Richard Kahn
Cookie stuffing, a deceptive technique in affiliate marketing, can significantly undermine efforts to drive traffic and leads to your company’s website. Though affiliate marketing can be a tool for growth, it remains vulnerable to exploitation by fraudulent affiliates. In this blog, we will explore the mechanics and consequences of cookie stuffing.
Table of Contents
What Is a Cookie in Web Browsing?
Before explaining cookie stuffing, let’s first understand what a cookie is. A cookie is a text file in a user’s web browser that websites can read from and write data to. With cookies, websites can track a person’s browser history, save login credentials, and store various other data that advertisers and their websites can use.
Merchants running affiliate marketing programs often rely on cookies to attribute customer or lead activities with a particular affiliate so they can provide the right compensation to the right affiliate partners.
What Is Cookie Stuffing (a.k.a. Cookie Dropping)?
Cookie stuffing is a form of affiliate fraud where a website drops one or more third-party cookies onto a visitor’s web browser. These malicious cookies cause merchants with affiliate programs to misattribute any traffic with those cookies to the fraudster. So, when the time comes to pay affiliates for their efforts, the fraudster gets credit for traffic that they didn't really help generate.
This can take money away from affiliates who brought the traffic to the business or cause the business to spend money on affiliate reimbursement when the fraudster did nothing to promote their business.
Cookie stuffing harms a company’s affiliate marketing efforts since the affiliates who produce results start to see less profit from the program—which makes them less likely to keep participating.
In some cases, the owner of the website installing the cookies might not know that they’re engaging in cookie stuffing. For example, their website might use an extension to enable some specific feature, such as a pop-up window or live chat feature, that is secretly designed to drop third-party cookies onto a visitor’s web browser.
Worse yet, in many cases, the cookie is dropped onto the customer’s web browser without their knowledge or consent because they didn’t click on a related ad meant to promote the company running the affiliate program.
This can be a violation of not just affiliate marketing compliance guidelines but of major data security regulations such as the European Union’s (EU’s) General Data Protection Regulation (GDPR), which specifically forbids collecting data without permission and requires websites to let people know when data is being collected.
The malicious cookies provide credit to the fraudster if a customer just so happens to visit the company’s website and take an action that would trigger compensation later—regardless of whether the merchant’s site was ever promoted!
This can contribute to wasted ad dollars compensating fraudulent affiliates who never helped to drive traffic or business.
7 Types of Cookie Stuffing
So, how do fraudsters perform cookie stuffing? There are a few different strategies for using cookie stuffing scripts, getting them on someone’s web browser, and getting money from companies with affiliate programs:
1. Image Cookie Stuffing
This is when a fraudster sets the source for an image link to be an affiliate link. Although a website visitor’s web browser won’t be able to display the image (since the source link doesn’t go to an image in the website’s database), the browser will still try to follow the link without the user’s input—loading and then acting on the cookie the link goes to.
Fraudulent affiliates using image stuffing techniques can load a lot of malicious cookies on a webpage and set them to display as nothing more than blank space—avoiding the warning sign of a bunch of broken images appearing on the screen.
2. Pixel Stuffing
Pixel stuffing is a fraud technique where the display area for an ad is shrunken down to a single pixel. Since the ad technically exists on the page, it will trigger an impression and can be used to stuff a cookie into the visitor's web browser without their knowledge.
While not strictly a cookie stuffing technique—pixel stuffing is more common for impression fraud—it bears mentioning in this list.
3. Banner Advertising Cookie Stuffing
Malicious affiliates can add auto-loading cookies into banner ads and use those on other sites. In this form of forced stuffing, visitors to a website with a malicious ad don’t even need to click on anything—the cookie is automatically loaded into their browser just by visiting the page the cookie-stuffed banner is on.
These fraudulent banner ads can easily be placed in high-traffic websites and online forums—quickly attaching a large number of malicious cookies onto unsuspecting visitors’ web browsers. When those visitors’ natural web use just happens to bring them to a merchant site with an affiliate program, the cookies ensure that the fraudster gets the credit for bringing in the lead, even though the banner ad may not have promoted that company in the least.
4. Pop-Up Cookie Stuffing
Website pop-up ads are a common tool employed by websites to act as a convenient way to grab a visitor’s attention and try to get them to sign up for something. However, some cookie stuffers publish pop-up extension tools for unsuspecting website owners that are filled with code for cookie stuffing.
When a website visitor hits a page with this malicious pop-up extension running, the extension forcibly stuffs affiliate link cookies into their web browser, even if the pop-up has nothing to do with the companies running those affiliate programs.
5. Iframe Cookie Stuffing
Iframes are special bits of code on a website that allow HTML codes or documents to be loaded onto the page. This can be used to display ads, videos, documents, or interactive elements from other sources (a common example is an embedded YouTube video).
Sometimes, the “third-party” code used in the iframe can include malicious cookie stuffers—ones that automatically hit any browser trying to load the code in the iframe with a bunch of affiliate cookies.
6. Code-Based Redirects Using JavaScript or Other Programming Languages
A fraudster can bypass all pretense of trying to promote a specific website or product and instead add code to their webpages using JavaScript or other programming languages to forcibly redirect website visitors to different pages and add affiliate cookies to their browsers.
7. Cookie Stuffing Using Browser Hijacking Tools
Another way that fraudulent affiliates can stuff cookies into an unsuspecting visitor's web browser is by using malware to hijack their web browser entirely. Once installed, a browser hijacker can modify a visitor's web browser settings and event redirect them to websites and web pages they didn't intend to visit.
By redirecting visitors to pages they otherwise wouldn't have visited, a fraudster can force fraudulent cookies using a variety of other cookie stuffing strategies. With a well-planned malware distribution method, the fraudster could potentially infect millions of devices and start forcing cookies onto all of them—increasing the likelihood that someone who completes an action on your website will have a fraudulent cookie crediting the crooked "affiliate" for the action.
Real Examples of Affiliate Cookie Stuffers Who Got Caught
One important step in learning to recognize when a fraudulent affiliate is engaging in cookie stuffing is to take a look at real-life examples of cookie stuffing and analyze how the fraudsters did it. Additionally, by studying how they were caught, you can identify some strategies to help your own cookie stuffing detection efforts.
Here are some examples of cases where cookie stuffers got caught in the act:
1. Honey/PayPal Accused of Stealing Affiliate Commissions
In a The Verge article from December 2024, it was revealed that Honey, the coupon-finding browser extension owned by PayPal, was allegedly manipulating affiliate tracking links to claim commissions unfairly.
Honey automatically replaced affiliate cookies at checkout, ensuring the extension, rather than the original affiliate, received credit for the sale. This practice remained unnoticed by users because Honey still functioned normally—finding and applying coupon codes—while covertly altering affiliate attribution.
As a result, content creators and influencers who relied on affiliate commissions lost earnings, leading to a class-action lawsuit. Plaintiffs claimed that Honey’s deceptive practices directly impacted their revenue streams.
Given enough time, this could have diverted millions in affiliate commissions away from legitimate marketers, raising concerns about browser extensions’ interference in affiliate programs.
2. Dataly Media’s Cookie Stuffing Scheme
In a Ad Exchanger report from January 2023, ad security firm Confiant uncovered a cookie stuffing operation linked to Dataly Media, an Ecuador-based affiliate marketing platform.
The scheme involved secretly placing affiliate cookies onto users' browsers without their knowledge. This allowed Dataly Media to claim commissions for sales it never influenced, distorting attribution models for advertisers and funneling millions in fraudulent commissions into their pockets.
Investigators found that Dataly Media had engaged in this fraud for years, with evidence dating back to at least 2015. The operation affected numerous advertisers, highlighting the ongoing risks of cookie stuffing in affiliate marketing.
Without proper detection, this scheme could have continued indefinitely, further defrauding brands that rely on accurate attribution.
3. Capital One Shopping Extension Faces Lawsuit
According to a Wall Street Journal article from January 2025, influencers Jesika Brodiski and Peter Hayward filed a class-action lawsuit against Capital One, alleging that its Capital One Shopping browser extension unfairly intercepted affiliate commissions.
The extension automatically replaced cookies from influencers’ affiliate links with its own, ensuring that Capital One—not the original referrer—earned the commissions. Many influencers argued that Capital One’s extension effectively stole their earnings without contributing any legitimate traffic or engagement.
Legal experts see this as a major case in the evolving debate over browser extensions and ethical affiliate tracking. The outcome of this lawsuit could significantly impact how browser-based tools interact with affiliate marketing programs.
This case underscores the potential legal risks for companies that manipulate affiliate tracking to their advantage.
How to Spot Cookie Stuffing and Other Forms of Affiliate Fraud
One of the first steps in fighting any kind of fraud is being able to identify it in the first place—preferably before it costs the company millions of dollars in fraudulent affiliate ad spend! But how can companies spot affiliate fraud before it gets too far out of hand?
Keeping an eye out for affiliate fraud warning signs can help. Two major warning signs of cookie stuffing include:
1. Sudden Increases in Affiliate Program Spend Without Commensurate ROI
For cookie stuffing, one of the biggest warning signs to watch out for is a sudden increase in affiliate program spending without a commensurate increase in sales.
This happens because people who would normally visit the company’s website or close deals even without a suggestion from an affiliate are hitting the website with a fraudulent affiliate cookie in their browser. So, the company spends more on affiliate marketing while not seeing a real ROI for it.
2. Spikes in Complaints and Withdrawals by Affiliates
Another potential warning sign of cookie stuffing is a sudden spike in complaints or resignations from affiliates. With cookie stuffing, the fraudster can end up stealing the credit for referrals from their honest counterparts. So, despite actually helping drive revenue for the merchant, affiliates may not get paid for their time and effort because of the misattribution of leads to cookie stuffers.
This can cause extreme dissatisfaction among affiliates who rely on affiliate marketing programs to be a solid secondary (or even primary) revenue stream—leading to complaints or even the abandonment of the program by affiliates. From the honest affiliates’ perspective, there’s no reason to continue spending time, effort, or online “real estate” on a merchant who isn’t paying them for the results they’re producing. So, they instead partner with other companies that may prove more lucrative.
Related Post: 6 Tips for Crafting a Fraud-Resistant Affiliate Marketing Campaign
How to Stop Cookie Stuffing Fraud
How can companies defend against malicious affiliates who use cookie stuffing techniques to violate their affiliate marketing compliance guidelines and defraud them for revenue?
1. Using Promotional Codes at Checkout
One potential method some companies employ is to use affiliate-specific promotional codes instead of tracking cookies to assign credit for a customer/prospect action to an affiliate.
For example, an affiliate could advertise a special promotional code to use on the merchant’s site (such as #AffiliateName1010), which gives the affiliate’s audience a small discount on a purchase at the merchant’s store or a free month of some subscription service. Using this method, the presence or absence of fraudulent affiliate links in a browser doesn’t matter, and affiliates get proper credit when someone uses the code.
Unfortunately, this method isn’t perfect. It relies on the affiliate’s audience to take a specific manual action to complete, and not everyone will remember to use the code. Also, the need to manually enter something creates an extra hurdle to getting a customer to make a purchase (sometimes, the smallest things can lead to an abandoned cart).
2. Carefully Vetting Affiliates Before Adding Them to Your Program
Another measure that a company can take to prevent fraud is to carefully vet affiliates before adding them to an affiliate program. Taking measures to positively identify who an affiliate is and to verify that they can produce results can help to proactively weed out some of the more obvious fakes and stop them from defrauding your affiliate program.
One thing that many companies might check is the affiliate's social media accounts. This may involve looking at their channel analytics to see how long their channel has existed, how frequently they post, how much engagement there is with their posts and other information. Using this information, the company tries to identify a high-value affiliate.
Unfortunately, this method isn't perfect because there are fraudsters out there who use bots and click farms to artificially inflate their social media profiles. If you don't know how to spot an account that uses fake followers, you might end up adding a fraudster who will use cookie stuffing or other ad fraud techniques against you.
Some of the warning signs of an influencer using fake followers to pad their account include:
- An unusually large audience for an account that was recently created or doesn't have a lot of content.
- Posts having poor-quality engagement (a lack of comments or comments being so generic they could apply to anything).
- A sharp increase in subscribers for an older account without a viral post to explain it.
- Followers having "low-quality" profiles that were recently created, lack detail, and/or only follow that particular influencer.
- A high percentage of spam activity in comments under the influencer's content.
Discover more warning signs of fraud and how to fight it with our Affiliate Marketing Fraud 101 eBook.
3. Using an Ad Fraud Solution
To truly stop affiliate fraud, companies need to be proactive about their anti-fraud efforts. Instead of waiting for months or years to collect enough data to definitively identify fraud trends, they need to be able to spot and identify malicious affiliate link code in their partners’ ads and websites. Here’s where an ad fraud solution can help.
Anura’s ad fraud solution makes it easy to identify affiliate fraud-related activity so companies can nip the problem in the bud. The fraud solution’s analytics tools provide a way to identify trends in affiliate programs that indicate fraud and apply a massive backlog of data to confirm fraudulent activity to prevent any false positives.
To help you master your new ad fraud detection toolkit, the Anura team provides dedicated support, including live support over the phone from 8:00 AM to 5:00 PM EST every Monday through Friday.
