How Affiliate Tracking Works: Cookies vs Server-Side

Affiliate tracking records which partner sent a customer, then credits that partner when the customer pays. The older way keeps the partner's ID in a browser cookie until checkout. The sturdier way, now normal for SaaS, uses the cookie only until signup, then stores the partner on the customer's account and ties commission to the billing system's paid invoices through a webhook. After signup, nothing depends on the browser keeping a cookie.

The difference matters because browsers have been shortening the life of tracking cookies since at least 2019, and Safari in particular can cut a 90-day window down to seven days. Here's how each piece works, and which parts still break.

The four steps from click to commission

1. Click. An affiliate's link (yourapp.com/?via=jane or a redirect such as go.tracker.com/jane) is clicked. The tracking system logs the click and generates a visitor or click ID.
2. Store. That ID is kept somewhere it'll survive until the visitor converts: a cookie, local storage, or a parameter carried through the signup form.
3. Signup. When the visitor creates an account, the ID is read and the new customer record is linked to the affiliate.
4. Payment. When the customer pays, the payment is matched to that customer, the commission rule runs, and commission accrues. A refund reverses it.

Every tracking method is some variation on where step 2 keeps the ID and how step 4 learns about payment. The weak link in most setups is step 2, because the browser decides how long the ID lives.

Third-party and first-party cookies

A third-party cookie is set by a domain other than the site you're on, such as an affiliate network's domain while you're on the merchant's site. A first-party cookie is set by the site you're on.

Third-party cookies are mostly gone for affiliate purposes:

• Safari has blocked cookies for cross-site resources by default since Safari 13.1 and iOS 13.4, announced by WebKit on 24 March 2020.
• Firefox turned on Total Cookie Protection by default for all desktop users worldwide in June 2022, giving every site its own cookie jar so a tracker can't link activity across sites.
• Chrome still allows third-party cookies, with the user deciding in settings. Google said on 22 April 2025 that it would not roll out a new standalone prompt for third-party cookies, and on 17 October 2025 it retired most Privacy Sandbox technologies, including the Attribution Reporting API, while keeping CHIPS and FedCM. As of October 2026 we found no later Google announcement changing that.

So third-party cookies still work in Chrome for users who haven't blocked them, and not in Safari or Firefox by default. Any tracking that depends on them will undercount, and by an amount you can't easily measure.

First-party cookies are the standard fix: the tracking script on your own domain reads the click ID from the URL and stores it in a cookie on your domain. But first-party isn't the end of the story in Safari.

What Safari's ITP does to first-party cookies

Safari's Intelligent Tracking Prevention (ITP) puts limits on first-party storage too. Three rules matter for affiliate tracking:

Cookies written by JavaScript are capped at 7 days. Since ITP 2.1 (February 2019), persistent cookies created through document.cookie get a maximum seven-day expiry. A tracking script that sets a "90-day" cookie in the browser actually gets 7 days in Safari. Revisiting the site and re-setting it restarts the 7 days.

Script-writable storage is deleted after 7 days without interaction. Since March 2020, Safari deletes a site's local storage, IndexedDB and similar storage after seven days of Safari use without the user interacting with that site. Moving the ID from a cookie into local storage doesn't escape the cap.

Cookies set by servers on a "third-party" IP address are capped at 7 days. WebKit landed a change in October 2022 titled "Cap cookie lifetimes to 7 days for responses from third party IP addresses" (WebKit bug 246477). This targets setups where a tracking vendor's server is mapped onto a subdomain of your site: the cookie looks first-party, but it's set by infrastructure that isn't yours. The bug doesn't publish the exact matching rule, so test your own setup in Safari rather than assuming you're exempt.

A fourth change affects links rather than cookies. Safari 17's Private Browsing added blocking for "known tracking query parameters in links", per WebKit's WWDC23 post. The post doesn't list which parameters, so if you rely on a custom URL parameter, check it in a private window.

Here's what the 7-day cap means in practice. Of the 82 programs in our directory that state a cookie window, the median is 90 days. Suppose a visitor clicks an affiliate review on an iPhone, leaves, and comes back directly 12 days later to sign up. With a JavaScript-set cookie, Safari has already expired it, and the affiliate gets nothing, despite a 90-day policy. With a cookie set by your own server in an HTTP response, it's still there.

Server-side tracking

"Server-side" covers a few related techniques. They all move the important records off the browser.

Server-set first-party cookies

Your own server, not a script, sets the cookie in the HTTP response when the visitor lands with a click ID. It isn't subject to the JavaScript cap, so it can last as long as your window says, provided it's set by your own infrastructure. This is the cheapest improvement for most sites.

Attach the affiliate at signup

At signup, read the click ID (from the cookie or the URL) and save the affiliate on the user record in your database. From then on the attribution lives in your data, not in the browser. The cookie only has to survive from click to signup, which for a SaaS product with a free trial or free plan is usually the same visit or a few days later.

Billing webhooks

Pass the customer or affiliate reference into your billing system, then let the billing system tell the tracker when money arrives. With Stripe Checkout, the client_reference_id parameter takes a string of up to 200 characters to reconcile the session with your own records, and metadata holds key-value pairs:

const session = await stripe.checkout.sessions.create({
  mode: "subscription",
  line_items: [{ price: "price_123", quantity: 1 }],
  client_reference_id: user.id,
  metadata: { affiliate_id: user.affiliateId ?? "" },
  success_url: "https://yourapp.com/welcome",
});

When Stripe sends the paid-invoice and refund events to your webhook, the tracker matches them to the customer and accrues or reverses commission. Every renewal pays the affiliate without the browser being involved, which is the only sane way to pay recurring commission for 12 months or for life.

Postbacks

A postback (server-to-server or S2S tracking) is the network version of the same idea. The click ID is passed to your site in the link; when a conversion happens, your server calls the network's postback URL with that click ID and the order value. No cookie is needed on either side. It's common on affiliate networks and with media buyers, and it needs a developer to set up on your end.

Coupon codes and link-less attribution

A coupon code assigned to one affiliate attributes the sale with no cookie at all, which is why podcasts and YouTube rely on them. The cost is leakage: codes get posted on coupon sites and credit the affiliate for customers who were going to buy anyway. If you use codes, decide in your terms whether a code beats a link click (most programs say it does), and whether coupon sites are allowed. Our brand bidding guide covers the related rules.

First click, last click and multi-touch

When two affiliates touch the same customer, the attribution model decides who gets paid. Last click (the most recent affiliate link before signup) is the default in most tools. First click rewards the affiliate who introduced the customer. Programs in our directory do both: Envato states first-click attribution with a 90-day cookie, Sendcloud states last-click, and Hostelworld credits the last click within 30 days of the first click.

Multi-touch, splitting credit across several affiliates, is fairer in theory and hard to explain to affiliates in practice. For an affiliate program we'd pick last click, write it into your terms, and only revisit it if your affiliates are mostly top-of-funnel educators who keep losing credit to coupon sites.

Self-referral and fraud checks

Server-side data makes fraud checks easier, because you can compare the affiliate's own account with the customers credited to them. Common checks:

• the same card fingerprint, billing email or company domain on the affiliate's account and a "referred" customer;
• many signups from one IP address or device in a short period;
• clicks with no page view, or a click and conversion seconds apart, which can point to cookie stuffing;
• refunds clustered right after commission is paid.

Hold commission for at least your refund window before it becomes payable. That alone removes most of the incentive for the obvious frauds.

How PartnersWatch tracks

PartnersWatch is our product, so here's how it does this, briefly. The Track side gives each partner links and coupon codes. Our redirect records the click and adds a visitor ID, and the pw.js script stores it in a first-party cookie on your domain and calls pw.signup() when the customer signs up. Native webhooks for Stripe, Chargebee, Recurly and Paddle turn paid invoices into commission, and refunds claw it back automatically. Free trials don't pay commission until the first paid invoice. The cookie window and first- or last-touch can be set per program, and a self-referral guard is built in. A server-to-server conversion API covers anything that isn't a billing event.

Programs in our directory that state their attribution rules:

If you're setting up the program around the tracking, how to recruit affiliates and how partner payouts work are the next two steps.

FAQ

How does affiliate tracking work?

Affiliate tracking gives each affiliate a unique link or code, records the click, and stores an ID until the visitor signs up or buys. The sale is then credited to that affiliate. In modern SaaS setups the affiliate is saved on the customer's account at signup, and payments are confirmed through billing webhooks.

Do affiliate cookies still work in Safari?

Partly. Safari blocks third-party cookies by default and caps cookies written by JavaScript at seven days, even on your own domain. Cookies set by your own server in an HTTP response last longer. Attaching the affiliate to the customer at signup avoids most of the problem.

Is Chrome getting rid of third-party cookies?

Not as of October 2026. Google said in April 2025 it would keep users' existing third-party cookie choice in Chrome settings and not launch a new prompt, and in October 2025 it retired most Privacy Sandbox APIs. Third-party cookies still work in Chrome unless the user blocks them.

What is server-side affiliate tracking?

Server-side affiliate tracking records referrals and conversions on servers instead of relying on browser storage. Typical pieces are cookies set by your own server, saving the affiliate on the user record at signup, billing webhooks for payments, and postbacks between your server and a network.

What is a postback URL in affiliate marketing?

A postback URL is an address on the tracking platform that your server calls when a conversion happens, passing the click ID and order value. It credits the affiliate server to server, so no browser cookie is needed.

How do I track affiliate sales with Stripe?

Save the affiliate on your user record at signup, pass your user ID as client_reference_id or in metadata when you create the Checkout Session, and have your tracking tool listen to Stripe's payment and refund webhooks. Each paid invoice then accrues commission and each refund reverses it.