Quick Answer
Cookie stuffing is setting an affiliate tracking cookie without a genuine click, so a company collects commission on a sale it did not drive. Phia, the shopping plugin co-founded by Phoebe Gates and Sophia Kianni, was accused of it in July 2026, called the issue a bug, and later said the features were removed on July 7. The case matters because growth that depends on nobody noticing is borrowed, not earned.
Phia built its following on a simple job: find shoppers the lowest price and a discount code that works. According to TechCrunch, it has raised more than $40 million and takes a commission on purchases made through its platform.
The reporting that followed described something else running underneath, a set of features that claimed affiliate credit when the shopper had not clicked anything. For a founder under pressure to show growth, that story is uncomfortably familiar.
Revenue that appears in a dashboard is easy to mistake for demand that exists in a market. This covers what Phia is alleged to have done, what Phia said back, why the shortcut breaks trust, and the five checks that separate it from earned distribution.
What Phia Is Alleged to Have Done With Cookie Stuffing
Phia is alleged to have used cookie stuffing to claim affiliate commission on purchases it did not drive. The first public account was a Bloomberg investigation in July 2026. As TechCrunch summarized it, the browser extension would open a background tab, override other affiliates' referral codes and inject its own.
TechCrunch also reported that the story led to Phia's suspension from Impact.com, the affiliate and influencer platform. A network acting on traffic it can see for itself is a stronger signal than any outside commentary, including this post.
The fullest technical account is Ben Edelman's. He published his analysis of Phia's forced clicks, based on hands-on testing and code review, and followed it with a second post on on-exit clicks and cookie refreshes. Every mechanism below is his allegation, not a court finding.
1. Forced Clicks on the Checkout Page
Edelman describes a setting named enable_coupon_auto_drop in Phia's iOS app and Chrome plugin. When it was active, it invoked affiliate links without any user action, most often on a merchant's cart or checkout page, loading the link invisibly in a second tab.
In his testing, a server-side feature flag switched the setting on for iOS and left it off for Chrome. He argues that is why desktop-only fraud testing missed it, and he dates the feature to version 1.9.33, published on December 13, 2025.
2. Affiliate Links Fired When a Shopper Closed a Slider
On mobile, Edelman reports, Phia invoked its affiliate link when a shopper tapped the X to close a Phia slider, or simply tapped back onto the merchant's site. Dismissing an offer is the opposite of clicking one, which is why he treats it as a breach of the same network rules.
He dates that code to November 11, 2025. Using data from a service that tracks shopping sessions, he reports that under 10 percent of Phia's cart-page sessions included an affiliate click before then, and more than 50 percent afterwards.
3. Cookies Refreshed When a Shopper Returned
Edelman also describes code that re-invoked the affiliate link when a shopper came back to a merchant after a timeout, refreshing the cookie without a new click. He dates that change to October 7, 2025, and notes that afterwards some of Phia's affiliate links fired on the very first page of a shopping session.
4. Stand-Down Rules Ignored for Other Publishers
Affiliate network rules require a shopping plugin to stand down when another publisher referred the shopper. In one test, Edelman clicked a Savings.com link to Polaroid. He reports that Phia's own telemetry logged the competitor's affiliate cookie, and Phia then showed an offer that invoked its own link anyway.
That matters beyond the merchant. Edelman argues that every dollar taken through a stand-down violation is a dollar that would otherwise flow to another publisher.
What Phia Said Compared With What the Cookie Stuffing Reporting Alleged
Phia has disputed parts of the cookie stuffing reporting while acknowledging misattribution and committing to fixes. Its account shifted as more evidence came out, so it reads best beside the allegations rather than instead of them.
| Question | Phia's Account | Reporting and Edelman's Analysis |
|---|---|---|
| What caused it | A bug, per a spokesperson in July | A feature that could be switched on and off (Bloomberg) |
| How long it ran | A recent release | Roughly seven months from December 2025 (Edelman) |
| When Phia learned of it | When Bloomberg reached out | As far back as December (Bloomberg, August) |
| What has been done | Features removed July 7, reversals under way | Suspension from Impact.com (TechCrunch) |
In a statement to TechCrunch, a Phia spokesperson said: "Any features causing misattributions were immediately removed over a month ago on July 7."
The same statement said Phia had begun issuing transaction reversals to brand partners and was hiring a head of compliance.
Phia also told Bloomberg it rebuffed some of the claims and would "learn from this."
Bloomberg's August report, as TechCrunch described it, said Gates and Kianni knew about the practice as far back as December, based on leaked Slack messages and people familiar with the matter.
Why Cookie Stuffing Breaks the Trust a Startup Grows On
Cookie stuffing breaks trust because it takes credit for a sale instead of causing one, and every party that pays for that credit eventually checks. The five reasons below apply to any startup, not only to shopping plugins, and each comes with a check you can run on your own growth this week.
1. It Moves Commission Instead of Creating Demand
Edelman states the basic bargain plainly: "an affiliate earns a commission only if it presents an offer, the user clicks, and the user purchases."
Cookie stuffing removes the middle step, so the purchase happens exactly as it would have and only the name on the commission changes.
In his analysis, merchants are the main victims, because they pay commission on traffic they would have received anyway through their reputation or their search presence. A shopper who was already at checkout produces no new sale, only a new invoice.
The check is incrementality. Turn the mechanism off for a sample and see if sales fall, or only credited sales fall.
Edelman's tracking data shows the pattern. With both features disabled, the share of Phia's cart sessions with an affiliate click fell back below 10 percent, where it sat before they launched. The common mistake is reading attributed revenue as proof of demand, when attribution only records who claimed the sale.
2. It Only Works While the Mechanism Stays Hidden
A legitimate growth mechanic survives being explained to the person it affects. The alleged Phia features did the opposite. A link loaded in a tab the shopper never saw, and in Edelman's reading of the code, a dismissal was logged as a dismissal while an affiliate link fired anyway.
He also reports the forced clicks ran on iOS and not on Chrome, which kept them away from the desktop testing many fraud checks rely on. Device-specific behavior is not proof of intent on its own, but a mechanism that works best where auditors are not looking is the pattern to worry about.
To run the check, write one paragraph describing the mechanic to the shopper, the merchant and the network. Then ask if each of them would still agree to take part, or to pay.
The common mistake is running this test internally, where everyone already knows the rationale and nobody plays the party being billed. Hand the paragraph to someone outside the growth team and let them ask the awkward question.
3. The People It Costs Keep Records and Have Motives
Cookie stuffing costs merchants, other publishers and networks, and each of them holds data you cannot see. Edelman's stand-down test needed nothing more than a Savings.com link, a Polaroid cart and a traffic capture, and he says several people had reported Phia to networks before the story broke.
The same dynamic runs through the case against Honey, the PayPal-owned coupon extension, which TechCrunch notes remains the subject of an ongoing class action lawsuit. Publishers who lose commission have both the logs and the motive to pursue it.
The check is to list every party whose ledger your growth touches, then ask what their data would show if they went looking. Start with the partner who loses the most if your numbers are wrong.
The common mistake is assuming a network review settled the question. Edelman's point is that a review can fail to find a violation without proving there is none.
4. It Corrupts the Numbers You Use to Steer
A growth shortcut misleads the team running it as well as its partners. If a large share of revenue is credit that was not earned, every decision built on it rests on a number that disappears when the mechanism stops. That includes hiring, fundraising and pricing.
TechCrunch, summarizing Bloomberg's August report, says cookie stuffing made up a good chunk of Phia's sales and that the company saw a sizable drop in daily revenue once it stopped. That is the drop every shortcut is quietly scheduling.
The check is to report revenue two ways every month: everything attributed, and only what you can trace to a deliberate action by the buyer. When the two lines pull apart quickly, the gap is the number to explain before a board or an investor asks about it.
The common mistake is celebrating the first line and never building the second. By the time someone outside the company builds it for you, the explanation is no longer yours to give.
5. The First Explanation Becomes a Second Problem
Once a shortcut is exposed, the first public explanation gets tested against the evidence, and a weak one extends the story. Phia's early description of a problem in a recent release was disputed by Edelman, who pointed to a feature named auto_drop that had shipped months earlier.
Bloomberg's August reporting then described a feature that could be switched on and off, and the coverage moved from the product to what the founders knew. A statement meant to close the story opened a second one.
The check is to write the disclosure before you ship the feature, as if it has already been found. If the honest version is not a statement you would publish, the feature is not one you should ship.
The common mistake is treating communication as damage control after the fact. Used before launch, the draft disclosure is the cheapest compliance review a startup will ever run.
The Same Growth Shortcut Appears in Search and B2B Pipeline
Cookie stuffing is an affiliate term, but the shortcut behind it, claiming credit or visibility without earning it, shows up wherever a third party relies on your numbers. Search and B2B pipeline are where founders meet it most often.
Google's spam policies name the search version directly, including hidden text and link abuse, sneaky redirects and scaled content abuse. An AI SEO service that promises citations in ChatGPT or Google's AI answers through hidden text or bulk-generated pages is selling the same bargain: results that last only while nobody looks closely.
The durable version is slower and much less mysterious. Better Marketing's AI SEO service starts with pages a crawler can read and a buyer would quote, so any citation that follows can be explained in one sentence.
In B2B the shortcut is attribution rather than cookies. A B2B demand generation agency that counts every form fill touched by any campaign it ran can report pipeline a buyer would never recognize as its doing.
Ask it the question Phia's partners are now asking: which of these leads would not exist without the work, and how do you know? If you are shortlisting agencies, what a demand generation agency costs is a useful place to start pricing that work honestly.
Earned Distribution Compared With Cookie Stuffing as a Way to Grow
Earned distribution grows more slowly than cookie stuffing and keeps growing under scrutiny, which is the whole trade. The table sets the two side by side on the questions a merchant, a network or an investor would ask.
| Question | Cookie Stuffing | Earned Distribution |
|---|---|---|
| What creates the sale | Credit claimed at checkout | A buyer who chose to act |
| Who can see how it works | Only the company running it | The buyer, the partner, the public |
| What an audit does | Commission can be reversed | Nothing changes |
| What it builds over time | Exposure to claims | An audience that returns |
| How fast it shows up | Immediately | Over months |
For a software company, earned distribution usually means content marketing for tech companies: articles, founder posts and newsletters a buyer can trace back to the moment they decided to talk to you. How Plausible grew on published, checkable numbers is a good example of a product whose growth anyone could inspect.
Before you scale any growth mechanic, run it through five questions:
- Would it survive a journalist or a network reviewing it line by line?
- Does it create a purchase, or reassign credit for one that was already happening?
- Did the party paying for the result knowingly agree to the mechanism?
- Does it behave the same on every device and for every tester?
- Could you describe it in one paragraph without sounding evasive?
A mechanic that fails any one of them is a liability with a revenue line attached. Content marketing for tech companies, done honestly, passes all five, which is why it compounds instead of unwinding.
When Aggressive Attribution Is Not Cookie Stuffing
Not every attribution fight is cookie stuffing, and treating it that way makes the term useless. A shopping plugin that shows an offer, gets a real click and stands down for other publishers is doing affiliate marketing as the rules describe it. A merchant may dislike paying for it, and it is still not fraud.
Credit disputes between legitimate partners are usually a contract question, not fraud, because two publishers can both influence one sale. The line Edelman draws from the network rules is narrower: did the shopper knowingly take the action that set the cookie?
The visibility test does not mean growth has to be dull, either. Referral programs, founder outreach and newsletters can all move quickly, as long as the person on the other side can see what happened and why.
Run the Visibility Test Before Shipping a Growth Feature
Before any growth feature ships, describe it to the party who pays for its results and ask if they would still agree. Cookie stuffing fails that test in its first sentence, and so does any mechanic that only works while it stays hidden.
Growth your buyers can trace is slower, and it survives every audit. Better Marketing builds that kind of pipeline from founder-led content and outreach, and any B2B demand generation agency worth hiring should show you the path behind every lead it claims.