How cookie stuffing takes affiliate commission, and how to see it on your store

It's mid-October. You're reconciling September's affiliate orders before the peak-season rate bump. A news link goes round: a well-funded shopping app is accused of claiming sales it didn't drive. Your affiliate manager asks whether it's happening to you.

Your dashboard has a cashback app and a sub-network near the top, with orders from returning customers and shoppers following a creator's link. You can't tell which visits those partners started, or when commission locks.

Cookie stuffing is the question this guide answers: what it is, how an extension does it at your cart, what it costs, how to see it in your orders, and what protects your programme before peak.

What is cookie stuffing?#

Cookie stuffing means setting an affiliate's tracking cookie without the shopper clicking that affiliate's link, so it receives credit and commission for a sale it didn't refer. Under last-click attribution, the last cookie wins the commission.

The 2010 federal indictment in United States v. Hogan described the practice that way and said eBay credited the affiliate in the most recent cookie. [U.S. Attorney, N.D. Cal., copy hosted by Ben Edelman, Jun 2010] (opens the source) Last click remains impact.com's default, giving the last-click partner all of the credit. [impact.com Help Center, Oct 2026] (opens the source) Almost 80% of respondents in the PMA's 2026 US brand survey still used it; the trade body's announcement gives no sample size. [Performance Marketing Association, Jul 2026] (opens the source)

The classic method loads tracking invisibly. Rakuten Advertising's policy, updated 13 July 2026, calls a hidden merchant page or 1×1 pixel deceptive and bans software forcing clicks. [Rakuten Advertising, Jul 2026] (opens the source) Software on the shopper's device can open the affiliate link instead: Partnerize bans forced clicks and mimicking link clicks, CJ bans automatic redirects, and Awin requires voluntary, intentional interaction. [Partnerize, Apr 2025] (opens the source) [CJ, Aug 2022] (opens the source) [Awin, Oct 2026] (opens the source)

Two eBay affiliates were charged with wire fraud in separate 2010 cases. [Benjamin Edelman, Jul 2026] (opens the source) Shawn Hogan pleaded guilty in December 2012 and on 28 April 2014 received five months in custody and a $25,000 fine; Brian Dunning received 15 months on 4 August 2014. [U.S. District Court, N.D. Cal., via CourtListener, May 2014] (opens the source) [U.S. District Court, N.D. Cal., copy hosted by Ben Edelman, May 2014] (opens the source) [U.S. District Court, N.D. Cal., copy hosted by Ben Edelman, Aug 2014] (opens the source) Those convictions concern their own facts, not a general statute covering every instance. This research found no FTC action on affiliate cookie stuffing or coupon extensions, and no UK case. Your practical remedy is contractual: reversal and recovery.

How does a shopping extension take the last click on your own store?#

In this form of cookie stuffing, your shopper is in a real store session. The extension opens its affiliate link in a background tab or request at a moment the shopper didn't choose, and last click credits it with your order.

Bloomberg's testing of Phia's mobile extension, reported on 9 July 2026, found a background tab opening without user interaction at checkout, overriding earlier referrals, including on direct visits. Its reporting named Walmart, Nike and Zara and links across impact.com, CJ, Rakuten and Awin. [Bloomberg via The Business of Fashion, Jul 2026] (opens the source) Fortune's republication of Bloomberg's August report restates tests across more than 50 retail sites. [Bloomberg via Fortune, Aug 2026] (opens the source)

On 9 July 2026, Benjamin Edelman alleged Phia's enable_coupon_auto_drop invoked affiliate links at cart or checkout, first shipped on 13 December 2025. His tests found it enabled for iOS and disabled for Chrome, so a desktop test would have missed it. [Benjamin Edelman, Jul 2026] (opens the source) Bloomberg reported a dashboard showing activation on 10 December and deactivation on 7 July, when it contacted Phia. [Bloomberg via Fortune, Aug 2026] (opens the source)

Edelman's 11 August follow-up alleged clicks when mobile shoppers closed the slider or tapped outside it, by 11 November 2025. He alleged timed link refreshes on return visits from 7 October 2025. In tracking data he cited, as many as 12% of Phia's affiliate links then came on a session's first page. [Benjamin Edelman, Aug 2026] (opens the source)

One unnamed tracking service's data showed affiliate clicks in under 10% of Phia cart sessions before November 2025 and over 50% afterwards, he reported. These are click shares, not order or commission shares. [Benjamin Edelman, Aug 2026] (opens the source)

Phia said on 8 July that a recent release caused misattributions and it had fixed them. [Bloomberg via The Business of Fashion, Jul 2026] (opens the source) [Bloomberg via Fortune, Aug 2026] (opens the source) It says the features were removed on 7 July. [TechCrunch, Aug 2026] (opens the source) It disputes the cookie stuffing label, citing app downloads and acceptance of pop-ups containing a cookie disclosure, and says it offered transaction reversals to brands. [The Cool Down via Yahoo Finance, Oct 2026] (opens the source) [Business Insider, Jul 2026] (opens the source)

Creators allege similar attribution replacement elsewhere. The creators' January 2026 second amended complaint against Honey alleges a hidden tab; the Honey case for merchants covers it. [Creators' counsel, N.D. Cal. ECF 249, Jan 2026] (opens the source) RetailMeNot's case alleges a hidden mini-tab; one interference-with-contract claim survived on 25 March 2026. [U.S. District Court, S.D.N.Y., Mar 2026] (opens the source) On 9 October 2026, a Seattle judge let interference and unjust-enrichment claims against Microsoft proceed. [U.S. District Court, W.D. Wash., Oct 2026] (opens the source) Klarna's extension case ended by stipulated dismissal on 9 September 2026; the stipulation isn't public. [U.S. District Court, S.D. Ohio, via CourtListener, Sep 2026] (opens the source) No court has found liability against these extensions as of 17 October 2026.

Edelman says merchants are the main payers: commission on traffic you should receive without another charge, also displacing another publisher's credit where it referred your shopper. [Benjamin Edelman, Jul 2026] (opens the source)

What does it cost the merchant?#

Cookie stuffing costs you commission on orders the partner didn't refer, at your contracted rate. If another affiliate brought the shopper, your payment goes to the wrong partner and distorts your view of each partner's contribution.

impact.com is paid by the brands whose programmes it measured. That concentration of credit doesn't establish improper clicks.

Not started doesn't mean stuffed or unearned: the partner didn't begin the converting session. PartnerCentric sells commission-adjustment tools; its release gives no client or order count.

Replacing a creator's credit redirects an existing commission; claiming a direct or email order creates an extra one. Keep creator codes and affiliate links together when you reconcile. Recovery depends on timing: impact.com's Phia reprocessing covered unpaid actions. [Business Insider, Jul 2026] (opens the source)

Why don't the usual checks catch it?#

The usual cookie stuffing tests look for a referral without a visit. An extension's click happens during a real visit by someone already buying, so you need timing and sequence alongside session matching.

Missing sessions, abnormal conversion rates, absent referrers and spikes can flag other patterns. Awin names extremely short click-to-transaction times as a warning; impact.com's Advanced Action Listing shows Click to Action Time in seconds. [Awin Help Center, Apr 2026] (opens the source) [impact.com Help Center, Oct 2026] (opens the source) Genuine coupon and cashback clicks also happen at checkout, so a short gap alone proves nothing.

Edelman says merged sub-affiliate traffic makes spikes, conversion rates and timing harder for you or your network to distinguish. [Benjamin Edelman, Jul 2026] (opens the source)

In a statement an industry newsletter published on 8 July, Phia said networks had reviewed it as compliant. [Affiliate for Publicists, Jul 2026] (opens the source) Edelman's response: a review can miss violations; it can't certify their absence. [Benjamin Edelman, Jul 2026] (opens the source)

Chrome's policy requires related user action before each affiliate link, code or cookie and bans silent shopping-cookie updates. [Chrome for Developers, Mar 2025] (opens the source) Enforcement began in June 2025. [Chrome for Developers, Mar 2025] (opens the source) It has no stand-down rule, doesn't govern iOS Safari, and Phia's Chrome listing still shows its no-violations badge. [Chrome Web Store, Oct 2026] (opens the source)

A Content Security Policy doesn't control the shopper's extension. Section 9.1 of the W3C's CSP Level 3 Working Draft says policies should leave extensions operating and notes Chrome's exemption for chrome-extension:. [W3C, Sep 2026] (opens the source) Content scripts have an isolated environment inaccessible to your page; tab creation runs from the extension's service worker or pages. [Chrome for Developers, Oct 2026] (opens the source) [Chrome for Developers, Sep 2026] (opens the source) The affiliate tab and network cookie sit outside your page's control; the redirect then lands on your store.

Vendor prevalence figures disagree widely and mostly omit measurement methods. This guide uses none of them.

How can you see it in your own orders?#

To check for cookie stuffing, put your network's credited orders beside your store's arrival records. Look for clicks after the cart, on a return visit's first page, after another partner, or against customers arriving direct or from your email.

The redirect reaches your URL carrying a network click id. CJ tells advertisers to store cjevent in a first-party cje cookie on their own domain for 13 months, overwriting it whenever a new value arrives. [CJ Developer Portal, Oct 2026] (opens the source)

Shopify marketing activity data and Performance by marketing channel default to last non-direct click. [Shopify Help Center, Oct 2026] (opens the source) [Shopify Help Center, Oct 2026] (opens the source) A late affiliate landing can therefore take channel credit too. A background-tab visit becoming the last visit is an inference from the field definitions, not Shopify documentation about extensions.

Open your order's Conversion summary: it shows visits over the last 30 days and the first visit's origin. View conversion details adds days between first and latest visits and an activity timeline; View full sessions opens each visit's details. [Shopify Help Center, Oct 2026] (opens the source)

Your developer can read Order.customerJourneySummary.firstVisit and lastVisit, the latter being the last session before purchase. Each CustomerVisit has landingPage and referrerUrl. [Shopify developer docs, Oct 2026] (opens the source) [Shopify developer docs, Oct 2026] (opens the source) Order-level landingPageUrl and referrerUrl are deprecated; REST's landing_site and referring_site belong to the legacy API. [Shopify developer docs, Oct 2026] (opens the source) [Shopify developer docs, Oct 2026] (opens the source)

Shopify's changelog query returns the recorded last visit's landing page and referrer; replace its example order id with yours. [Shopify developer changelog, Aug 2025] (opens the source)

query referrerData {
  order(id: "gid://shopify/Order/14134963208214") {
    customerJourneySummary {
      lastVisit {
        landingPage
        referrerUrl
      }
    }
  }
}

Full query-string retention isn't documented. Shopify staff suggest parsing click ids from landingPage when present, so check your own known affiliate test order before relying on it. [Shopify Developer Community Forums, Dec 2025] (opens the source)

For a page-by-page record, your developer can add a custom pixel under Settings > Customer events, subscribed to page_viewed: event context supplies the full URL, query string and referrer. [Shopify Help Center, Oct 2026] (opens the source) [Shopify developer docs, Oct 2026] (opens the source) Pixels are sandboxed and can't change the page. [Shopify developer docs, Oct 2026] (opens the source)

WooCommerce's Order Attribution has been enabled by default since 8.5.0, released 9 January 2024, under WooCommerce > Settings > Advanced > Features. [WooCommerce Developer Blog, Jan 2024] (opens the source) It records source type, referrer, UTM fields and session entry page, using last click with UTM and organic sources overriding earlier sources. It has no dedicated network-click-id fields and doesn't track across sessions. [WooCommerce documentation, Sep 2026] (opens the source) [WooCommerce source code on GitHub, Oct 2026] (opens the source)

You can't add an unrestricted script inside Shopify checkout to watch extensions: checkout.liquid stopped working for Information, Shipping and Payment on 13 August 2024, and Thank you and Order status on 28 August 2025. [Shopify Changelog, Feb 2023] (opens the source) [Shopify developer docs, Oct 2026] (opens the source) Checkout UI extensions run in a Web Worker without page access, so use session and order evidence. [Shopify developer docs, Jul 2026] (opens the source)

Export impact.com's Advanced Action Listing with Referring URL, Landing Page URL, Referral Date, Click to Action Time, device and sub-IDs. [impact.com Help Center, Oct 2026] (opens the source) Performance by Full Referring URL allows 14 days per export. [impact.com Help Center, Oct 2026] (opens the source) Awin Classic's Reports > Performance > Transactions includes click time, minutes to transaction and referrer. [Awin Help Center, Aug 2026] (opens the source) impact.com warns referrers can be unreliable when links open new tabs. Sub-IDs appear only when the partner passes them. [impact.com Help Center, Oct 2026] (opens the source) [impact.com Help Center, Oct 2026] (opens the source)

Give your analyst these checks:

• Clicks after the cart. Compare your network's click time with Conversion summary: did it arrive inside the final visit, just before purchase?
• First-page clicks on return visits. Look for your partner's clicks clustering on session entry, Edelman's refresh signature. [Benjamin Edelman, Aug 2026] (opens the source)
• Customers arriving another way. Compare your returning, direct and email orders credited to one software partner or sub-network.
• An earlier partner. A creator or content link before an extension's winning click raises the stand-down question.
• Two networks paid. Edelman says Shopify integrations report each order to each network by default; reconcile duplicates across your programmes. [Ben Edelman, Aug 2026] (opens the source)
• Test on a phone. Follow another partner's link, then shop your store with the app or extension installed on an iPhone. In Edelman's tests, the cart-time clicks ran on iOS, not Chrome. [Benjamin Edelman, Jul 2026] (opens the source)

What actually protects your affiliate programme?#

Your terms, stand-down requirements and commission deadlines give you grounds and time to challenge an order. Your affiliate manager should settle them with finance before November's rate bump.

1. Write forced clicks and stand-down into your terms. Require affirmative action, stand-down after another partner's referral, identified software traffic, and rights to reverse and recover payments plus investigation costs. impact.com's policy v1.0.0, dated 26 August 2025, uses afsrc=1: no prompts or new or modified tracking cookies for the session or 30 minutes, whichever is longer. [impact.com, Aug 2025] (opens the source) Rakuten requires session-long stand-down; CJ requires respect for publisher-driven traffic and prior CJ interactions. [Rakuten Advertising, Jul 2026] (opens the source) [CJ, Aug 2022] (opens the source) Awin makes extensions soft click by default, payable only as the sole click or last among other soft clicks. [Awin, Aug 2025] (opens the source) Edelman recommends recovery including investigation costs and reports multiple seven-figure recoveries. [Benjamin Edelman, Jul 2026] (opens the source) Use the six terms that matter in an affiliate agreement. The catch: impact.com's rule requires the same brand relationship; you still need evidence of a breach.

2. Know your lock dates before peak. Have finance record your actual deadlines and your affiliate manager own the reversal request. A referral window decides which clicks qualify; the lock date decides when you can still change the payment. They are separate clocks. [impact.com Help Center, Oct 2026] (opens the source) [impact.com Help Center, Oct 2026] (opens the source) impact.com permits changes before lock, with support needed for reattribution; days-only locking is capped at 90 days. [impact.com Help Center, Oct 2026] (opens the source) [impact.com Help Center, Oct 2026] (opens the source) CJ allows one extra pay period before locking, then no advertiser edits. [CJ, Oct 2026] (opens the source) Awin automatically validates after your chosen period and recommends your returns period plus seven days. Its Shopify integration auto-approves unchanged orders. [Awin Help Center, Oct 2026] (opens the source) [Awin Help Center, Oct 2026] (opens the source) Awin accepts wrong marketing source as a decline reason. Approved Access commissions can't be reversed except in exceptional cases; Accelerate and Advanced can seek support, while paid commissions can't be reversed on any plan. [Awin Help Center, Jul 2026] (opens the source) The catch: a returns check doesn't check attribution. Don't leave November's orders for January reconciliation; after lock, recovery becomes a negotiation.

3. Ask which software partners and sub-networks you pay. Have your agency or network list extensions, apps and sub-publishers. Shopify's own affiliate programme is a model for your terms: written extension approval, stand-down for existing affiliate cookies, and no sub-affiliate networks since February 2026. [Shopify, Oct 2026] (opens the source) The PMA said members would vote on its proposed toolbar standard from 1 September 2026; no result has been posted, and it isn't binding. [Performance Marketing Association, Aug 2026] (opens the source) The catch: without sub-IDs, your report names the sub-network, not the app.

4. Run your order checks monthly through peak. Give your analyst the export and your affiliate manager the flagged orders before their deadlines. Ask the network to explain the click against the shopper's journey, including the earlier partner and the sub-publisher behind the credited account. Keep its response with your order evidence so finance can distinguish a pending challenge from an accepted reversal. The catch: genuine coupon clicks can look similar. Send the network your order evidence as a question to investigate.

5. Measure what each software partner adds. Use holdout measurement, keeping a comparison group, and test your cashback partner before renewing. The catch: small programmes need weeks of traffic; a November start won't answer before Cyber Monday. Agree timing with your developer using the code freeze guide.

What doesn't protect you: Chrome's policy lacks stand-down and iOS coverage; your CSP doesn't control installed extensions; network review can miss the behaviour. Keep your contractual rights separate.

How Benson shows who took the last click#

Benson's attribution integrity, on Stop and above, records the affiliate id, click id or UTM source your shopper arrives with: Awin, impact.com and CJ click ids, UTM tags, the ref parameter and first-party affiliate cookies you list. When credit changes after your shopper reaches the cart, it records the overwrite, shows the extension detected in that session, and estimates the commission moved at your rates, with the first partner and winner side by side.

Alerts, a network report and a CSV list the overwrites by network, with the rates and method used and no shopper identities. Your network's compliance team can compare them with its click logs, which gives you evidence for your terms and for a challenge before lock.

The Free plan includes extension detection and observe mode: which coupon and cashback extensions run in your sessions, with nothing changed on your store.

Partner deals record whom you pay, how and at what rate. Each readout shows orders, commission at your recorded rate, and, with attribution integrity on Stop and above, how often the partner joined after the cart. The partner deal playbook covers the decision.

Film 03 / 09You have a deal with an extensionWatch1:11

Block, on Stop and above, hides non-partner extension pop-ups by rule while allowing your partners through, on storefront home, product, collection, search, cart and cart-drawer pages. On Shopify, no app can change what an extension shows inside checkout, so checkout code policies, also Stop and above, accept only allowlisted codes in coupon-extension sessions and return a short message for others. Every control can run against a holdout, measuring the result on your store.

To start, add Benson from the Shopify App Store and leave it in observe mode through a normal week before peak. Overwrites are recorded on Stop and above, and the trial is 14 days of Own, no card, so they're on record before your rates go up.

Sources#

• U.S. Attorney, N.D. Cal.: United States v. Hogan indictment (Jun 2010)
• impact.com Help Center: Last Click Credit Policy Explained, checked (Oct 2026)
• Performance Marketing Association: US brand survey results (Jul 2026)
• Rakuten Advertising: Affiliate Network Policies and Guidelines (Jul 2026)
• Partnerize: Partner Terms and Conditions (Apr 2025)
• CJ: Software Publishers Policy (Aug 2022)
• Awin: Publisher Code of Conduct, checked (Oct 2026)
• U.S. District Court, N.D. Cal.: United States v. Hogan docket (May 2014)
• U.S. District Court, N.D. Cal.: Shawn Hogan judgment (May 2014)
• U.S. District Court, N.D. Cal.: Brian Dunning sentencing minutes (Aug 2014)
• Bloomberg via The Business of Fashion: Phia took credit for sales it didn't drive (Jul 2026)
• Bloomberg via Fortune: Phia's internal messages and attribution features (Aug 2026)
• Benjamin Edelman: Forced clicks and stand-down violations (Jul 2026)
• Benjamin Edelman: On-exit clicks and cookie refreshes (Aug 2026)
• TechCrunch: Phia's response to the August reporting (Aug 2026)
• The Cool Down via Yahoo Finance: Phia's response on misattribution (Oct 2026)
• Business Insider: Phia reversals and impact.com's reprocessing window (Jul 2026)
• Creators' counsel: Honey second amended complaint (Jan 2026)
• U.S. District Court, S.D.N.Y.: RetailMeNot opinion and order (Mar 2026)
• U.S. District Court, W.D. Wash.: Microsoft dismissal order (Oct 2026)
• U.S. District Court, S.D. Ohio: Ahntourage Media v. Klarna docket (Sep 2026)
• Engadget: Phia's July report and response (Jul 2026)
• Hello Partner: Phia allegations and network responses (Jul 2026)
• CourtListener: Federal docket search for Phia (Oct 2026)
• Shub Johns & Holbrook: Potential Phia claims investigation (Aug 2026)
• Chrome Web Store: Phia listing (Oct 2026)
• impact.com: The 2025 affiliate benchmark (Feb 2026)
• PartnerCentric via Silicon UK: Conversion origination measurement (Feb 2025)
• Shopify: Affiliate Commission Guide (May 2026)
• Awin Help Center: Identifying sales that need investigation (Apr 2026)
• impact.com Help Center: Advanced Action Listing Report, checked (Oct 2026)
• Affiliate for Publicists: Phia's network-compliance response (Jul 2026)
• Chrome for Developers: Affiliate Ads policy (Mar 2025)
• Chrome for Developers: Affiliate policy enforcement update (Mar 2025)
• W3C: Content Security Policy Level 3, section 9.1, Working Draft (Sep 2026)
• Chrome for Developers: Content scripts, checked (Oct 2026)
• Chrome for Developers: chrome.tabs (Sep 2026)
• CJ Developer Portal: HTTP Response Cookie, checked (Oct 2026)
• Shopify Help Center: Measuring marketing performance, checked (Oct 2026)
• Shopify Help Center: Marketing reports, checked (Oct 2026)
• Shopify Help Center: Viewing order conversion summary, checked (Oct 2026)
• Shopify developer docs: CustomerJourneySummary (Oct 2026)
• Shopify developer docs: CustomerVisit (Oct 2026)
• Shopify developer docs: Order attribution fields (Oct 2026)
• Shopify developer docs: Legacy REST Order resource (Oct 2026)
• Shopify developer changelog: Landing-page and referrer cookie changes (Aug 2025)
• Shopify Developer Community: Staff answer on order click ids (Dec 2025)
• Shopify Help Center: Manage your custom pixels, checked (Oct 2026)
• Shopify developer docs: page_viewed event, checked (Oct 2026)
• Shopify developer docs: About web pixels, checked (Oct 2026)
• WooCommerce Developer Blog: WooCommerce 8.5.0 release (Jan 2024)
• WooCommerce: Order Attribution Tracking (Sep 2026)
• WooCommerce source: OrderAttributionMeta fields, checked (Oct 2026)
• Shopify Changelog: checkout.liquid deprecation (Feb 2023)
• Shopify developer docs: checkout.liquid, checked (Oct 2026)
• Shopify developer docs: Checkout UI extensions security (Jul 2026)
• impact.com Help Center: Performance by Full Referring URL Report, checked (Oct 2026)
• Awin Help Center: Transactions report fields (Aug 2026)
• impact.com Help Center: Using the Referring URL Parameter, checked (Oct 2026)
• Benjamin Edelman: Duplicate commission across programmes (Aug 2026)
• impact.com: Stand-Down Policy v1.0.0 (Aug 2025)
• Awin: Soft Click Policy (Aug 2025)
• impact.com Help Center: Referral Window Explained, checked (Oct 2026)
• impact.com Help Center: Action locking and payment scheduling, checked (Oct 2026)
• impact.com Help Center: Changing pending payouts before lock, checked (Oct 2026)
• CJ: Publisher Payment Cycle, checked (Oct 2026)
• Awin Help Center: Auto-validation (Oct 2026)
• Awin Help Center: Shopify auto-validation (Oct 2026)
• Awin Help Center: Commission validation and reversal limits (Jul 2026)
• Shopify Growth Center: Shopify's own affiliate compliance guidelines, checked (Oct 2026)
• Performance Marketing Association: Proposed toolbar standard (Aug 2026)
• X: Former coupon-extension builder's recollection (Jan 2025)
• Everflow: Tye DeGrange on click-to-order comparisons, checked (Oct 2026)
• Shopify Community: Merchant's sub-network traffic concern (Jan 2026)
• Hello Partner: Ishtvan Torpoi on testing coupon extensions (Jan 2026)
• Benson guide: The Honey case for merchants
• Benson guide: Creator codes and affiliate links
• Benson guide: Affiliate agreement terms
• Benson guide: Holdout measurement for coupon controls
• Benson guide: Evaluate a coupon-extension partnership
• Benson guide: Black Friday code freeze
• Benson playbook: Partner deal
• Benson: Shopify App Store listing