Newsroom live
AFFHOUSE
Get the brief
Latest
Sweepstakes casino bans: what operators and affiliates facedStake sponsorship case: Everton, UFC, F1 and KickSportsbook marketing: what DraftKings and FanDuel spendSaaS Affiliate Programs: A Blogger's $680K Semrush CaseRobux gambling ruling: why affiliates are exposedPrizePicks: how DFS pick'em became a $2.5bn US businessPopunder Ads Case: $30K in MENA, 1,536 iGaming FTDsPlayer lifetime value case: $9,125 in CPA, $61,376 GGR
Knowledge base9 min read

What is cookie stuffing? How it steals affiliate commissions

Cookie stuffing plants an affiliate cookie without a real click, so the stuffer takes last-click credit for sales it did not drive. Mechanics, cases, law and detection.

Published Updated

Chocolate-chip cookie broken open to reveal a hidden circuit board inside, under the words Cookie Stuffing Steals

Cookie stuffing is placing an affiliate tracking cookie in a visitor's browser without a real click or any intent to buy, so the stuffer collects last-click commission on sales it did not drive. The merchant pays for a customer it would have won anyway, and the affiliate who actually referred the buyer loses the commission.

It is a long-running form of affiliate fraud that has moved from hidden page code to browser extensions.

In affiliate marketing and performance advertising, a tracking cookie should record one fact: a person chose to click a partner's link. Cookie stuffing cuts the tie between that choice and the credit. The cookie, or the tag doing its job, is set by code the visitor never sees.

As a working definition, it covers any method that drops or overwrites an affiliate identifier without a genuine user action. It is also called cookie dropping or cookie forcing.

The damage outlasts any single sale: the program's reports reward the wrong partner, so budget and better terms flow toward the fraud.

How affiliate attribution works, and why stuffing pays

The visitor clicks a tracking link carrying the affiliate's ID. The tracking server logs the click and stores the ID in a cookie or as a click ID. If the visitor buys or signs up inside the program's lookback window, the sale is matched to that ID. Whether the deal is a flat CPA or a revenue share (how those models differ), this record decides who gets paid.

Many programs credit only the last affiliate click before the sale, so a newer cookie replaces an older one. That is what makes stuffing pay. The stuffer persuades no one; it only needs its ID in the browser before a purchase that was going to happen.

Say a reader picks a sportsbook from a review site's comparison table and starts signing up. At the deposit step, a coupon extension silently fires its own affiliate link. Under last click, the extension's owner is paid for the deposit and the review site gets nothing.

Cookie stuffing hides in page code, widgets, redirects and software the visitor never notices. These are the patterns compliance teams watch for, described so they can be recognised, not copied.

  • Hidden page elements. Invisible images, zero-size frames or scripts that call a tracking URL in the background.

  • Free tools and widgets. Code bundled into a widget other site owners embed, so visits to their pages fire the stuffer's link. This was the eBay method.

  • Forced redirects, pop-ups and pop-unders. The visitor passes through a tracking link they never chose.

  • Browser extensions and apps. Software that adds an affiliate tag, or swaps an existing one for its own, on a store page or at checkout. The Honey and Phia allegations concern this pattern.

  • Lookalike domains and link spam. Typo domains and forum or comment links that route through a tracking URL.

The three are often lumped together but show up differently in the data.

Cookie stuffingClick spammingClick injection
What happensAn affiliate cookie or tag is set or replaced without a real clickMasses of fake clicks are reported in the hope some users convert later on their ownMalicious app code fires a click just before an install finishes
WhereWeb affiliate programs, browser extensionsApp install and web campaignsApp install campaigns
In the dataClicks without impressions or referrers; conversions minutes after a click from shoppers already on the siteBursts of clicks with almost no conversions, and no clustering around a typical click-to-conversion delayInstalls that land almost instantly after the credited click

The documented cases range from prison sentences (eBay) to a pending lawsuit (Honey) and a press report (Phia).

eBay: the case that ended in prison sentences

According to the US Attorney's Office for the Northern District of California, Brian Dunning admitted that between about May 2006 and June 2007 he ran a cookie stuffing scheme against eBay's affiliate program through his company, Kessler's Flying Circus. Free applications on two of his websites carried code that gave visitors' browsers a cookie with the company's affiliate ID, although they had not clicked an eBay link.

He pleaded guilty to wire fraud in April 2013. The company's eBay commissions for the period came to about $5.2 million, and both sides stipulated that $200,000 to $400,000 of that came from the scheme. In August 2014 he was sentenced to 15 months in prison; no restitution was ordered because of a separate civil settlement with eBay.

Shawn Hogan, another eBay affiliate prosecuted over cookie stuffing, pleaded guilty to wire fraud and was sentenced in May 2014 to five months in federal prison, according to press coverage.

Honey (PayPal): allegations in a pending lawsuit

Starting in late 2024, online creators sued PayPal in federal court in California (now consolidated as In re PayPal Honey Browser Extension Litigation, No. 5:24-cv-09470). They allege that the Honey extension replaced their affiliate tracking with PayPal's own at checkout, taking last-click credit for sales they had referred. Their amended complaint calls this cookie stuffing through redirects. PayPal disputes the claims.

In 2025 the court dismissed the first complaint with leave to amend. On June 22, 2026, Judge Beth Labson Freeman denied PayPal's motion to dismiss the second amended complaint. Neither ruling decides whether the allegations are true.

Phia: a 2026 report

In July 2026, Bloomberg reported, as Engadget relayed it, that Phia, an AI shopping app and browser extension co-founded by Phoebe Gates and Sophia Kianni, had attached its affiliate code to sales it did not drive. Engadget described a video by researcher Ben Edelman showing Phia's affiliate link "invisibly loaded into a second tab" on iOS after a user visited a merchant's website. Phia told Bloomberg that "in a recent release our codebase was causing misattributions" for a subset of users, and said the issue was resolved. This is press reporting, not a legal finding.

Cookie stuffing can be illegal, and how serious it gets depends on the layer: contract, platform rules, civil claims or criminal law.

  • Program terms. Affiliate agreements generally prohibit it; a breach usually means reversed commission and a closed account. Some name it outright, such as a Staples agreement quoted in the Honey complaint. Amazon's Associates Program Policies bar opening an Amazon page other than through a customer's click on a Special Link, Special Links in pop-ups or pop-unders, artificially generated clicks, and Special Links in browser extensions.

  • Platform rules. The Chrome Web Store affiliate ads policy, updated in March 2025, requires a related user action before an extension adds each affiliate code, link or cookie, and bars replacing an existing affiliate code without the user's explicit knowledge.

  • Civil claims. Merchants or displaced affiliates can sue for fraud, breach of contract or unfair competition. eBay settled civil claims with Dunning, and the Honey creators rely in part on California's unfair competition law.

  • Criminal law. In the eBay case, prosecutors charged cookie stuffing as federal wire fraud under 18 U.S.C. 1343. Criminal cases are the exception; most disputes end at the program or civil level.

This is a general summary, not legal advice.

Cookie stuffing is detected through patterns across many conversions, not one odd sale. Programs and networks check:

  • Click-to-conversion time. Conversions bunched seconds or minutes after the click, especially when the session began on the merchant site through another channel.

  • Clicks without exposure. No matching impression, no referrer, or a referring page with no visible link.

  • Conversion rates that do not fit. A partner's conversion rate or EPC jumps with no change in traffic. Stuffing at volume shows the opposite: a click count far out of proportion to sales.

  • Overwrite patterns. One partner keeps appearing as last click minutes after another partner's click.

  • Customer mix and clusters. An unusually high share of returning customers, or clicks clustered on the same IP ranges, user agents or data centers.

  • Test journeys. Purchases in clean browsers and with popular coupon extensions installed, checking whose ID reaches checkout.

Casino and sportsbook programs pay per first deposit or as a share of player revenue, so a stuffed cookie makes the operator pay acquisition money for a player its own brand advertising would have brought in. Affiliate terms in other industries, such as the Amazon and Staples terms above, ban these methods, and iGaming programs generally follow the same pattern. Check the prohibited-traffic and commission-reversal clauses of each program you join.

In regulated US states the affiliate is a regulated party too. New Jersey's Division of Gaming Enforcement registers or licenses affiliates that market for online casinos, and Pennsylvania requires online casino affiliates to hold certification or registration, depending on how they are paid. There, a fraud finding can become a licensing question, not only a contract dispute.

The first step is evidence: timestamps, click IDs and test journeys that show whose tag reached checkout.

If you are an affiliate:

  • Track commission per merchant against clicks. Falling commissions on steady clicks are the first sign of being overwritten.

  • Test your links with common coupon and cashback extensions installed, and check whether your tag reaches checkout.

  • Keep timestamps, click IDs and screenshots, and send them to the affiliate manager or network compliance team.

If you run a program:

  • Review top partners monthly on click-to-conversion time, new-customer share and referrers.

  • List the banned methods in your terms, including software that adds or replaces tags without a user action.

  • Hold payouts long enough to review, and audit coupon and cashback partners separately.

Yes, because the target is the click record, not the cookie. Browsers have tightened cookie rules for years, and many programs now store a click ID and confirm conversions through postback tracking. That changes the mechanics, not the incentive. Software that opens a tracking link in a hidden tab, the pattern described in the Phia report above, produces a click that looks real to the tracker.

FAQ

Cookie stuffing breaches affiliate program terms and can support civil claims. In the eBay case, US prosecutors charged it as federal wire fraud and two affiliates were sentenced to prison.

The best-known cookie stuffing example is the eBay case: in 2006 and 2007, an affiliate's free web tools set his company's eBay cookie in visitors' browsers without any click on an eBay link. He pleaded guilty to wire fraud in 2013.

Cookie stuffing shows up as conversions seconds after a click, clicks without impressions or referrers, and one partner repeatedly overwriting another just before checkout.

Cookie dropping is usually another name for cookie stuffing. Click spamming floods a tracker with fake clicks to claim conversions later, mostly in app campaigns.

Can browser extensions stuff cookies?

Browser extensions can stuff cookies by adding or replacing affiliate tags at checkout, which Chrome Web Store policy forbids without a related user action.

Cookie stuffing adapts to a world without third-party cookies. With click IDs and server-to-server tracking, the attack shifts to generating clicks through hidden tabs, redirects or extensions.

Sources

Keep reading

All knowledge base →