How referrals are recorded, why the mechanisms are degrading, and what replaces them.
In this lesson:
- Explain how affiliate tracking works technically, from click through to commission calculation
- Identify the causes of tracking failure and quantify their commercial consequences
- Compare attribution models and explain why the choice materially changes who gets paid
- Describe the technical and regulatory pressures reshaping tracking and the approaches replacing cookies
A technical system with entirely commercial consequences
Tracking looks like an engineering concern and is treated as one in most organisations. It is not. Tracking determines which affiliate gets paid for which player, which means every technical failure in the system is a transfer of money from one party to another.
Affiliates lose revenue they earned. Operators either underpay partners, damaging relationships they depend on, or overpay through duplicate attribution. And because the failures are invisible in normal reporting, both sides frequently operate for long periods on numbers that are simply wrong.
This lesson covers how the system works, how it fails, and where it is heading.
The standard mechanism
The conventional flow has four stages.
A player clicks a tracking link on affiliate content. The link points at the operator and carries parameters identifying the affiliate, and usually the specific site, page, campaign and creative.
The operator's system reads those parameters and records the click, setting a cookie in the player's browser that stores the affiliate identifier for a defined period, the attribution window. Windows of thirty days are common, though they range considerably.
If the player registers within that window, the system reads the cookie and attributes the registration to the affiliate. If the player registers immediately in the same session, attribution is straightforward. If they return three weeks later, the cookie must still be present.
The player's subsequent activity is then linked to that affiliate for commission purposes, and the operator's reporting shows the affiliate what its players generated.
Simple in outline, and each stage has failure modes.
Where tracking breaks
Cookie deletion and blocking. Users clear cookies. Privacy tools block them. Browsers have progressively restricted third-party cookies and shortened the lifespan of client-side storage, and the direction of travel is unambiguous. Attribution windows that assume a cookie will survive thirty days are increasingly optimistic.
Cross-device journeys. This is the largest single source of loss and it is structural rather than incidental. A person reads a comparison article on a phone during a commute, thinks about it, and registers on a laptop that evening. The cookie is on the phone. The laptop arrives at the operator with no attribution data whatsoever. The affiliate generated the customer and receives nothing.
In markets where mobile browsing dominates but registration and payment frequently happen on other devices, this loss is substantial. Neither party is at fault and neither can fully solve it with browser-based tracking.
In-app browsers. Links opened inside social or messaging applications often run in embedded browsers with isolated storage. A cookie set there may not exist when the user later opens their normal browser.
Redirect chains. Links passing through multiple redirects can lose parameters, particularly where an intermediate service strips query strings.
Delayed conversion. Gambling registration is often not impulsive. Someone may research for weeks. If the attribution window expires before they act, the affiliate that did the work is not credited.
Multiple touches. A player may encounter several affiliates. Only one will be credited, and which one depends on the attribution model.
Registration and deposit separation. A player may register without depositing and deposit weeks later. Whether the affiliate is credited depends on how the operator links those events and whether attribution persists past registration.
Attribution models
When multiple affiliates touch a player, someone must decide who is paid, and the choice is genuinely consequential.
Last click credits the final touch before registration. This is the overwhelming industry standard, because it is simple, auditable and produces no disputes about proportions. It is also demonstrably inaccurate. It systematically overpays affiliates positioned close to the point of conversion, particularly those capturing brand searches, and systematically underpays the content that created interest in the first place.
First click credits the initial touch, on the argument that the affiliate which introduced the player deserves the reward. It has the opposite bias, overvaluing top-of-funnel content and undervaluing the comparison content that closed the decision.
Multi-touch distributes credit across touchpoints, either evenly or weighted. It is more accurate in principle and rare in practice, because it requires the operator to identify all touchpoints reliably, it complicates every commission calculation, and it creates disputes about weighting that neither side can resolve with evidence.
The practical position is that last click persists because the alternatives are harder rather than because it is right. Anyone assessing affiliate performance should hold in mind that the numbers reflect an attribution convention, not a measurement of contribution.
The privacy transition
The technical foundation of affiliate tracking is eroding, and it is worth understanding why rather than treating each change as an isolated inconvenience.
Browser vendors have moved consistently towards restricting cross-site tracking, driven by user privacy expectations and regulatory pressure. Third-party cookies have been curtailed. The lifetime of client-side storage set by scripts has been shortened. Referrer information has been reduced. Identifiers used to link activity across contexts have been restricted.
Alongside this, data protection law requires a lawful basis for processing personal data and, in many jurisdictions, consent for non-essential cookies. A user declining cookie consent may not be trackable at all. Consent banners therefore directly affect attribution volumes, and their design affects it further.
The industry's response has been to move attribution away from the browser.
Server-to-server tracking passes a unique identifier from the affiliate to the operator at click time, stores it server-side, and returns a postback notification to the affiliate when a conversion occurs. Attribution no longer depends on anything persisting in the user's browser. It requires genuine technical integration on both sides, which limits it to affiliates with development capability, but it is substantially more reliable.
Unique tracking links per campaign allow attribution to be reconstructed from the landing URL rather than from stored state, and are the simplest improvement available to most affiliates.
Promotional codes provide a manual fallback, where the player enters a code at registration that identifies the affiliate. It works across devices and survives cookie loss, at the cost of requiring the player to remember and enter something.
Dedicated landing pages, where an affiliate sends traffic to a page created for it, provide attribution independent of cookies for as long as the page is only reachable through that affiliate's links.
Reporting and reconciliation
Affiliate reporting typically shows clicks, registrations, first time depositors, activity metrics and commission earned, broken down by campaign and by time period.
Several practical issues recur.
Timing differences. Operator reporting periods, commission calculation dates and payment dates rarely align neatly, and an affiliate comparing its own conversion tracking to operator reporting will find discrepancies that are timing rather than error.
Delayed adjustments. Players later identified as fraudulent, duplicated, self-excluded or in breach of terms are removed retrospectively, so figures reported early in a period may be revised downward.
Currency and rounding. Multi-market affiliates dealing in several currencies face conversion timing differences that produce small persistent variances.
Granularity limits. Operators generally will not expose individual player-level data to affiliates, both for data protection reasons and because that data is proprietary. This means affiliates cannot independently verify most of what they are paid, which places considerable weight on trust and on the reputation of the programme.
That last point deserves emphasis. The affiliate is being paid a share of revenue it cannot see, calculated on a basis it cannot audit, from players it cannot identify. This asymmetry is inherent to the model, and it is the reason an operator's reputation for accurate and consistent payment is a genuine competitive advantage in recruiting good partners.
When the numbers disagree
Attribution disputes are routine, and handling them well is a professional skill on both sides. The productive approach is diagnostic rather than adversarial, because the great majority of discrepancies have technical causes rather than dishonest ones.
The first step is to establish whether the gap is timing or substance. Operator reporting periods, commission calculation dates and the affiliate's own tracking rarely align exactly, and a discrepancy that closes when the same period is compared on both sides is not a discrepancy at all.
The second is to localise the loss to a stage in the funnel. If clicks match but registrations do not, attribution is failing between click and registration, which points at cookies, windows or cross-device behaviour. If registrations match but depositing players do not, the issue is more likely to lie in qualifying conditions or in players being excluded for reasons the affiliate cannot see. If everything matches until commission, the dispute concerns the calculation basis rather than the tracking.
The third is to test directly. Clicking a live tracking link, completing a registration and confirming that attribution appears correctly resolves a surprising proportion of disputes in minutes, and it distinguishes a broken link from a disagreement about method.
The fourth is to check what changed. Attribution failures usually begin at a specific point, and that point usually corresponds to a site redesign, a change of link format, a consent banner update, a platform migration on the operator side or a browser release. Establishing when the divergence started often identifies the cause without further investigation.
Where a genuine failure is found, the question of retrospective correction arises, and contracts frequently do not address it. An affiliate that can demonstrate traffic sent and conversion lost has a reasonable claim, but proving it without player-level data is difficult. This is an argument for maintaining independent records and for raising discrepancies promptly rather than months later.
Data protection and the affiliate relationship
A dimension frequently overlooked is that affiliate tracking involves processing personal data, and both parties have obligations.
Setting a cookie for tracking purposes generally requires consent in jurisdictions applying that standard, and consent must be genuine rather than assumed. This means the affiliate's own consent banner directly affects how many of its visitors can be tracked, and banner design has become a commercially significant decision rather than a legal formality.
Where an affiliate collects data itself, through email subscription, account registration on its own site or lead generation, it becomes a data controller with the full range of obligations that entails: a lawful basis for processing, transparency about what is collected and why, honouring access and deletion requests, and securing the data appropriately.
Where data is passed between affiliate and operator, the arrangement needs to be documented, with each party's role clear. Informal data sharing between commercial partners, which was common historically, is not defensible under current standards.
There is also a specific sensitivity in this sector worth naming. Data indicating that a person gambles, and particularly data indicating patterns that might suggest problems, is sensitive in practical terms even where it does not fall into a special category legally. Affiliates should be careful about retargeting audiences built from gambling interest, and particularly careful about anything that could reach people who have self-excluded. Operators are obliged to suppress marketing to self-excluded customers, and an affiliate retargeting list assembled independently can undermine that suppression entirely without anyone intending it.
Practical discipline
For affiliates, the useful habits are straightforward. Test tracking links before and after any site change, and test on multiple devices and browsers. Use unique parameters at campaign level so that discrepancies can be localised. Monitor the ratio of clicks to registrations and investigate sudden movements, since a tracking break usually appears first as a conversion rate that drops without an obvious cause. Keep independent records of traffic sent. And where volume justifies the effort, move to server-to-server integration.
For operators, the corresponding habits are to test attribution across the actual journeys players take rather than in ideal conditions, to be transparent about the attribution model and the window, to investigate affiliate discrepancy reports properly rather than dismissing them, and to recognise that under-attribution damages partner relationships in ways that are expensive to repair.
The underlying point for both sides is that tracking is not infrastructure to be configured once. It degrades continuously as browsers change, sites change and player behaviour changes, and it requires ongoing attention proportionate to the money that depends on it.
What good tracking hygiene looks like
Pulling the practical guidance together, a short operating standard for both sides.
Treat tracking as a monitored system rather than a configuration. Attribution degrades continuously as browsers, sites and behaviour change, so it needs regular verification rather than one-time setup.
Establish a baseline for conversion rates by source and by campaign, so that deviations are visible. Most tracking failures announce themselves as an unexplained drop in conversion, and without a baseline that drop is invisible.
Test on real journeys, meaning multiple devices, multiple browsers, with consent banners in their live configuration, and including the delay between click and registration that real players exhibit. Testing in ideal conditions confirms only that the system works in ideal conditions.
Document the attribution model, window and calculation basis clearly, and make them available to partners. Most disputes originate in unstated assumptions rather than in disagreement about facts.
Keep independent records on the affiliate side, so that a discrepancy can be evidenced rather than merely asserted.
Move to server-side attribution where volume justifies the integration effort, because the browser-based foundation will continue to erode and the affiliates and operators that have already migrated will lose less as it does.
Finally, recognise the asymmetry honestly. The affiliate cannot audit what it is paid. That places an obligation on the operator to be accurate and transparent, and it makes a reputation for correct payment one of the more valuable assets an affiliate programme can hold.
Fraud and the tracking system
A final consideration, because tracking is also the mechanism through which affiliate fraud operates.
Cookie stuffing sets affiliate cookies on users who never clicked a link, capturing attribution for players the affiliate did not introduce. It is detectable through implausible ratios between impressions, clicks and conversions.
Brand bidding in paid search, where prohibited, intercepts users already searching for the operator directly and claims commission for customers who would have arrived anyway. Operators monitor this through automated search result checking across markets.
Typosquatting captures traffic from misspelled brand domains, with the same effect.
Incentivised registration, where users are rewarded for signing up rather than motivated to play, produces registrations that satisfy CPA qualifying conditions while generating no genuine customers.
Attribution hijacking places the affiliate's cookie late in a journey generated by another party, capturing last click credit for work done elsewhere.
The common thread is that each exploits the gap between what tracking records and what actually happened. The defences are correspondingly analytical: monitoring the ratios between funnel stages for implausible patterns, comparing player quality across sources, checking search results independently, and investigating partners whose conversion characteristics differ markedly from the norm without an obvious explanation.
For legitimate affiliates, the practical implication is that unusual metrics invite scrutiny even when innocent, so being able to explain the traffic and its source is worth more than an unexamined good result.
Key takeaways
- Tracking determines who gets paid, which makes it a commercial system rather than a technical one, and disputes over it are ultimately disputes about money.
- Cookie-based tracking is degrading steadily under browser privacy changes, and the trajectory is towards less reliable browser-side attribution, not more.
- Cross-device journeys break browser tracking entirely, and mobile-dominated markets therefore suffer the most attribution loss.
- Last click attribution is the industry standard because it is simple and auditable, not because it is accurate.
- Server-to-server tracking and unique link parameters are the practical responses, and affiliates should verify tracking actively rather than assume it works.