Become an affiliateStart your program

Traffic and channels

Cookie stuffing

Also called cookie dropping, forced clicks, cookie planting, forced cookies.

Short answer

Cookie stuffing is fraud in which an affiliate plants tracking cookies or click IDs on users who never clicked an affiliate link. The affiliate then appears to be the source of purchases they had no part in.

Definition of Cookie stuffing.

Cookie stuffing exploits the fact that in many setups an affiliate click is just an ordinary HTTP request. If that request is triggered automatically – from a hidden iframe, a 1 by 1 pixel image, a script or a redirect the user never sees – the tracking is set anyway. The user has not seen any link and does not know that a click has been recorded in their browser.

The aim is to capture conversions that others have created. The more browsers carry the fraudster's click ID, the greater the chance that some of them will buy anyway within the attribution window. Under last-click attribution, the fraudster does not need to persuade anyone of anything – it is enough to be last in line when the order is placed.

Contractually, it is a breach of the program terms and leads to exclusion and forfeiture of earned commission. If money is paid out on the basis of clicks generated without any action by the user, it may, depending on the circumstances, also constitute fraud, but that assessment belongs with the police and the courts, not with the network.

What cookie stuffing looks like in the data

The pattern is rarely subtle. Click volume is wildly out of proportion to the affiliate's visible traffic, the conversion rate is extremely low because the count is full of clicks no human made, and the clicks that do become sales often have a striking time between click and purchase – either seconds or several weeks.

Other signals: clicks without a referrer, the same referrer across thousands of users, clicks on several different programs from the same session, and an overrepresentation of buyers who land directly on the store's homepage instead of on a product page.

Browser extensions are the tricky variant

An extension the user has installed themselves can sit in the browser and call affiliate redirects in the background every time the user visits an online store. The line between a discount extension the user actively triggers and an extension that puts itself last in the queue without asking lies in the active choice. If the choice is not visible, it is stuffing with a nicer name.

How it goes wrong

  • 01

    Innocent setups look like fraud

    Prefetching, link previews and security scanners can fetch an affiliate redirect without a human having clicked. Volume alone therefore proves nothing. It is the relationship between clicks, sessions and conversions that reveals the pattern.

  • 02

    The affiliate is liable for third-party code

    If you run ad networks, widgets or borrowed scripts on your site, they can set clicks in your name without you noticing. You are still the one the program excludes.

  • 03

    Money is paid out before the pattern is spotted

    Stuffing often pays in the first weeks, precisely because the early figures look like growth. The checks must come before the payout, not after.

At Affilyflow

Cookie stuffing in practice

Affilyflow does not have a fraud engine that identifies cookie stuffing on its own. What it does have is the material needed to detect it: every tracking event is logged, including those that did not become a sale, known bots get neither click recording nor attribution, and the same order can never count twice thanks to deduplication on order ID per program.

No conversion credits a balance automatically. Everything is created as pending, the store has the program's approval period (30–90 days) to reject with a reason the affiliate can read, and a blocked affiliate cannot earn, regardless of which route the sale comes in by.

Frequently asked questions

Is cookie stuffing illegal?

In any case it is a breach of the program terms and leads to exclusion and forfeiture of commission. Whether it is also criminal fraud depends on the specific case and is decided by the police and the courts.

How do you detect cookie stuffing?

You compare clicks, sessions and conversions instead of looking at a single figure. Large volumes of clicks without corresponding visits, a very low conversion rate and clicks without a referrer are the clearest signals.

Can I end up cookie stuffing by accident?

Yes. Widgets, ad scripts or extensions on your site can trigger affiliate redirects without you having asked for it. Open the network tab in your browser's developer tools and look for redirects that are called without you clicking.

What happens to the commission if an affiliate is caught?

Sales that have not yet been approved are rejected with a reason, and the account is blocked. A blocked account cannot earn anything further, regardless of which route a sale might come in by.

Read on