Cookie Stuffing

Cookie stuffing is dropping an affiliate tracking cookie onto a visitor's browser without a genuine click or their knowledge, so that if the visitor later buys something on the merchant's site, the fraudster's affiliate account gets credited and paid, even though it did nothing to influence the sale.

How it works#

A legitimate affiliate cookie gets set when a user actually clicks an affiliate link and lands on the merchant's site. Cookie stuffing fakes that step: hidden iframes, forced pixel redirects, or malicious browser extensions silently fire the tracking request in the background while the visitor is doing something else entirely, often on a page that has nothing to do with the merchant. The cookie lands, the visit never happened, and the affiliate account collects a commission on any purchase that visitor makes within the attribution window, whether or not that purchase had anything to do with the stuffed link.

Why networks ban it outright#

Affiliate networks generally treat cookie stuffing as a ban-level offense, not a warning-level violation, because it directly steals commission from whichever legitimate channel (paid search, a real referral, organic) actually drove the sale. Merchants lose trust in their own conversion tracking data once stuffed cookies are in the mix, since the numbers stop reflecting what real marketing spend produced.

How it differs from legitimate tracking#

Real affiliate tracking requires a user-initiated click that redirects through a tracking pixel or redirect chain the visitor can see happening, even if it's fast. Cookie stuffing skips the click entirely and tries to hide the redirect. It's a close cousin of click fraud, but where click fraud fakes the click itself (often with bots), cookie stuffing skips the click and fakes only its side effect, the cookie.

Warning signs for merchants and competitors#

A merchant reviewing its own affiliate reports usually spots cookie stuffing through a mismatch: an affiliate showing steady, sizeable commission with essentially no visible referral traffic in analytics, or a spike in conversions immediately after adding a new affiliate whose actual promotional presence (a site, a social account, an ad account) can't be found anywhere. Competitive researchers looking at a market from the outside, checking who's actually running paid creative for a brand, rely on the same logic in reverse: if a competitor's conversions are climbing without any matching increase in visible ad spend across the networks you'd expect, that's worth investigating rather than assuming.

Related terms#

Cookie stuffing is one of several tactics networks group under attribution fraud alongside click fraud. If you're auditing a competitor's funnel or reporting a scam ad, stuffed-cookie schemes usually surface as sudden, unexplained commission spikes with no matching traffic to justify them; cross-checking against an index of captured ads like OpenAdLibrary is one way to see whether a suspiciously high-converting affiliate shows any visible creative at all.