Affiliate Marketing

The payment mechanism is the dispute

Affiliate marketing pays a third-party publisher a commission on sales attributed to it. The attribution rule in almost universal use is last click: whichever affiliate link the buyer touched most recently before purchasing gets the credit. That combination creates a direct financial incentive to be the last click, regardless of whether the publisher did anything to cause the purchase, and every documented affiliate fraud pattern is a variation on that single theme.

Understanding last click as a credit-allocation rule rather than a causal finding is not an academic point in this channel. It is the payment mechanism. A merchant who chose last click has chosen a rule that pays the party closest to the transaction, and a publisher who engineers proximity to the transaction is exploiting the merchant's own choice. Whether that is fraud, a breach of program terms, or a permitted business model is answered first by the contract and only then by the data — and an affiliate marketing expert witness who begins with the data and works backward to the terms usually ends up defending a conclusion the terms do not support.

Cookie stuffing, and what it looks like in a click log

Cookie stuffing — also called cookie dropping or forced clicks — sets an affiliate's tracking cookie in a browser without the user clicking any affiliate link. The delivery is typically an invisible iframe, a one-by-one image, or a scripted redirect through the merchant's tracking server. If the user later buys from the merchant by any route at all, the last-click rule credits the party that stuffed the cookie.

The pattern is visible in a click log and invisible in a commission summary. In the log it appears as clicks with no plausible referring page, or with a referrer that is an unrelated site, or in volumes wildly out of proportion to the publisher's own traffic, or with click-to-conversion intervals measured in seconds on users who were already on the merchant's site. Related patterns share the same signature: typosquatting on the merchant's brand, toolbar and extension injection, forced clicks inside ad units, and adware that rewrites affiliate parameters. The analysis is pattern analysis and it is inferential. That has to be stated, because on its face a single stuffed cookie and a single genuine click can look the same, and the strength of the opinion comes from the distribution rather than from any one record.

The eBay prosecutions, with the government's own figures

The best-documented cookie-stuffing matters are the federal prosecutions arising from eBay's affiliate program in the Northern District of California. Brian Andrew Dunning was indicted on 24 June 2010 on five counts of wire fraud, pleaded guilty on 15 April 2013 to a superseding information charging wire fraud under 18 U.S.C. § 1343, and was sentenced on 4 August 2014 to 15 months in prison and three years of supervised release. The Department of Justice described the conduct as free-application websites whose code “would cause the user's browser to receive a cookie with KFC's ID number, even though the user did not click on an eBay ad or link,” KFC being the company through which he participated in the program.

The numbers matter, because the ones in circulation are wrong. Popular accounts describe a $35 million or $28 million eBay affiliate fraud. DOJ's own releases state that eBay paid that company approximately $5.2 million in commissions between May 2006 and June 2007, and put the fraudulent portion at between $200,000 and $400,000. An expert who repeats the larger figure will be asked for its source and will not have one. A second defendant, Shawn Hogan, was prosecuted in the same investigation; there does not appear to be a published opinion in that matter, so it should be identified by its docket rather than by a reporter citation, and its terms taken from the docket rather than from trade press.

The civil case is the better citation, and it holds less than it is said to hold

The published decision in this area is eBay Inc. v. Digital Point Solutions, Inc., 608 F. Supp. 2d 1156 (N.D. Cal. 2009), decided by Judge Fogel on motions to dismiss the first amended complaint. eBay alleged that the defendants placed software code on a user's computer surreptitiously and directed the browser to eBay's site without the user's knowledge or any affirmative action, depositing affiliate cookies and drawing commissions on conversions the defendants did not generate.

What the court actually did is narrower than the way the case is usually described. It allowed the Computer Fraud and Abuse Act claim under 18 U.S.C. § 1030 to proceed, rejecting the argument that a publicly accessible website cannot be a protected computer. It dismissed with leave to amend the RICO claim for insufficient particularity as to enterprise and pattern, and the California Penal Code § 502 and common-law fraud claims under Rule 9(b). It found venue improper as to certain non-party-affiliated defendants under a forum selection clause in eBay's publisher agreement. It is a pleadings decision. It does not hold that cookie stuffing violates the CFAA as a matter of law and it makes no findings of fact, and marketing writing that describes it as a merits ruling is describing something that did not happen.

Browser extensions, and the question a court actually asked

The most recent test of last click as a mechanism came from the consolidated litigation over the Honey browser extension owned by PayPal. Content creators and affiliate publishers alleged that the extension replaced their affiliate tracking with its own at checkout — taking the last click and therefore the commission — even where it found no coupon and contributed nothing to the sale. Following argument in November 2025 the court dismissed the claims without prejudice, finding on the reporting available that the plaintiffs had failed to plead injury traceable to the extension and had failed to plead facts showing they were entitled to the commissions in the first place. That reporting comes from counsel for the prevailing side, a dismissal without prejudice is not a final judgment, and the current posture should be checked on the docket before anyone relies on it.

The stated ground is what makes the matter useful regardless of outcome, because it is exactly the analysis a marketing expert supplies. What did the program terms say about attribution? What did the click and conversion logs record? Would this publisher have been paid under the applicable rule if the extension had not acted? Those are answerable from network data. Who deserved the sale is not.

What the networks record, and how each record is obtained

The major networks serving US commerce are Impact.com, CJ, Rakuten Advertising, ShareASale and Awin, and PartnerStack. The largest single program, Amazon Associates, is not a network but a first-party program, and it is a special case: reporting is aggregated to the day and product level and individual click logs are not exposed to associates at all.

A network transaction record typically carries the publisher identifier, the click identifier, the click timestamp, the landing page, the referring URL, the conversion timestamp, the order value, the commission and the attribution decision. On the click side there is a full click log with address, user agent and referrer. The route to each depends on posture. Where the client is the merchant, network reporting is contractual and available without process — but raw click logs are frequently not exposed in the standard interface and have to be requested specifically, which is the most common reason a merchant-side analysis stalls. Where the client is the publisher, only its own side is visible. Where the adverse party is the network, a subpoena is required. Retention periods for click logs are not uniformly published; the practical step is to ask each network in writing, early, in a form that can be put into evidence.

Coupon sites, trademark bidding, and the contract question underneath

A large share of affiliate disputes are not about fraud at all. A shopper who has already decided to buy searches for a discount code, lands on a coupon site, clicks through and completes the purchase. The coupon site takes the commission on last click. Whether that is theft, arbitrage or the ordinary consequence of the merchant's own attribution choice depends entirely on the program's terms — many merchants expressly exclude or reduce coupon-site commissions and many do not. It is a contract question first and a marketing question second, and the strongest argument on the other side is simply that the merchant chose last click.

The affiliate dispute that most often reaches litigation is a publisher bidding on the merchant's trademark in paid search, because it implicates the merchant's own search performance and its trademark rights at the same time. The evidence there is drawn from both the affiliate network and the search platform, and the two records are kept on different clocks, which is a reason to identify the theory early rather than after one of them has expired.

What the affiliate record does not settle

Commission reports do not establish that an affiliate caused a sale. They establish that the network's attribution rule assigned credit for it. Those are different propositions, and the gap between them is exactly what the Honey dismissal turned on — whether a publisher was entitled to the commission in the first place.

A click log cannot always separate a stuffed cookie from a genuine click on the face of a single record. Distinguishing them takes pattern analysis — referrer plausibility, click-to-conversion interval, volume relative to the publisher's own traffic — and the conclusion is inferential rather than direct. An honest report says so and shows the distribution.

Nor does the record identify a person. A click log carries an address, a user agent and a timestamp; connecting those to a named actor generally requires payment records, communications, or third-party logs that no affiliate network holds. And where the program is Amazon Associates, the click-level layer does not exist for the publisher at all, so an analysis of that program starts from aggregated reporting and has to concede the limitation rather than reason around it.

Frequently Asked Questions

Published 2026-08-12