Cookie stuffing: the Phia case and the risks for affiliate marketing

Updated on October 15, 2026

Phia's daily revenue collapsed from $80,000 to under $28,000 as soon as the fraudulent feature was switched off. That difference was affiliate commissions the platform collected without earning them, and it could happen in your program too, without you noticing.

Does this problem really affect me, or is it just an American story?

If you run an affiliate program or invest budget in performance marketing, cookie stuffing affects you directly: the affiliate channel has a global fraudulent traffic rate of 9.09%, and the budget drained in silence can reach 15-25% of affiliate spend.

The Phia case broke in the United States, but the mechanics of the fraud know no borders. In Italy, according to data from the Osservatori of Politecnico di Milano and Netcomm, B2C product e-commerce reached €40.1 billion in 2025, with over 91,000 companies active with their own website. Many of them use affiliate programs to acquire customers. All of them are potentially exposed.

The question isn't whether cookie stuffing exists in your market. The question is whether you have the tools to see it.

What really happened with Phia?

Phia, a shopping discovery startup founded by Phoebe Gates and Sophia Kianni, was accused of dropping affiliate cookies into users' browsers every two hours across more than 50 sites, without those users having clicked any promotional link. The founders had known about the practice for at least seven months before claiming they had discovered it in the last 24 hours.

The investigation, published by Bloomberg and picked up by TechCrunch, reconstructed the mechanism in detail. The enable coupon auto drop feature was set up to automatically drop an affiliate cookie every two hours. The result: Phia appeared as the referrer for purchases it had no part in influencing, and collected the related commissions.

According to TechTimes and Bloomberg, the co-founders had known about the problem since December 2025. The public statement that they had discovered it "in the last 24 hours" came seven months later.

The story gained extra resonance from the founders' public profile. But the technical mechanism is identical to the one dozens of anonymous affiliates use every day. The Phia case has become a reference point in the performance marketing industry precisely because it made visible a practice that normally goes unseen.

How does cookie stuffing work? The mechanism explained without jargon

In a normal affiliate program, the commission goes to whoever generated the click that led to the purchase. In cookie stuffing, the cookie is dropped into the user's browser with no click at all: the user sees nothing, but their browser now attributes every later purchase to the fraudulent affiliate.

A cookie is a small file that the browser saves to remember where a user came from. Affiliate programs use these files to work out who brought in a customer and pay the right commission. The system works well when the user actually clicks a promotional link.

Cookie stuffing breaks this logic. The cookie is dropped through hidden pixels, invisible iframes (page windows the user never sees) or scripts running in the background. The user does nothing. But their browser now carries a label that says: “this customer came through affiliate X.” Any later purchase, even one the user would have made anyway, earns that affiliate a commission.

The structural problem is the last-click attribution model: whoever arrives last in the purchase journey, even fraudulently, takes the credit for the entire conversion. As long as this model dominates, there is a financial incentive to commit fraud. To see how automation can instead help detect anomalies in your data, it’s worth reading about how AI agents in business workflows work: the same automated monitoring principles apply to auditing affiliate conversions.

Who pays the real price of this fraud?

The damage spreads across the whole chain: the merchant pays commissions it doesn’t owe, the legitimate affiliate loses theirs, the platform risks disputes, and users see their browsing data manipulated without consent.

The financial damage is far from negligible. According to 24metrics data, the affiliate budget drained by cookie stuffing can reach 15-25% of a program’s total spend, without generating any real value. A single fraudulent cookie can be worth $50 to $100 in commission, far more than a single ad impression in display advertising.

There is also a legal dimension that is often underestimated. Dropping cookies without consent is in clear conflict with the GDPR (the European data protection regulation) and the ePrivacy Directive. A merchant that works with an affiliate practicing cookie stuffing could be exposed to indirect liability if it hasn’t carried out due diligence on the partner.

How widespread is this fraud in the affiliate channel?

The affiliate channel has a fraudulent traffic rate of 9.09% globally, according to the Opticks Ad Fraud Report 2025, based on 2 billion clicks. Affiliate fraud costs advertisers $3.4 billion a year, equal to 17.3% of global spend in the channel.

The Phia case is not an exception. The best-known precedent is PayPal Honey: the browser extension lost over 6 million users in a few months (from 20 to 14 million Chrome users by July 2025) and faced a class action of over $5 million, according to data reported by 24metrics. In March 2025, Google updated the Chrome Web Store policies, explicitly banning extensions from claiming affiliate commissions without providing real discounts.

A TrafficGuard audit of a large food retailer with over 7 million customers found that, out of nearly 8,000 conversions analyzed in one month, over 30% were affected by invalid traffic or malicious intent. About 25% of these problematic conversions were caused by cookie stuffing. Numbers that show why the issue has become a priority for technology platforms too.

Three real-world scenarios: how much does cookie stuffing cost an Italian e-commerce business?

An online store with €500,000 in annual affiliate spend can lose between €75,000 and €125,000 in commissions it doesn’t owe. The loss is silent: reports show conversions, but they don’t tell you whether they were truly earned.

The figures below are illustrative scenarios built by applying the fraud rates documented in the Opticks Ad Fraud Report 2025 to typical budgets of Italian companies. The numbers are meant to show the calculation; they are not real client data.

How do you detect cookie stuffing: which tools and approaches exist?

No single tool solves everything, but combining independent monitoring, cross-checking data sources and periodic partner audits drastically reduces your exposure.

The most accessible starting point is to compare your affiliate network data with an independent analytics tool such as Google Analytics. If the conversions attributed to the affiliate channel in the platform's report are significantly higher than what Analytics records as affiliate traffic, something needs investigating.

The issue is tied to corporate data governance: the same principles that guide responsible AI adoption (transparency, audits, human oversight) apply to managing affiliate programs. It's no coincidence that the debate on AI governance and cyber risks touches the same sore spots: whoever controls the data controls the outcome.

What legal rules and risks should you watch for?

Placing cookies without consent violates the GDPR and the ePrivacy Directive. A merchant that hasn't done due diligence on its affiliate partners can face indirect liability, even if it isn't the one committing the fraud.

The GDPR (General Data Protection Regulation) requires users' explicit consent before non-technical cookies are placed in their browser. Cookie stuffing violates this rule by definition: the cookie is placed without the user knowing anything, let alone giving consent.

For an Italian merchant, the risk isn't just reputational. If a supervisory authority (such as the Garante Privacy) found that an affiliate partner placed non-consensual cookies on Italian users, and that the merchant had not put adequate controls in place, liability could extend to the merchant. Due diligence, meaning the upfront vetting of partners, is no longer just good practice: it's an essential element of governance.

The Phia case, as documented by CIPA World, also shows a often-underestimated risk: internal awareness. If a company's managers knew about the practice for months and did nothing, the reputational damage multiplies. Governance isn't just a technical issue: it's a matter of company culture.

How to get started: the steps to protect your affiliate program

You start by comparing affiliate platform data with Analytics data, identify the anomalies, update your contracts and introduce a periodic audit. Four steps, and none requires advanced technical skills.

What mistakes are most common in managing an affiliate program?

The most common mistake is relying solely on the affiliate platform's reports without checking them against independent sources. The second is having no anti-fraud clauses in your contracts, which makes it impossible to recover commissions.

Working with Italian e-commerce businesses of different sizes, we've seen a recurring pattern: the affiliate program is set up once and then monitored only on surface metrics (number of conversions, cost per acquisition). Nobody looks at attribution patterns over time, nobody compares the data with Analytics, nobody reads the partner contracts.

This isn't a skills problem: it's a process problem. The same approach that leads a company to introduce structured processes for launching products with AI should apply to governing the affiliate channel: checklists, review cadences, clear responsibilities.

How can you tell if your affiliate program is running clean?

Three indicators are enough for a first check: consistency between affiliate platform data and Analytics data, each partner's conversion rate compared to the average, and the absence of anomalous attribution spikes on cookies with a long window.

Ongoing monitoring doesn't necessarily require expensive tools. For many Italian SMEs, a spreadsheet updated monthly with data from the two main sources (affiliate platform and Analytics) is already a significant step forward from where they are today. What matters is that it becomes a process, not an occasional task. The same principle applies if you're considering how to integrate AI into business processes: ongoing governance matters more than the tool you choose.

So, is cookie stuffing a risk worth tackling right now?

Worth it if you have an active affiliate program with more than 5 partners and a budget above 50,000 euros a year. The risk is real, and the cost of an audit is far lower than the potential loss.

A middle ground: your affiliate program is small (under 50,000 euros) but you're planning to expand it. Start building governance processes now, before volume makes the problem more expensive to manage.

Not yet if you don't have an active affiliate program yet. But if you're thinking of launching one, start with anti-fraud clauses in your contracts and an independent monitoring system: it's much easier to do it from the start.

How we see it at SHM

For us, the Phia case isn't just an American startup story. It's a reminder of what happens when technology is separated from responsibility. AI and automation can do extraordinary things, and we see it every day in the projects we work on, but without governance they become tools of harm, not of value.

We believe technology is the means and people are the end. An automated system that drops cookies every two hours across 50 sites is technically sophisticated. But it's designed to take value, not to create it. The difference lies in the choices of those who build it and those who oversee it.

With the companies we work with, we build strategic AI integration processes that always include a layer of audit and human oversight. The same approach applies to affiliate programs: setting up the channel isn't enough, you have to keep watch over it. If you want to understand how to structure a monitoring system for your affiliate program, or how to integrate data processing and business intelligence tools to detect anomalies in real time, we're happy to think it through together on your specific case. You can also explore our hub on AI and process automation for more practical insights.

The affiliate channel works. But it only works if it's clean.

Frequently Asked Questions

Cookie stuffing isn't a technical problem: it's a problem of those who choose not to look.