What the ICO's ruling on cashback cookies means and what needs to happen next

You might have missed it last week as the news only came out around 5pm on Friday (and not many of us check Linkedin over the weekend) but the big news of the week, month, or even year, is that the ICO have officially confirmed on their website that cashback cookies (and other forms of loyalty) fit under the Strictly Necessary cookie type in consent platforms.

You can view the answer to a question submitted to their innovation team here: https://ico.org.uk/for-organisations/advice-and-services/innovation-advice/previously-asked-questions/#pecr (scroll to the bottom).

In a way - this isn't news; as TopCashback's guidance to advertisers for some time as been that this is the case based on the rules around PECR but DPO's can be very risk adverse, so having this confirmed by the ICO marks and important step towards helping our customers ensure that they get the cashback they are expecting.

If you want further background on this - you can read some of my other articles below:

• Cookie Consent and what it means for the Affiliate Industry
• Why Cashback sites shouldn't sit behind consent

In this article - I'm going to try and give a recap on why this is important and also what advertisers need to do to allow for this to happen and for them to remain complaint if their affiliate cookies currently sit behind consent.

What is it & why this is important?

As a very quick recap - these little things are now on nearly every page you'll visit over the internet.

More and more of them are becoming ICO compliant - which means that a reject all button (like in the example above) needs to be prominent. Some good research done at the end of 2023 showed that 61% of UK customers accept these cookie banners; although other research shows it's a lot less than this; regardless - the point is the same - a lot of customers click decline.

On a recent Moonpull audit we did of our top 100 websites; over 40% of these advertisers had the cookies only dropping after a user clicks accept.

To put into further context; my rough estimate is that so far this year, TopCashback members alone have lost over ￡10m in cashback due to customers declining consent; and that number is only going up as more advertisers become complaint with ICO guidelines.

From an advertiser perspective - there is motivation to get this sorted; clearly they won't want their own customers to have a bad experience and not return; and the time and effort to have to deal with claims isn't what anyone wants!

So what next for advertisers? What are the practical steps?

For months; if not years, we've been speaking to affiliate networks about what needs to be done here and the good news is that most of them have a solution for this already.

The ICO are very clear in their guidelines that this cookie in this situation can only be used for the purpose of tracking the customers cashback, this means you have to understand how to treat the traffic that comes from TopCashback differently to the traffic that might come from another non-loyalty publisher. This is how it is usually done:

• Cashback/Loyalty site sends clicks to affiliate network as normal
• Network identifies traffic is coming from cashback/loyalty site/link
• Network appends homepage/deeplink URL for the advertiser and adds in something like "&cashback=true".
• The tech solution that manages the advertisers consent looks to see if cashback=true is in the URL and if it is, drops the cookie straight away; if it isn't - follows the normal process outlined (i.e. drops of the user says yes and doesn't if user says no).

The last point is a really important one - and it really does depend on the setup with the affiliate tracking, your CMP, your tag manager, etc.

My advice is to reach out to your network. As mentioned already, most have a tech solution that should be a simple change to your setup; Impact.com recently announced that this form of tracking is the default for all new advertisers launching in their network; Awin have their consent signals technology; CJ have a consent parameter, etc.

If you struggle here - reach out to your contact at TopCashback UK - or even me directly - we have a dedicated tracking manager at TopCashback who will be able to also speak to our contacts and find a way to make it work for you - this likely small tech change can hold a HUGE importance to ensuring that your customers are paid the cashback they expect so it should now become a priority to get it right and over time we'll be reaching out one by one to all advertisers whose cashback tracking currently sits behind consent to put some timelines in place to get this changed & updated.