The data an affiliate has and the data it needs
An affiliate can see everything up to the click and almost nothing after it. Its own analytics record the visit, the page, the source and the click on an operator link; the operator's reporting records, at whatever granularity the agreement allows, what the customer did next. The affiliate business is run in the join between those two sources, and most affiliates run it badly. This lesson covers tracking, reconciliation, the metrics that matter, forecasting a revenue-share book, and detecting fraud in the affiliate's own traffic.
How tracking works
The operator issues the affiliate a tracking link containing an identifier for the affiliate and, usually, parameters for the campaign, page or placement. When a reader clicks, the operator's system records the identifier, typically in a cookie and a server-side session, and if the reader registers within the attribution window (its length is set by each operator's programme and varies widely, so check it in the agreement) the account is tagged to the affiliate. Every subsequent event on the account, deposit, wager, net revenue, is reported against the tag.
Postbacks and server-to-server tracking. Rather than relying on the affiliate reading the operator's dashboard, the operator can send events (registration, first deposit, qualification) to the affiliate's tracking system in real time, by calling a URL the affiliate specifies. This is widely used in performance marketing and, because the operator's server sends the conversion data directly to the affiliate's platform, it does not depend on a browser cookie surviving; it lets the affiliate attribute conversions to the exact page and placement that produced them, and it is what allows the affiliate's own analytics to show conversion rates rather than just clicks. Affiliates should ask for postbacks on every event the operator will provide and build their reporting on them.
Sub-IDs. Parameters on the tracking link that identify the page, position, campaign or test variant. Without them, the affiliate knows it referred a customer; with them, it knows which page and which placement did, which is the difference between optimising and guessing.
Tracking platforms. Third-party systems that manage links, receive postbacks, aggregate operator reports through their APIs and present them in one place. The larger affiliates run one; the smallest use spreadsheets; the operator's dashboards alone are not enough, because they cannot be compared across operators or joined to the affiliate's own traffic data.
Reconciliation
Every month the operator reports what it owes, and the affiliate should check it. The check compares the affiliate's own record (clicks, postback registrations and first deposits, by operator and period) against the operator's statement (registrations, depositors, net revenue, commission). The discrepancies are routine and worth chasing: registrations the affiliate's tracking saw and the operator's did not (attribution lost, window expired, tagged to another affiliate), depositors counted differently (qualifying thresholds), net revenue computed with deductions the agreement did not specify, and commission tiers misapplied. Net revenue is the operator's gaming revenue after the deductions the agreement allows, and Catena Media's annual report for 2025 warns that an increase in an operator's cost base can reduce the net revenue ultimately paid to the affiliate, and undetected miscalculations on the operator's side can produce incorrect fees, which is why it audits operators regularly. Each deduction should be checked against the contract.
An affiliate that reconciles finds money; one that does not is paid what the operator's system produces, which is not always the same thing. Reconciliation also produces the evidence for the quality conversation in lesson five: the affiliate knows its cohorts' deposit rates and values because it has tracked them itself.
The metrics
The affiliate's operating dashboard has a small number of figures that matter, by operator, market and page.
Click-through rate: clicks on operator links per visit, by page. The measure of whether the content persuades.
Registration rate: registrations per click. Mostly the operator's sign-up funnel, partly the fit between what the page promised and what the reader found.
Deposit rate: first depositors per registration, and per click. The number operators care about most and the one that drives CPA qualification.
Value per depositor: for revenue share, the net revenue per referred customer per month, and its curve over time; for CPA, the fixed fee paid for each referred player who meets the agreed qualifying criteria. Together with deposit rate, this gives earnings per click (EPC), the single figure that compares operators and pages on the same basis.
Earnings per click by page and operator is the core optimisation metric. A page whose EPC is twice another's deserves the better placement; an operator whose EPC is half the average deserves a worse one or a renegotiation.
Cohort retention: for revenue share, what share of a month's referred depositors are still active three, six and twelve months later, and what they generate. The shape of this curve is the affiliate's book.
Channel and market split: everything above, by traffic source and by market, for the portfolio management in lessons two and four.
Forecasting a revenue-share book
An affiliate on revenue share has an asset that pays in the future, and estimating its value is the most important calculation in the business, for management and for a buyer.
The method is cohort-based. For each month's referred depositors at each operator, the affiliate has (or can estimate from operator reports) the net revenue they generated in each subsequent month. Plotted, these produce decay curves: a cohort's monthly contribution typically falls quickly in the first months and then declines slowly for years, with shapes that differ by product and operator, and VIP-heavy operators producing lumpy curves. Averaging the curves gives an expected lifetime value per depositor, and applying it to the existing base gives the expected future revenue of the book, which is then discounted for the risk that terms change, operators exit markets or customers are limited. Allow for volatility, because revenue share falls when players win: Better Collective reported that player-friendly sports results in September 2025 reduced its third-quarter revenue by approximately 10 million euros compared with a year earlier. And model it at the level the commission is paid: where an agreement calculates revenue share across all the referred players in an account, a large win by one player in a month reduces the commission on the whole account, not only on that player's cohort.
A simpler version many affiliates use: the last twelve months' revenue-share income from cohorts older than twelve months, as a run-rate of "old money" that continues if new acquisition stopped tomorrow. That figure, times a multiple, is a large part of what a buyer will pay.
Fraud in the affiliate's own traffic
Operators police affiliate fraud, and an affiliate that is not policing it in its own traffic will be caught by the operator first, with consequences for the relationship.
Bonus abuse rings. Groups who register through affiliate links to claim sign-up offers, extract value and leave. They produce depositors who qualify for CPA and never generate revenue share, and operators withhold commission or close accounts when they find them: many agreements let the operator withhold or claw back commission on traffic it deems fraudulent and suspend or terminate the affiliate's account.
Self-referral and incentivised traffic. Users paid to sign up, or the affiliate's own team. Commonly prohibited in operator agreements, and compliance guidance written for operators says affiliate policies should clearly ban self-referrals.
Bought traffic from prohibited sources. Sub-affiliates or traffic vendors sending clicks from sources the operator's terms exclude (incentivised, adult, unlicensed markets).
Attribution hijacking. Toolbars, extensions or redirects that overwrite another affiliate's cookie with the fraudster's at the moment of registration. Browser platforms now police the extension route too: since June 2025 Google's Chrome Web Store policy has barred extensions from adding, modifying or replacing affiliate links unless the affiliate programme is disclosed, the user acts before any affiliate link, code or cookie is applied, and the user gets a direct benefit.
The affiliate's defences are the same as the operator's at a smaller scale: monitor deposit rates and revenue-share curves by page, source and sub-affiliate for anomalies (a source with high registrations and no revenue is a ring), verify sub-affiliates, refuse traffic vendors, and read the operator's quality feedback as an early warning. The Fraud and Risk Management course covers promotional abuse from the operator side.
Data protection
Tracking a reader's click and receiving their conversion data is personal-data processing under European and British law, which treats cookie identifiers as online identifiers that can identify a person, and under a growing number of American state laws, such as California's, whose definition of a unique personal identifier covers cookies, beacons and pixel tags. Consent for tracking cookies, which the ePrivacy Directive requires in the EU and the Privacy and Electronic Communications Regulations require in Britain, a privacy notice that tells readers operators may set cookies and receive their data, and agreements with operators that define what customer data is shared and on what basis are the minimum. Britain added consent exemptions in February 2026, including statistical analytics used only to improve a site, with a clear notice and a free way to object, but that exemption does not cover information shared with others for their own purposes, so affiliate tracking cookies still need consent. The Information Commissioner's Office puts the duty on the site: a service that embeds third-party features or enables third-party cookies in most cases has the primary responsibility for compliance and must have appropriate arrangements in place with those third parties, and for consent to be valid the site must tell users the identity of any third parties it shares data with. Listed affiliates treat this as a business risk: Catena Media's 2025 annual report warns that breaching data privacy rules could expose it to financial penalties, damages and indemnities to third parties such as operators. Because customer-level data shared between operator and affiliate carries these obligations, the affiliate's tracking design should assume aggregate data from operators and event-level data only from its own postbacks.
Reporting that runs the business
A monthly affiliate management report answers: revenue by operator, market and model against forecast; EPC by page and operator, with the changes; cohort curves and the book's estimated value; reconciliation findings and money recovered; traffic by channel and the concentration figures; fraud flags; and the compliance items open. A report that shows only revenue and traffic answers none of the questions that decide what to do next month.
What to take from this lesson
Run the business in the join between your own analytics and the operators' reports. Get postbacks and use sub-IDs so conversions attach to pages. Reconcile every statement; the discrepancies are money. Optimise on earnings per click by page and operator, and value the revenue-share book by cohort decay. Police your own traffic before the operator does, and design tracking for data-protection law rather than around it.