Server-side tracking and consent in 2026: what advertisers need to know

Tracking is the foundation of every affiliate programme. If a sale is not recorded, the partner is not paid, and partners who are not paid stop promoting you. Yet the rules and technology around tracking have shifted a lot in the past two years, and many advertisers are unsure what still applies.

This article gives you a practical overview of where things stand in October 2026: consent rules in the EU, Google Consent Mode v2, the status of third-party cookies in the main browsers, and why server-to-server tracking has become the standard for affiliate networks.

The legal basics: GDPR and ePrivacy

In the EU two sets of rules work together. The ePrivacy Directive, Article 5(3), requires consent before you store or read information on a user’s device, such as cookies, unless it is strictly necessary for a service the user asked for. GDPR then governs how you process any personal data you collect. The UK has its own, closely related rules.

Change is being discussed but has not arrived. The European Commission proposed its Digital Omnibus package in November 2025, including new cookie rules such as one-click refusal and machine-readable browser signals. In October 2026 the Council was still settling its negotiating position and the European Parliament had not adopted its own, so none of these changes is in force. Plan on today’s rules for at least the coming year.

Consent banners that work for affiliate tracking

Your consent management platform decides which tags may fire. Many advertisers lose affiliate sales simply because the network’s tag is placed in the wrong category or blocked by default. Talk to your legal adviser about how affiliate tracking should be classified on your site, then check the setup:

• Every affiliate network tag is listed in the banner with a clear purpose and the correct category.
• Accept and reject are equally easy to find, and the banner text explains tracking in plain language.
• The network tag fires on the confirmation page after consent is given, also when consent is given on that same page.
• You pass the consent status to the network where it supports a consent parameter.
• You test the full journey from partner click to order confirmation in a private browser window, with and without consent.

Google Consent Mode v2 in brief

If you use Google Ads or Google Analytics, Consent Mode v2 is required for personalised advertising for users in the EEA and is linked to Google’s EU User Consent Policy, which also covers the UK. Since March 2024 Google expects four signals: ad_storage, analytics_storage, and the two newer ones, ad_user_data and ad_personalization.

• Basic mode blocks Google tags until the user consents, and nothing is sent before that.
• Advanced mode loads the tags before the banner appears and sends cookieless pings when consent is declined, which Google uses for modelling.
• Consent Mode only controls Google’s own tags. Your affiliate network tags need their own consent handling.

Third-party cookies: Chrome, Safari and Firefox

For years the industry prepared for Chrome to drop third-party cookies. That is no longer the plan. In April 2025 Google said it would keep its current approach to cookie choice in Chrome rather than introduce a new prompt, and in October 2025 it announced that it was retiring the Privacy Sandbox technologies because of low adoption.

• Chrome: third-party cookies remain available unless the user blocks them.
• Safari: Intelligent Tracking Prevention has blocked third-party cookies by default since 2020.
• Firefox: Total Cookie Protection, which keeps cookies separate for each website, has been on by default for all users since 2022.

The practical lesson is that tracking built on third-party cookies already fails for a large part of your traffic, especially on iPhones. Chrome’s decision does not change that.

Server-to-server tracking in affiliate networks

Server-to-server (S2S) tracking sends the conversion from your own server to the network instead of relying only on a script in the shopper’s browser. When a visitor arrives from a partner, your site stores the network’s click ID, for Awin the awc parameter, and your server sends it back with the order.

• Awin now requires S2S tracking for all advertisers and treats consent signals as a separate integration that is also required.
• Awin reported in September 2025 that in an internal sample of 25,000 sales, 22% of tracked conversions were visible only because of S2S tracking.
• Options and requirements differ between networks such as Adtraction, Partner-ads, Daisycon, Tradedoubler and Impact, so ask each network you work with for its current server-side specification.
• Plugins for Shopify and WooCommerce, or a server-side tag manager, can make implementation easier.

One important point: server-side tracking changes where data is sent, not whether you need a legal basis. If consent is required, it is still required. S2S makes your data more complete and reliable. It is not a way around the banner.

Checklist for advertisers

• Map every tracking tag on your site and its consent category.
• Confirm Consent Mode v2 sends all four signals if you use Google Ads.
• Implement S2S tracking with every network you work with, alongside the browser tag.
• Run test orders through each network before peak season and check they appear correctly.
• Follow the Digital Omnibus negotiations, but do not change your setup until rules are adopted.

Good tracking is not just a technical detail. It decides whether partners trust your programme enough to promote it. A clean consent setup combined with server-to-server tracking gives you complete data, fewer disputes and a stronger position with your best partners.

Unsure whether your tracking captures every sale? Start with a free audit of your affiliate programme before Black Friday on 27 November.

Sources

1. Engadget – Google has killed Privacy Sandbox (October 2025)
2. iubenda – Google Consent Mode v2: what it means for your business and advertising
3. PPC Land – EU Council draft cuts cookie re-prompt wait from 6 months to 4 (October 2026)
4. Awin Help Centre – Server-to-server tracking
5. Hello Partner – Awin reports $100M in revenue recovery thanks to CPI (September 2025)
6. Mozilla – Firefox rolls out Total Cookie Protection by default to all users worldwide