Affiliate Tracking & Attribution · Cookies, Privacy & Disputes

Affiliate tracking records the complete journey from a user clicking an affiliate link to completing a conversion — attributing the conversion to the publisher and calculating the commission owed. The core mechanism is a unique publisher identifier embedded in the affiliate link that persists across the user's browser session until they convert or the attribution window expires.

The full tracking sequence: (1) Publisher embeds their unique affiliate link (containing their publisher ID and optional sub-tracking IDs) in their content. (2) User clicks the link. (3) The click is recorded by the network's tracking server — capturing timestamp, publisher ID, user IP, device, and browser. (4) The tracking server sets a first-party or third-party cookie in the user's browser, recording the publisher attribution. (5) User is redirected to the advertiser's website. (6) User browses and eventually completes a purchase. (7) The advertiser's conversion tracking pixel or server-to-server postback fires, sending the transaction data (order ID, order value) to the network. (8) The network matches the conversion to the publisher attribution cookie and records the commission.

Any break in this chain results in an unattributed conversion — the sale happens but no commission is recorded for any publisher. Tracking gaps are one of the most contentious issues in affiliate marketing and the subject of most publisher disputes.

Traditional affiliate tracking relies on cookies — small files stored in the user's browser that persist the publisher attribution across browsing sessions. Two types of cookies are used in affiliate tracking:

Third-party cookies are set by the affiliate network's domain (not the advertiser's domain) when the click is recorded. Because they are set by a third-party domain, they are subject to browser restrictions that have significantly reduced their effectiveness: Safari has blocked third-party cookies since 2017; Firefox has blocked them since 2019; Chrome is phasing them out. Third-party cookies that persist for longer than 7 days are also blocked in Safari's Intelligent Tracking Prevention (ITP).

First-party cookies are set by the advertiser's domain rather than the network's domain, making them more durable against browser privacy restrictions. They require technical integration between the advertiser and the network — the advertiser's website must be set up to set first-party cookies on behalf of the network. Networks like Impact and Awin have documented first-party cookie implementations that significantly improve tracking accuracy compared to third-party cookie-reliant setups.

Server-side cookie setting — where the cookie is set by a server-side redirect through the advertiser's domain rather than by JavaScript — further improves cookie persistence because it is not subject to JavaScript-blocking browser extensions or Intelligent Tracking Prevention rules.

Attribution models determine which publisher gets credit — and commission — when multiple affiliate touchpoints exist in the same purchase journey. A user might read a review on a content blog (click 1), then see a comparison on a second site (click 2), then use a voucher code from a cashback site (click 3), then complete the purchase. Standard last-click attribution credits click 3 entirely — the cashback site earns 100% of the commission despite the content blog initiating the purchase journey.

Most affiliate networks still default to last-click attribution, despite its documented limitations for rewarding content publishers fairly. Programmes that want to attract and retain high-quality content affiliates should evaluate multi-touch attribution models — the technology is available in modern platforms like Impact and Partnerize, though it requires buy-in from publishers accustomed to last-click.

The cookie window (also called the attribution window or cookie duration) is the period during which a publisher's attribution persists. If a user clicks an affiliate link and then converts within the window, the publisher is credited. If the user converts after the window expires, no commission is paid to any publisher — the conversion is unattributed.

Standard affiliate cookie windows:

• 30 days: The most common standard — represents a reasonable balance between giving publishers fair credit for initiating consideration and not paying commissions on purchases unrelated to the affiliate's promotion.
• 7 days: Used in categories with shorter consideration cycles (impulse purchases, low-value items). Also becoming more common as browser restrictions make longer cookie windows technically less reliable.
• 1 day: Used by Amazon Associates as the default window — one of the industry's most criticized attribution windows, particularly for high-consideration product categories where the purchase journey spans many days or weeks.
• 90+ days: Used in high-consideration categories (financial products, insurance, luxury goods) where the purchase journey is genuinely long and publishers reasonably expect credit for initiating consideration well before the final decision.

Apple's App Tracking Transparency (ATT) framework (iOS 14.5, released April 2021) and Intelligent Tracking Prevention (ITP) in Safari have significantly reduced tracking accuracy for affiliate programmes targeting iOS users. ITP limits third-party cookies to 24 hours from the last time a user directly visited the tracking domain — meaning a publisher who relies on 30-day cookie windows may find that iOS Safari conversions from users who did not directly visit the network's tracking domain are unattributed after 24 hours.

The practical impact: iPhone users — a significant proportion of online shoppers in many categories — are underrepresented in affiliate conversion data because their conversions are less likely to be correctly attributed. Programmes that have not migrated to first-party cookie implementations are experiencing higher rates of unattributed conversions on iOS.

The industry has developed several alternative tracking approaches that reduce or eliminate cookie dependency:

First-party cookie implementation. The most widely adopted solution — tracking cookies are set by the advertiser's domain rather than the network's domain, making them first-party cookies that are more durable against browser restrictions. Impact, Awin, and CJ all have documented first-party tracking implementations.

Click ID parameters. The affiliate link passes a unique click ID as a URL parameter. The advertiser's site stores this in a first-party cookie or passes it through the checkout flow so it can be included in the conversion postback. This creates a click-to-conversion link that does not depend on third-party cookies.

Email-based tracking. Where conversions happen through logged-in accounts or email-linked purchases, the user's email address can serve as a stable identifier for attribution — matching the publisher's click to the eventual conversion via the user's email address. This requires advertiser technical integration but provides highly accurate attribution for registered users.

Server-to-server (S2S) postback. The most robust conversion tracking method — instead of a browser-fired pixel, the advertiser's server sends a direct HTTP request to the network's server when a conversion occurs, including the click ID that was passed in the affiliate link. S2S postback does not depend on any browser environment and is completely cookie-independent.

Server-to-server (S2S) or server-side tracking is the gold standard for affiliate conversion recording because it is independent of browser privacy settings, JavaScript blocking, and cookie restrictions. In an S2S setup, the affiliate link passes a unique click ID as a URL parameter; the advertiser's website stores this click ID (in a first-party cookie, a database, or both); when a conversion occurs, the advertiser's server — not a browser pixel — sends the conversion data and click ID directly to the network's tracking server.

S2S tracking requires technical development work on the advertiser's side to implement the click ID capture and server-side postback. The investment is justified for programmes with significant mobile traffic (where browser-based tracking is least reliable) and for categories with long consideration cycles where cookie expiry is a significant tracking gap.

Tracking disputes occur when a publisher believes they drove a conversion that was not attributed to them — or when an advertiser believes they paid commission on a conversion that the publisher did not legitimately influence. Both types of dispute are inevitable in affiliate programmes and should be managed through a documented dispute process.

Publisher dispute investigation process: check whether the click was recorded in the network's click log (if no click is recorded, there is no tracking evidence to support the publisher's claim); check whether an attribution cookie was present at the time of conversion (if a cookie from a different publisher overwrote the original one under last-click rules, that should be explained); verify whether the advertiser's tracking pixel fired correctly on the confirmation page (a broken conversion pixel causes unattributed conversions across all publishers).

Advertiser dispute investigation process for suspected fraud: check click-to-impression ratios for the publisher (a publisher with huge claimed reach and almost no clicks is suspicious); check order patterns for the flagged transactions (multiple orders from the same IP address, or orders placed in the first minutes after a click, may indicate fraudulent activity); review the publisher's declared promotion methods against what tracking data suggests they are actually doing.

A user who clicks an affiliate link on a mobile phone and then completes the purchase on their desktop computer will generate an unattributed conversion in standard cookie-based tracking — the click cookie is in the mobile browser but the conversion happens in a desktop browser, and the two cannot be connected without cross-device identity resolution.

Cross-device attribution requires either: a logged-in user session (if the user is logged into the advertiser's site or the publisher's site on both devices, their identity can be bridged); email-based matching (if the user's email address is captured as part of the checkout, it can be matched to the email address collected at the click stage); or probabilistic identity matching (linking devices based on shared IP addresses, browser fingerprints, and timing patterns — less accurate but does not require a logged-in session).

The trajectory of affiliate tracking is toward server-side, first-party, consent-based approaches that are resistant to browser privacy restrictions. Programmes that have not invested in S2S tracking and first-party cookie implementation will progressively see higher rates of unattributed conversions as browser restrictions increase. The transition is not optional — it is driven by regulatory requirements (GDPR consent requirements for cookie usage), platform requirements (Apple, Google, Mozilla), and user expectations.

The silver lining of this transition: programmes that implement robust server-side tracking will see better attribution accuracy than they had with third-party cookies — because server-side postback does not depend on browser environments at all. The migration from cookie-dependent to server-side tracking, once completed, typically results in an increase in measured conversions, not a decrease, because it captures conversions that were previously lost in browser tracking gaps.

Sources & Further Reading