripts, heatmaps and chat widgets.
• For each, write down its purpose and whether it relies on an exception or on consent.
• Check that the consent banner blocks consent-based tags until the visitor agrees, and that declining is as easy as accepting.
• If you rely on the analytics exception, add clear information and a simple way to object, and confirm your provider acts as your processor.
• Give every creator a code as well as a link.
• Add a post-purchase source question.
• Agree with affiliate creators how sales are credited when tracking isn't possible.

This is separate from disclosure

Cookie rules govern how you measure. Whether a creator's post is properly labelled as an advert is a different set of rules, from the ASA and the CMA. UK influencer marketing rules covers labelling, gifted content and affiliate disclosure.

Getting the setup built

Much of this is implementation: which tags load before consent, how the banner works, how codes and survey answers reach your reporting, and how creator landing pages are counted. If your site needs that work done properly rather than patched, ZSpace Labs, a web development studio that builds sites for UK clients, sets up analytics and tracking as part of its website builds. Disclosure: Kudozz has a paid partnership with ZSpace Labs, and this is a sponsored link.

Conclusion

The ICO's final guidance gives UK sites a real exception for improving their own websites, but it draws a clear line at advertising, and creator campaigns are advertising. Plan for consent where measurement is advertising-related, keep affiliate creators covered with codes, and build in signals that don't depend on cookies. That way the campaign is compliant and the report still tells you which creators worked.