Written by Krisztián StarkKey takeaways
- Cookie stuffing drops an affiliate tracking cookie on a browser that never clicked the affiliate's link, so the fraudster collects commission on sales they did not cause.
- It is banned by affiliate programs and has led to US wire fraud convictions: two of eBay's former affiliates went to federal prison in 2014.
- Tracking that credits a conversion only to a click made by a known, signed-in user and confirmed by the advertiser's server leaves a stuffed cookie nothing to claim.
What is cookie stuffing?
Cookie stuffing is affiliate fraud where someone forces an affiliate tracking cookie onto a person’s browser without that person clicking the affiliate’s link. If the person later buys from the merchant on their own, the merchant’s tracking reads the planted cookie and pays the fraudster a commission for a sale they did nothing to cause. It is also called cookie dropping or forced clicks, and it is prohibited by affiliate programs and has been prosecuted as wire fraud in the United States.
The merchant pays for sales it would have made anyway, and honest affiliates lose referrals they earned. For the wider picture of fake clicks and fake leads, see Ad fraud and bot traffic.
How cookie stuffing works
A normal affiliate referral has three steps. A visitor clicks an affiliate link, the link passes through the network’s or merchant’s tracking server, and that server stores a cookie with the affiliate’s ID before sending the visitor on to the merchant. If the visitor buys within the cookie’s lifetime, the affiliate is paid. What is a tracking link? explains that redirect, and What is a conversion window? covers how long the cookie counts.
Cookie stuffing fakes the first step: the tracking server gets the same request as from a real click, so it sets the same cookie. The methods differ only in how that request is triggered.
Hidden images and iframes
The oldest method loads the affiliate link as the source of an invisible element: a 1x1 pixel image, an iframe sized to zero, or a frame hidden off screen. Every visitor to the page silently “visits” the tracking link. Hiding them in free widgets that other site owners install spreads the stuffing to sites the fraudster does not own.
Browsers have made this harder. WebKit announced in its March 2020 post on full third-party cookie blocking that Safari blocks cookies for cross-site resources by default. Mozilla’s Total Cookie Protection announcement (June 2022) made separate cookie storage per site the default for all Firefox desktop users, so a cookie set inside a frame on one site cannot be read on another. Chrome is different: Google said in its April 2025 Privacy Sandbox update that it would keep its current approach of letting users choose about third-party cookies, with Incognito blocking them by default.
Pop-unders and forced redirects
A pop-under opens the merchant’s site through the affiliate link in a window behind the one the user is looking at. A forced redirect sends the whole page through the affiliate link and on to the merchant when the user did not ask to go there, for example from a typo domain or an exit script. Because the browser makes a normal top-level visit, the tracking cookie is a first-party cookie and survives the browser protections above.
Browser extensions and adware
Software already on the user’s device can watch which shop the user opens and send them through an affiliate link at that moment, or open the link in a background tab. The user arrived at the shop on their own, but the last affiliate cookie on record now belongs to the software’s owner. This is the version argued about most today.
Why a planted cookie steals the credit
Most affiliate programs use last-click attribution: the sale goes to the affiliate whose cookie was set most recently. (What is attribution? explains the models.) Cookie stuffing exploits that rule in two ways:
- Claiming organic sales. The fraudster stuffs cookies on huge numbers of browsers. Some of those people would have bought from the merchant anyway, and each of those sales now carries the fraudster’s ID.
- Overwriting real referrals. A shopper clicks an honest reviewer’s link, then a stuffed cookie or an extension redirect replaces the reviewer’s cookie before checkout. The reviewer did the work; the fraudster is paid.
Illustrative example (sample figures only)
A merchant pays 5% commission. A blogger’s honest review sends a shopper who buys a $400 laptop the next day. Between the click and the purchase, the shopper visits a page with a hidden frame that loads another affiliate’s link. The merchant pays $20 to the stuffer, the blogger gets nothing, and the merchant’s reports now credit the stuffer with a sale.
Real cookie stuffing cases
The eBay affiliate prosecutions
The best documented case is from eBay’s affiliate program. According to the US Attorney’s Office for the Northern District of California, Brian Dunning pleaded guilty to wire fraud in April 2013, admitting a cookie stuffing scheme against eBay between about May 2006 and June 2007. His company offered two free website applications, ProfileMaps.info and WhoLinked.com, whose code made visitors’ browsers receive a cookie with the company’s affiliate ID even though they did not click an eBay link, did not see eBay content, and did not know their browser had been sent to eBay’s tracking server. The company was paid about $5.2 million in commissions in that period; for sentencing, the parties agreed $200,000 to $400,000 came from the fraud. In August 2014 Dunning was sentenced to 15 months in prison and three years of supervised release.
Shawn Hogan, who had been one of eBay’s top affiliates, was charged in the same investigation. MarTech (then Marketing Land) reported in May 2014 that he pleaded guilty to one count of wire fraud and was sentenced to five months in federal prison, a $25,000 fine and three years of supervised release, and that court documents showed he had earned $28 million in eBay affiliate commissions.
The Honey extension dispute
In December 2024 a YouTube investigation by MegaLag alleged that PayPal’s Honey shopping extension replaced creators’ affiliate links with its own at checkout and opened hidden tabs to register affiliate referrals. Fortune reported the allegations along with a statement from a Honey spokesperson that “Honey follows industry rules and practices, including last-click attribution.” Creators then filed lawsuits. Bloomberg Law reported that on November 21, 2025, Judge Beth Labson Freeman of the Northern District of California dismissed the creators’ suit, finding the complaint did not establish that they were entitled to those commissions under their contracts with merchants. That ruling did not decide whether the extension behaved properly, and litigation of this kind can continue, so check the current status before you cite it.
This is not classic cookie stuffing, since users installed Honey themselves. The argument is whether software may take last-click credit at the end of a purchase someone else referred.
Chrome Web Store rules for extensions
Google tightened its rules in 2025. Its March 11, 2025 Chrome Web Store policy update says an extension must not add, modify or replace affiliate links unless the affiliate program is clearly disclosed on the store listing, in the user interface and before installation, user action is required before any affiliate link, code or cookie is applied, and the link is tied to a direct benefit for the user at that moment. Its example is a coupon extension, which must not insert an affiliate link when it finds no coupon. Enforcement began on June 10, 2025 (checked on October 22, 2026).
Is cookie stuffing illegal?
It always breaks affiliate program terms, and it can be a crime. In the eBay cases, US prosecutors treated taking commissions through stuffed cookies as wire fraud, and both defendants pleaded guilty. Whether a given scheme is criminal depends on the country and the facts; this is background, not legal advice.
The contract side is much clearer. Amazon’s Associates Program Policies say you cannot cause any page of an Amazon site to open in a customer’s browser other than as a result of the customer clicking a link on your site. They also ban Amazon links in pop-up or pop-under windows (with a narrow exception for pop-ups closely tied to your own content) and ban intercepting or redirecting traffic, including through software installed on users’ computers (checked on October 22, 2026). Breaking program rules usually means commissions are withheld and the account is closed.
How to detect cookie stuffing
No single signal proves stuffing, so networks and merchants look for several at once.
| Signal | What it suggests | How to check |
|---|---|---|
| Huge click counts with almost no conversions per click, yet a steady share of sales | Cookies set on many browsers that never meant to visit | Compare clicks, conversion rate and sales by affiliate against your normal range |
| Clicks with no referrer, or referrers that do not match the affiliate’s declared site | Requests fired from hidden elements, redirects or software | Log the referrer and landing context for every tracked click |
| Clicks that arrive in the same second as a page view on an unrelated site | Hidden images or iframes on a third-party page | Crawl the affiliate’s pages and look for zero-size frames and 1x1 images pointing at tracking links |
| Sales that land on the merchant’s checkout seconds after the “click” | An extension or script triggering the link at checkout | Measure click-to-sale time by affiliate; real browsing takes minutes, not seconds |
| Customers who reached the shop through search or another affiliate, then show this affiliate’s cookie | Overwriting of real referrals | Keep the full click path, not only the last cookie, and review which affiliates appear last too often |
| A test browser picks up an affiliate cookie without clicking anything | Direct proof of stuffing | Browse the affiliate’s site and widgets in a clean profile and inspect cookies after each page |
Merchants can also shrink the payoff: shorter cookie lifetimes, no commission on clicks without a real landing visit, and rules that stop a coupon or extension partner from replacing an earlier referral. Postback vs pixel tracking explains why reconciling with your own order data matters.
Things that count as cookie stuffing even if you did not mean it
Loading any affiliate or offer link in a hidden iframe or image, opening it in a pop-under or a window the user did not click, sending visitors through it on page load or on exit, and using a plugin or script that does any of these for you. If a vendor’s “auto-monetization” widget sets affiliate cookies without clicks, you are responsible for it on your site.
Cookie stuffing vs click injection and click spamming
Cookie stuffing is the web cousin of mobile attribution fraud. All of these fake the click, not the purchase or install, and all of them depend on last-click rules. Click injection and SDK spoofing explained covers the mobile side in depth.
| Fraud type | Where | What is faked | Typical giveaway |
|---|---|---|---|
| Cookie stuffing | Web, via hidden elements, pop-unders, redirects | A referral click that sets the affiliate cookie | Clicks without real visits, very low conversion per click, odd referrers |
| Checkout overwriting by software | Web, via extensions or adware | A last click just before purchase | Click-to-sale times of seconds, affiliate appears last after other sources |
| Click spamming | Mobile and web | Masses of clicks so one precedes an organic conversion | Flat spread of click-to-conversion times across the window |
| Click injection | Android | A click fired once an app install has started | Click time after the install began, per the Play Install Referrer timestamps |
| SDK spoofing | Mobile, from servers | The install or event itself | Events your own backend never recorded |
Cookie stuffing and click spamming steal credit for conversions that really happened; SDK spoofing invents conversions that never did.
Why signed server-to-server tracking is harder to stuff
Cookie stuffing works because a cookie in a browser is the only proof of who referred a sale, and anyone who can make that browser load a URL can create the proof. Offerwall tracking with server-to-server postbacks and per-user signed links works differently:
- The user is known before any click. The publisher’s server builds the wall link for one signed-in user and signs it with a hash. A link without a valid hash for that user ID is refused, so a random browser cannot be enrolled by loading a URL.
- Credit attaches to a click the user made on an offer. Each offer click gets its own click ID tied to that user and app. Click ID and sub ID explains how that ID travels.
- The advertiser’s server confirms the result. A conversion counts only when the advertiser’s own system reports the action for that click ID, and the reward reaches the publisher in a signed postback with a transaction ID. A planted cookie on someone who never opened the wall has no user, click ID or transaction behind it, so there is nothing to credit.
That does not make the model fraud-proof. The risks move to bots, multiple accounts, VPNs and forged postbacks. Postback security and Stop multi-accounting and VPN abuse cover those defenses. Stuffing can still hurt from the advertiser’s side: if their own last-click tracking lets another source’s cookie replace the offerwall click, the user may not be credited, one cause behind an offer not being credited.
Publishers are held to the same rule as any affiliate: the user must choose to open the wall and each offer. How you may promote your offerwall lists what is prohibited, including hidden iframes, pop-unders and windows that open without a click.
Where Sharklio fits
Sharklio is a pay-per-result affiliate network. Your server builds and signs each user’s offerwall link with a hash, offers are reviewed by our team before they go live, and every credit and every reversal reaches your server as a signed server-to-server postback. Users on VPNs, proxies, Tor or data center networks are blocked from the wall, and every publisher application is reviewed by hand. Advertisers work with us through custom integrations and pay only for conversions their own server-to-server postback confirms, never for impressions or clicks. See how the wall works, or get in touch with questions.
Frequently asked questions
What is an example of cookie stuffing?
A page that loads an affiliate link inside an invisible 1x1 image, so every visitor gets the affiliate’s cookie without clicking anything. In the eBay case, free website widgets did this to visitors of every site that installed them.
Is cookie stuffing illegal?
It breaks every mainstream affiliate program’s terms, and in the United States two former eBay affiliates pleaded guilty to wire fraud over it and went to prison in 2014. Whether a specific case is criminal depends on the jurisdiction and the facts.
How do you detect cookie stuffing?
Look for affiliates with huge click counts but tiny conversion per click, clicks without real referrers, click-to-sale times of a few seconds, and affiliates who keep appearing as the last click after other sources. Browsing the affiliate’s pages in a clean browser profile and checking for new cookies is direct proof.
Is cookie stuffing the same as click injection?
They are related but not the same. Cookie stuffing plants a referral cookie on the web, while click injection fires a fake ad click on Android once an app install starts; both steal last-click credit for a conversion someone else caused.
Do browser extensions do cookie stuffing?
Some extensions and adware have been accused of replacing affiliate cookies at checkout. Since June 10, 2025 the Chrome Web Store requires disclosure, a user action, and a direct user benefit before an extension applies an affiliate link, code or cookie.
Can cookie stuffing affect offerwall rewards?
Not in the usual way, because offerwall credit comes from a click a signed-in user made on an offer and a conversion the advertiser’s server confirmed, not from a browser cookie. It can still cause a missed reward if an advertiser’s own tracking lets another source’s cookie replace the offerwall click.
