Cookie stuffing: the Phia case and affiliate risks

The history of the Phia case

Phia is a startup in the shopping discovery segment. It was founded by Phoebe Gates, daughter of Bill Gates, and climate activist Sophia Kianni. The platform promises users they can find products aligned with their values and preferences. However, as of July 2026, an investigation published by Bloomberg and reported by TechCrunch has raised serious accusations.

According to the investigation, Phia allegedly practiced the so-called cookie stuffing . In essence, the platform would have deposited affiliate cookies in users' browsers without them having actually interacted with a promotional link. Consequently, Phia was listed as the referrer for purchases it had not influenced in any way. Therefore, it collected undeserved commissions to the detriment of merchants and other legitimate affiliates.

At the time of publication of this article, Phia has not issued full formal denials. However, the affair has already become a case study in the performance marketing industry.

What is cookie stuffing: mechanism and anatomy of the fraud

Cookie stuffing is one of the oldest and most insidious affiliate frauds. It works by exploiting how affiliate programs track conversions. Normally, a user clicks on an affiliate link, receives a cookie in their browser, and if they make a purchase within the attribution window, the commission goes to the affiliate who generated the click.

In cookie stuffing, however, the cookie is placed without a voluntary click. This happens through hidden pixels, invisible iframes, or scripts running in the background. The user sees nothing. However, their browser now carries a cookie that attributes every subsequent purchase to the fraudulent affiliate.

In fact, the practice is particularly difficult to detect. Merchants see conversions that appear legitimate. Only a thorough analysis of logs and attribution patterns can reveal statistical anomalies. Therefore, many frauds remain invisible for months or years before being discovered.

To delve deeper into the technical mechanisms of digital fraud in advertising, the IAB glossary on ad fraud offers an authoritative and updated overview.

Winners and losers: who pays the price for cookie stuffing

Cookie stuffing is not an abstract harm. It produces concrete economic effects distributed across multiple players in the supply chain.

• E-commerce merchants pay commissions for sales they would have made anyway, without any contribution from the fraudulent affiliate. This directly erodes operating margins.
• Legitimate affiliates lose commissions that would be due to them. The fraudulent affiliate's cookie overwrites the original one, erasing the real contribution.
• Affiliate platforms suffer reputational damage. Furthermore, they risk legal disputes if they lack adequate detection mechanisms.
• Consumers do not suffer direct economic damage. However, their browsing data is manipulated without consent, with relevant implications under GDPR.

In this scenario, Phia is in the position of being accused of systematically siphoning value from other players in the ecosystem. Furthermore, its media visibility — linked to the public profile of its founders — has enormously amplified the scope of the case.

SHM Studio's reading: compliance and control as strategic priorities

The Phia case isn't an isolated incident. Similarly, in recent years, several affiliate networks have had to deal with unfair attribution practices. However, this episode has particular resonance because it involves a startup with high visibility and media backing.

We at SHM Studio we're seeing a worrying trend: many Italian SMEs running affiliate programs lack adequate auditing tools. As a result, they are potentially exposed to similar frauds without even knowing it. Therefore, the first concrete action is to equip yourself with an attribution monitoring system that goes beyond surface-level metrics.

Furthermore, the issue has a regulatory compliance dimension that should not be underestimated. The non-consensual deposit of cookies is in direct conflict with GDPR and the ePrivacy Directive. For this reason, a merchant collaborating with an affiliate practicing cookie stuffing could find themselves exposed to indirect liability, should they not have exercised due diligence on the partner.

For an in-depth look at cookie regulations in Europe, the official EDPB document on consent remains the most authoritative reference available.

What nobody tells you: attribution is still an unsolved problem

The Phia case brings an uncomfortable truth to light. Last-click attribution models, still dominant in many affiliate programs, are structurally vulnerable to manipulation. Whoever arrives last in the funnel — even fraudulently — takes credit for the entire conversion.

Therefore, the problem is not just ethical. It's architectural. As long as affiliate programs rely on simplified attributions, there will be a structural incentive for fraud. In particular, for platforms operating in discovery mode – like Phia – the temptation to inflate attribution numbers is amplified by investor pressure to demonstrate commercial traction.

Therefore, the answer can't just be regulatory. It must also be technological and methodological. Multi-touch attribution models, incremental analysis, and periodic audits of affiliate partners are concrete tools to reduce exposure. Likewise, contractual transparency with affiliate partners — clear and verifiable anti-fraud clauses — becomes an essential governance element.

On this front, research by McKinsey on performance marketing document how companies with advanced attribution models achieve significantly higher returns on ad spend.

Operational implications for Italian marketing managers

For marketing managers and digital leaders of Italian companies, the Phia case suggests some concrete priorities.

First, it's a good idea to check the list of active affiliate partners and analyze conversion patterns. Unusual spikes in attribution — especially on cookies with a very wide window — are a signal to investigate. Afterward, it's useful to compare affiliate network data with that from Google Analytics or other independent analysis tools. Significant discrepancies warrant further investigation.

In addition to this, it's worth reviewing contracts with affiliate partners. Clauses that explicitly prohibit cookie stuffing and provide for periodic audits have become a minimum governance standard. Finally, it is advisable to introduce a periodic review — at least quarterly — of affiliate performance, with specific attention to new entrants in the program.

From the perspective of channels, those who manage