Cookie stuffing: the Phia case and the risks for affiliates

The Phia case timeline

Phia is a startup in the shopping discovery segment. It was founded by Phoebe Gates, daughter of Bill Gates, and climate activist Sophia Kianni. The platform promises users they can find products aligned with their values and preferences. However, as of July 2026, an investigation published by Bloomberg and reported by TechCrunch He has made serious accusations.

According to the investigation, Phia allegedly practiced the so-called cookie stuffing. In essence, the platform allegedly placed affiliate cookies in users' browsers without them having actually interacted with a promotional link. Consequently, Phia was listed as the referrer for purchases it had not influenced in any way. Therefore, it collected commissions that were not owed, to the detriment of merchants and other legitimate affiliates.

At the time of this article's publication, Phia has not issued complete formal denials. However, the situation has already become a case study in the performance marketing industry.

What is cookie stuffing: mechanism and anatomy of the fraud

Cookie stuffing is one of the oldest and most insidious affiliate frauds. It works by exploiting how affiliate programs track conversions. Normally, a user clicks on an affiliate link, receives a cookie in their browser, and if they make a purchase within the attribution window, the commission goes to the affiliate who generated the click.

In cookie stuffing, however, the cookie is deposited without a voluntary click. This happens through hidden pixels, invisible iframes, or scripts executed in the background. The user sees nothing. However, their browser now carries a cookie that attributes every subsequent purchase to the fraudulent affiliate.

In fact, the practice is particularly difficult to detect. Merchants see conversions that appear legitimate. Only a thorough analysis of logs and attribution patterns can reveal statistical anomalies. Therefore, many frauds remain undetected for months or years before being discovered.

To delve deeper into the technical mechanisms of digital advertising fraud, the Glossary of IAB on Ad Fraud offers an authoritative and up-to-date overview.

Winners and losers: who pays the price for cookie stuffing

Cookie stuffing is not an abstract harm. It produces concrete economic effects distributed across multiple actors in the supply chain.

• E-commerce merchants paying commissions for sales that would have closed anyway, without any contribution from the fraudulent affiliate. This directly erodes operating margin.
• Legitimate affiliates they forgive commissions that would otherwise be owed to them. The fraudulent affiliate's cookie overwrites the original one, erasing the real contribution.
• Affiliate platforms they suffer reputational damage. Furthermore, they risk legal disputes if they lack adequate detection mechanisms.
• The consumers They do not suffer direct economic damage. However, their browsing data is manipulated without consent, with relevant implications under the GDPR.

In this scenario, Phia is in the position of the accused party for systematically extracting value from other ecosystem actors. Furthermore, its media visibility — linked to the founders' public profile — has greatly amplified the scope of the case.

SHM Studio Reading: Compliance and Control as Strategic Priorities

The Phia case isn't an isolated incident. Similarly, in recent years, several affiliate networks have had to deal with unfair attribution practices. However, this episode has particular resonance because it involves a startup with high visibility and media backing.

We of SHM Studio We are observing a worrying trend: many Italian SMEs managing affiliate programs lack adequate auditing tools. Consequently, they are potentially exposed to similar frauds without their knowledge. Therefore, the first concrete action is to equip ourselves with an attribution monitoring system that goes beyond surface-level metrics.

Furthermore, the issue has a regulatory compliance dimension that should not be underestimated. The non-consensual deposit of cookies is in direct violation of the GDPR and the ePrivacy Directive. For this reason, a merchant collaborating with an affiliate engaged in cookie stuffing could be exposed to indirect liability, should they fail to exercise due diligence on the partner.

For an in-depth look at cookie regulations in Europe, the Official EDPB document on consent remains the most authoritative reference available.

What no one tells you: attribution is still an unsolved problem

The Phia case sheds light on an uncomfortable truth. Last-click attribution models, still dominant in many affiliate programs, are structurally vulnerable to manipulation. Whoever arrives last in the funnel—even fraudulently—takes credit for the entire conversion.

So, the problem isn't just ethical. It's architectural. As long as affiliate programs are based on simplified attributions, there will be a structural incentive for fraud. In particular, for platforms that operate in discovery mode—like Phia—the temptation to inflate attribution numbers is amplified by investor pressure to demonstrate commercial traction.

Therefore, the answer cannot be purely regulatory. It must also be technological and methodological. Multi-touch attribution models, incremental analysis, and periodic audits of affiliate partners are concrete tools for reducing exposure. Similarly, contractual transparency with affiliate partners—clear and verifiable anti-fraud clauses—becomes an essential governance element.

On this front, the research of McKinsey on performance marketing document how companies with advanced attribution models achieve significantly higher returns on advertising spend.

Operational implications for Italian marketing managers

For marketing managers and digital leaders of Italian companies, the Phia case suggests some concrete priorities.

First of all, it is appropriate to check the list of active affiliate partners and analyze conversion patterns. Anomalous attribution spikes—especially on cookies with a very wide window—are a signal to investigate. Subsequently, it is useful to compare the data from the affiliate network with that from Google Analytics or other independent analysis tools. Significant discrepancies warrant further investigation.

In addition to this, it is worth reviewing contracts with affiliate partners. Clauses that explicitly prohibit cookie stuffing and provide for periodic audits have become a minimum governance standard. Finally, it is advisable to introduce a periodic review—at least quarterly—of affiliate performance, with specific attention to new entrants in the program.

From a channel perspective, who manages