Affiliate tracking works by assigning each affiliate a unique link. When someone clicks that link, the platform drops a cookie in their browser and records the click. If that visitor buys within the cookie window, the platform credits the sale to that affiliate and queues a commission. The whole thing happens in milliseconds, and most of the time you’ll never know it occurred.
That’s the clean version. The messier version is that cookies expire, browsers block them, iOS updates break them, and someone buying on their laptop after clicking on their phone won’t always get credited at all. Understanding where the gaps are is the difference between a tracking system that mostly works and one you can actually trust.
What actually happens when someone clicks an affiliate link
Every affiliate gets a unique URL from your tracking platform. It usually has a parameter in it like ?ref=affiliatename or a subdomain like affiliatename.yourdomain.com. When someone clicks that link, a few things happen at once.
The tracking platform logs the click and records where it came from. It also drops a tracking cookie in the visitor’s browser. That cookie is a small file that says, in effect, “this person came here through affiliate X.” If the visitor completes a purchase before that cookie expires, the platform reads the cookie, confirms the attribution, and credits the affiliate’s account.
Most platforms also fire a tracking pixel on the thank-you or confirmation page after a purchase. The pixel is a tiny, invisible image file that pings the tracking server when it loads. That ping carries the order data, matches it against the stored cookie, and records the conversion. Your tracking platform ends up with a complete record: this affiliate sent a click, that click led to a purchase, here’s the commission owed.
On cookie-based systems, the tracking platform reads the cookie on the buyer’s device at the moment of purchase. On server-side systems, the attribution happens on your server instead of in the browser, which makes it harder for ad blockers and privacy tools to interfere. More on that in a minute.
Choosing the right software matters more than most new program managers realize. Best Affiliate Program Software: How to Choose the Right Platform breaks down the major options, what each one does well, and the tracking differences between in-house systems and networks.
Cookie tracking vs. server-side tracking: what’s the difference
Cookie-based tracking has been the standard for over 20 years. Your tracking platform drops a first-party or third-party cookie in the visitor’s browser when they click an affiliate link. The cookie stores the affiliate ID, the timestamp, and sometimes campaign data. When the visitor converts, the platform reads that cookie and credits the right affiliate.
The problem is that cookie tracking has gotten less reliable. Safari’s Intelligent Tracking Prevention (ITP) deletes third-party cookies after 24 hours and restricts some first-party cookies to 7 days. Firefox blocks third-party cookies by default. Chrome was scheduled to eliminate them too, and even though Google delayed that rollout repeatedly, the direction of travel is clear. Browsers are making cookie lifespans shorter and access more restricted.
Server-side tracking moves the attribution logic off the user’s browser and onto your server. Instead of relying on a cookie that might get deleted or blocked, your server sends purchase data directly to the tracking platform when a transaction completes. Since this happens server-to-server, ad blockers and browser privacy settings don’t touch it. Server-side tracking is more accurate for programs running paid traffic, since ad blockers tend to be more common among that audience.
Most platforms offer both. If you’re running a high-volume program or seeing consistent discrepancies between your order system and your affiliate platform, server-side tracking is worth setting up even if cookie tracking is your primary method.
Cookie length is one of the most debated settings in any affiliate program, and it directly affects how much credit your affiliates get for the traffic they send. What is a good affiliate cookie duration? covers the tradeoffs and what most successful programs actually use.
First-click vs. last-click attribution: which one affects your commissions
Attribution models decide which affiliate gets the commission when a buyer clicks multiple affiliate links before purchasing. Most programs use last-click attribution by default, which means the affiliate whose link was clicked most recently gets 100% of the commission. The affiliate who drove the initial awareness gets nothing.
Last-click attribution is simple and easy for every platform to implement. But it disadvantages affiliates who do the heavy early work, like a blogger who writes a thorough review that sends a reader to your site, only to have them click a coupon affiliate’s link at checkout and hand that affiliate the full commission.
First-click attribution does the opposite, crediting the affiliate who brought in the visitor initially. It favors content creators and organic traffic drivers over retargeters and coupon sites. Some programs, especially those with longer buying cycles, use first-click for this reason.
A smaller number of platforms support multi-touch or linear attribution, where credit is split across all affiliates who touched the buyer’s journey. This is more accurate in theory but creates complexity in payouts and disputes. Most programs running on standard affiliate networks don’t have this option.
The practical takeaway: know which model your platform uses before you make promises to affiliates about how commissions work. If you’re on last-click and a top-of-funnel affiliate complains their sales don’t match their traffic, that’s likely your attribution model at work, not a tracking bug.
Your commission structure and your tracking model are closely linked. If you haven’t thought through how different affiliate types get paid under your current setup, How To Structure An Affiliate Program (Commission Tiers, Rules, And Partner Types) is a good place to work through the options before they become disputes.
Why affiliate tracking breaks (and what causes it)
Tracking fails more often than most people want to admit. The most common reasons:
Ad blockers. Around 27% of U.S. internet users run an ad blocker, and many of them catch affiliate tracking scripts in the process. Browser extensions like uBlock Origin and Privacy Badger flag tracking pixels and third-party scripts. If your pixel fires from a third-party domain, a significant percentage of your buyers may never register as conversions in your affiliate platform.
iOS privacy settings and Safari ITP. Apple’s Intelligent Tracking Prevention has progressively shortened cookie lifespans on Safari and iOS. Since Safari accounts for roughly 20% of browser traffic in the U.S., and iPhone users make up a disproportionate share of mobile commerce, a cookie that lasts 30 days in Chrome may survive only 7 days, or in some cases 24 hours, in Safari. Longer-cycle purchases where a buyer researches for a week before buying are especially vulnerable.
Cross-device journeys. A buyer clicks an affiliate link on their iPhone on Tuesday, then completes the purchase on their laptop on Friday. The cookie lives on the iPhone, not the laptop. Unless your platform uses fingerprinting, a logged-in customer ID, or some form of cross-device matching, that conversion doesn’t credit the affiliate. There’s no clean fix for this on pure cookie-based systems, which is why some programs move to server-side tracking for exactly this reason.
Redirect chains. Affiliate links often go through several redirects before landing on your site. If any redirect in that chain strips UTM parameters or fails to pass the affiliate ID properly, tracking breaks at that point. This is especially common when affiliates use link shorteners or redirect through their own domain without setting it up correctly.
Pixel placement errors. If your thank-you page tracking pixel isn’t loading on every confirmed order (not just the first one, or not on mobile, or not for certain payment methods), you’re silently missing conversions. This is worth checking on a periodic basis, not just at launch.
The fix for most of these is layered tracking: a cookie for standard cases, a server-side event for purchases, and a logged-in customer ID where possible. No single method catches everything, but a combination of two covers most of the gaps.
The three things to check first when an affiliate says a sale wasn’t credited
Every affiliate manager gets this message eventually. An affiliate sends you a screenshot of a sale confirmation and asks where their commission is. Before you start manually awarding commissions or assuming your platform is broken, check these three things.
1. Was the affiliate link actually used? Pull the order record from your sales system and check the referral source or UTM data attached to it. Most order management systems and e-commerce platforms log this. If the referral shows up as “direct” or empty, the buyer likely went straight to your site or searched for it, bypassing the affiliate link entirely. This is the most common explanation for uncredited sales, and it’s not a tracking failure.
2. Was the sale within the cookie window? Check when the affiliate last generated a click from that customer and compare it to the purchase date. If your cookie is 30 days and the buyer clicked the link 45 days ago, the cookie expired before the purchase. This is especially common for higher-ticket products where buyers take longer to decide.
3. Did the pixel fire? Most affiliate platforms have a transaction log or event history that shows whether a tracking pixel fired for a given order. If you see a click recorded but no corresponding conversion event, the pixel may have failed to fire on that order. Check whether the purchase method, device, or payment processor could explain it, as some payment gateways redirect to a third-party confirmation page that bypasses your pixel entirely.
If all three check out and the sale still wasn’t credited, that’s when you look at potential tracking setup issues. But most of the time, one of these three explains it. When an affiliate has done everything right and the attribution is genuinely missing, award the commission manually and document it. Trust costs less to maintain than to rebuild.
Tracking disputes are one of the fastest ways to lose an affiliate’s trust. How to Build Trust and Credibility with Your Affiliates covers how to handle these situations and what affiliates are actually looking for when they decide to keep promoting your program.
Affiliate tracking in the context of fraud prevention
Understanding how tracking works also makes you better at spotting when it’s being abused. Cookie stuffing, where an affiliate drops their tracking cookie on a visitor’s device without a genuine click, works by exploiting the exact same mechanism that legitimate tracking uses. The platform sees a cookie and credits a sale, regardless of whether the visitor consciously clicked the affiliate’s link.
One of the better signals for this is the ratio of clicks to conversions. A conversion rate that’s dramatically higher than your program average, or higher than the same affiliate’s previous performance, is worth investigating. Legitimate traffic from a good affiliate can produce great conversion rates, but a sudden spike without a clear traffic source explanation is a flag.
The other signal is quick-click patterns, where a buyer shows multiple affiliate clicks in a very short window. If an affiliate’s cookie shows up fractions of a second after another affiliate’s click, the second cookie wasn’t clicked by a human.
Your tracking setup can’t prevent fraud entirely, but a solid understanding of how attribution works helps you read the data rather than just trust it.
How to audit your tracking setup
Most programs set up tracking once and never look at it again. That’s a mistake, because your platform updates, your site changes, and payment processors occasionally restructure their thank-you pages in ways that break pixels quietly.
Do this at minimum once a quarter:
- Place a test order using a real affiliate link and verify the conversion shows up in your platform within a few minutes.
- Check that your confirmation page pixel fires on mobile, not just desktop.
- If you use multiple payment methods (credit card, PayPal, Stripe, etc.), run a test purchase through each one and confirm tracking fires for all of them.
- Check your platform’s error log or event feed for any failed pixel fires in the past 30 days.
- Compare your total platform-reported conversions against your total confirmed orders for the same period. A gap larger than 5-10% warrants investigation.
If you’re seeing consistent undercounting, talk to your platform’s support team about adding server-side tracking as a secondary method. The setup time is typically a few hours, and the improvement in attribution accuracy is usually significant.
For a broader look at what else might be broken in your program beyond tracking, running a full program audit covers the things that are easy to miss when you’re deep in day-to-day management. How to Audit Your Affiliate Program (and Fix What’s Broken) gives you the full checklist.
FAQ: affiliate tracking questions
How long does an affiliate tracking cookie last?
Cookie duration varies by platform and program settings. Common durations are 30, 60, and 90 days, though some programs use 365 days or a lifetime cookie that never expires. The duration sets the window between a click and a purchase where the affiliate still gets credit. Shorter cookies favor programs with fast buying cycles. Longer ones are standard for higher-ticket offers where buyers take more time to decide. Browser restrictions on Safari and iOS have made some shorter-duration cookies even shorter in practice.
Can an affiliate’s tracking cookie get overwritten?
On most platforms using last-click attribution, yes. If a buyer clicks affiliate A’s link on Monday and affiliate B’s link on Wednesday, affiliate B’s cookie replaces affiliate A’s. When the buyer purchases, affiliate B gets the commission. Some platforms let you configure this differently, either preserving the first click or locking the cookie to the first affiliate who touched the buyer. Check your platform’s documentation to understand its default behavior before affiliates start asking.
What happens if someone buys on a different device than the one they clicked on?
With standard cookie-based tracking, the sale usually won’t credit the affiliate. Cookies are stored per device and per browser, so a click on an iPhone doesn’t carry over to a purchase on a MacBook unless your platform has cross-device matching. Server-side tracking with a persistent customer ID (like an email-based match after login) can bridge this gap. Some platforms also use probabilistic fingerprinting to infer cross-device journeys, though this is less reliable and increasingly restricted by privacy regulations.
Why does my affiliate platform show more clicks than my Google Analytics does?
The two systems measure different things with different methods. Your affiliate platform counts every redirect through the tracking link. Analytics counts pageviews on your site, filtered through whatever the browser allows. Ad blockers, bot traffic, and JavaScript loading failures all cause Analytics to undercount sessions that your affiliate platform records as clicks. A 10-20% discrepancy is common and not necessarily a sign of fraud or error. A 50%+ gap is worth looking into.
Is server-side tracking required for a successful affiliate program?
No, most programs run entirely on cookie-based tracking and do fine. Server-side tracking is worth adding if you’re running significant paid traffic (where ad blocker rates tend to be higher), if you’re seeing consistent unexplained discrepancies between your order system and your platform, or if a meaningful portion of your buyers come through Safari on iOS. For most mid-sized programs with organic traffic, a properly configured cookie setup with regular audits is sufficient.
How do I know if my tracking pixel is firing correctly?
The fastest way is to run a test purchase through your own affiliate link and check whether the conversion appears in your platform within 5-10 minutes. You can also use browser developer tools (Network tab) on your confirmation page to watch for the pixel request firing. Most affiliate platforms also have an event log or diagnostic tool that shows recent pixel fires and any errors. Set a recurring reminder to run this test quarterly, and run it immediately any time you change your checkout flow, payment processor, or confirmation page template.
