Cashback tracking cookies
How the cookie that tracks your cashback works, why it is treated as strictly necessary, and the standard we hold every partner brand to.
Cashback only works if a purchase can be traced back to the click that earned it. This page explains the small tracking cookie that does that, the ICO’s position on it, and what we ask of the brands we work with. It is written for both members and partner brands.
2The ICO's position
In October 2024 the Information Commissioner’s Office (ICO) confirmed that cookies like this can be treated as strictly necessary under the Privacy and Electronic Communications Regulations (PECR) when they are used solely to facilitate the cashback or reward a user has requested. Where that is the case, they do not need to be gated behind a consent banner.
“When someone signs up to an online service offering cashbacks or rewards, it is likely that some cookies set by that service would be essential as the user has requested that service.”
You can read the guidance on the ICO’s PECR previously asked questions.
Strictly necessary is not a loophole. It applies here only because the cookie does nothing beyond delivering the cashback the member requested. The moment a cookie is used for anything else, that analysis changes.
3What we ask of partner brands
For a member’s cashback to track reliably, the tracking cookie has to be allowed to drop as an essential, strictly-necessary cookie, regardless of the visitor’s consent tier. We ask every partner brand to:
- treat the cashback tracking cookie as strictly necessary, so it is set even under an essential-only consent choice;
- use it only for cashback attribution, never for marketing, advertising or profiling;
- keep it working through the checkout, so the completed sale can be attributed.
This is the standard the ICO’s guidance supports, and it is what keeps the cashback a member requested from being lost.
4Why it matters
If the tracking cookie is blocked unless a visitor accepts non-essential cookies, then every member who clicks through under an essential-only consent choice loses the cashback they were promised.
In practice that means missed cashback, frustrated members and avoidable support queries, for a cookie the ICO accepts can be treated as essential.
Treating cashback attribution as strictly necessary keeps the service working the way the member asked it to, and keeps the relationship between the member, TOSE and the brand straightforward and honest.