Cookie stuffing is affiliate fraud. An affiliate's tracking cookie lands on a shopper's device without the shopper clicking that affiliate's link, so when the shopper buys anyway, the affiliate collects the commission. It is also called cookie dropping.
The vendor pays for a sale the affiliate didn't cause, and the affiliate who earned it often loses the credit. If one partner's numbers look too good, I'd read their clicks before I pay them.
For years cookie stuffing was a topic for affiliate forums. In August 2026 it became general news. Bloomberg reported that Phia, the shopping app co-founded by Phoebe Gates and Sophia Kianni, had been taking credit and commission for affiliate purchases it didn't help generate, and that the founders knew about it for months (TechCrunch, 11 August 2026). Phia called it "misattributions", said the features were removed on July 7, and said it had started reversing transactions to brand partners.
The figure that stuck came from an alleged internal Slack message: stuffing made up an estimated 51% of the sales the app took credit for in June (TMZ, citing Bloomberg). Most of the coverage was about the founders. I read it from the other side of the deal, the one that pays the commission. I spent nine years as CTO of a direct-response company building the checkout and the attribution behind it, and a stuffed sale looks exactly like a real one until you put the clicks next to it.
What is cookie stuffing?
Affiliate programs track referrals with a cookie. When a shopper clicks an affiliate link, the network or tracking platform records the click and drops a cookie that names the affiliate. If the shopper buys before the cookie window runs out, that affiliate is paid.
Cookie stuffing skips the click. The affiliate link is loaded without the shopper choosing it, the cookie is set anyway, and the commission follows any purchase the shopper makes inside the window. The shopper pays the same price and usually never notices. The other names you'll see for it are cookie dropping, forced clicks and cookie sprinkling.
How cookie stuffing works
Every method does the same thing: it makes the browser request the affiliate link when nobody clicked it.
- Hidden images and frames. A page loads the affiliate link as a 1x1 image or an invisible iframe, so every visitor gets the cookie.
- Pop-unders and redirects. The link opens in a window behind the page, or the visitor is bounced through it on the way somewhere else.
- Browser extensions. A coupon or price-comparison extension opens the affiliate link at checkout, whether or not it found a discount. This is the pattern in the Phia reports: according to TMZ's summary of Bloomberg, the app set a tracking cookie in the checkout process and reported that it drove sales even when the product wasn't used.
- Images in forums and comments. An "image" whose address is really an affiliate link.
The first two cast a wide net and hope some visitors buy within the window. I'd worry more about the extension version, because it catches shoppers who are already in your checkout with a card in hand.
Why last-click credit makes it pay
Most affiliate programs pay the last affiliate cookie set before the sale. That rule, last-click attribution, is what makes stuffing profitable: a stuffer doesn't have to find customers, it only has to be the newest cookie on the device.
So a stuffed sale usually has two victims. The vendor pays a commission on a sale it would have made anyway, and the affiliate whose review actually sold the product sees the credit go to someone else. Programs that pay the first click or split the credit change who loses. They don't stop the stuffer from collecting.
What cookie stuffing costs a vendor
An illustrative program, to show the arithmetic. These are example numbers, not a real account.
| Illustrative affiliate program | Value |
|---|---|
| Affiliate-credited sales per month | 2,000 |
| Average commission per sale | $45 |
| Share of credited sales that were stuffed | 5% |
| Stuffed sales per month | 2,000 × 5% = 100 |
| Commission paid for nothing, per month | 100 × $45 = $4,500 |
| Per year | $4,500 × 12 = $54,000 |
Five percent is a modest guess next to the 51% estimate in the Phia reports. The cost the table can't show falls on the partner who earned the sale. Their EPC drops because their sales are credited to someone else, and the good ones move their traffic to an offer that pays them properly.
Is cookie stuffing illegal?
It breaks nearly every affiliate agreement. ClickBank's Prohibited Seller and Affiliate Activities guidelines list "cookie stuffing" first under "Interference with the Normal Flow of Business", and a breach "may result in the cancellation of your listings, suspension or termination" of the account (ClickBank). TechCrunch notes that affiliate contracts usually ban it.
Whether it is also a crime depends on the country and the facts of the case, and that question belongs with your lawyer. Collect the order IDs and timestamps first, and talk to them before you accuse a partner in public.
How to spot cookie stuffing in your affiliate numbers
Stuffing leaves a fingerprint in per-affiliate numbers. The two common methods leave opposite ones.
- Hidden page loads: a lot of recorded clicks, a conversion rate far below your other partners, and sales that arrive days after a "click".
- Checkout extensions: roughly one click per sale, a conversion rate far above everyone else, the click seconds before the order, and many buyers who were already your customers or came from your own email.
- Either method: the affiliate can't tell you where the traffic comes from, or names sites that send nothing when you visit them.
None of these proves fraud on its own. A strong email affiliate can convert well above the rest, and a legitimate coupon site does catch shoppers near checkout. Treat a pattern as a reason to ask questions before the next payout.
The quickest test I know takes twenty minutes. Pull the last 20 orders credited to the partner you're unsure about and write down two things for each: the time between the affiliate click and the order, and whether the buyer had bought from you before. Twenty clicks a few seconds before twenty repeat orders is a conversation you need to have.
How to stop cookie stuffing in your affiliate program
Six steps, in the order I'd set them up.
- Ban it in writing. Name cookie stuffing, forced clicks and extensions that set cookies without a click, and state the penalty: commissions reversed, account closed.
- Approve partners by hand. Ask each one for their traffic sources and look at them before you approve.
- Read per-affiliate numbers weekly. Clicks, sales, conversion rate and refunds side by side, compared with the program's median.
- Check the sources yourself. Open the sites that send clicks. For a coupon extension, install it and buy something without using a code.
- Review each payout. Paying after your refund window closes gives you time to look.
- Claw back and remove. Reverse the stuffed commissions under your terms and end the partnership.
If you sell through a network such as BuyGoods or Digistore24, the network sets the cookie and pays the affiliate, so the report goes to the network with your evidence attached.
Affiliate fraud checks in ElasticFunnels
Stuffing is hard to see when click data sits in one tool and order data in another. In ElasticFunnels each partner's clicks and sales sit in the same row.
- Per-affiliate numbers in one row. The dashboard breakdown's Affiliate and Sub ID tabs show sessions, clicks, sales, abandons, conversion rate, AOV, refund total and refund %, commissions paid and EPC for each affiliate.
- One partner's traffic, opened up. The Clicks report filters click and session data by affiliate, UTM, page, funnel, device and geo.
- Network affiliates too. ClickBank, BuyGoods, Digistore24 and JVZoo orders arrive with the affiliate stored on them, so network partners show up in the same tabs.
- Your own program. Commission groups, payouts and per-affiliate postbacks are managed in the same app.
ElasticFunnels won't stop a stuffer for you. It puts the numbers that give one away on one screen. If you run your own partner program, the affiliate tracking page shows how partners, commission groups and payouts fit together. Every feature is on every plan.
- A partner whose conversion rate is several times the program median gets a call before the next payout. Usually there's a good reason. Sometimes there isn't.
- I wouldn't pay affiliates before the refund window closes. The wait costs honest partners little and gives you time to check.
- Coupon and cashback extensions deserve their own terms. Decide up front whether they earn anything when the shopper was already in your checkout.
- When a network affiliate looks wrong, send the network order IDs and timestamps. "Something seems off" gets filed and forgotten.
Cookie stuffing is old, cheap to run and easy to miss, because a stuffed sale reads like any other line in a revenue report. It only shows when each partner's clicks sit next to their sales. Looking at that once a week takes far less time than paying stuffed commissions for a year.
