Affiliate Tracking Without Cookies

The durable chain

Step	Mechanism	Failure to engineer against
Click	Affiliate link carries a click ID; your landing infrastructure persists it server-side	Parameter stripped by a redirect or app-store hop nobody mapped
Registration	Click ID written into the registration record within the declared window	The click-to-signup gap: delayed conversions and cross-device journeys need a written policy, not an assumption
Qualification	Commissionable events (FTD, deposit thresholds, activity gates) computed from the wallet, joined by player key	Commission logic forked between the affiliate platform and the warehouse — one source computes, the other displays
Postback	Server-to-server notification per commissionable event, idempotent, logged	Fire-and-forget postbacks with no retry, no log, no reconciliation
Settlement	Invoices reconciled against the postback log, clawbacks per written terms	Paying on the affiliate platform's numbers without an independent check

Every step is first-party or server-to-server. The cookie deprecation took away nothing this chain needs — what it took away was the excuse for running affiliate attribution on pixels in the first place.

The three policies to write before the first dispute

The attribution window. How long a click claims a registration, and what happens across devices. Declared in the affiliate terms, enforced in code, versioned when it changes.
The precedence rule. Affiliate vs paid vs organic when journeys overlap — one rule, applied at registration, reflected identically in commission payouts and in the media-buy reporting. The silent double-credit between the affiliate ledger and the ROAS deck is the most common and most expensive inconsistency in iGaming acquisition math.
The clawback rule. Fraud, self-referral, chargeback and bonus-abuse cases: which commissions reverse, on what evidence, within what period. Written into terms while the relationship is friendly.

Quality: cohort the traffic, not the promises

Affiliate quality management is cohort analysis with a commercial consequence: per-affiliate cohorts on the standard four choices (anchor, window, filters, censoring), compared against the portfolio on retention, deposit behaviour and Reg2Dep. An affiliate whose cohort diverges sharply from every other source on the same offer is a conversation; one whose cohort is populated by multi-account clusters is a case. The protection boundary applies here too — affiliates never receive player-level data beyond the commission events, and suppression lists are never shared outward.

Reconciliation: the invoice is a query

Month-end affiliate settlement should be mechanical: the postback log is the shared truth, the warehouse recomputes commissionable events independently, differences are explained by the declared rules or escalated as incidents. If settlement requires a spreadsheet negotiation each month, the missing artefact is always the same — a logged, idempotent, mutually visible event chain. Build the chain once; the negotiations end.

Continue reading: Media buy measurement — the paid-channel half of the same precedence discipline. Media buy — the glossary definition.

Affiliate tracking — common questions

How does affiliate tracking work without cookies at all?

The durable chain is: affiliate link carries a click ID → the click ID lands in the registration record at signup (first-party, server-side) → every commissionable event afterwards is attributed by joining the player key to that stored ID, and reported to the affiliate by server-to-server postback. No third-party cookie appears anywhere in that chain — which is why affiliate attribution, done right, survived the cookie deprecation with less damage than paid-social attribution did.

What breaks the click-to-registration link in practice?

The unowned gap between click and signup: app-store hops, aggressive in-app browsers, players who click today and register next week from a search result. The engineering answers are a server-persisted click ID with a declared attribution window, resilient parameter carry-through across every landing flow (including the ones marketing forgot exist), and an explicit policy for the returning-organic case — because the dispute is never about the players who converted in one session.

How should affiliate and paid-channel attribution be deduplicated?

By one written precedence rule applied at the moment of registration, not at invoice time: which source wins when a player touched an affiliate link and a paid ad, within which windows. Any rule is defensible if declared; what is indefensible is paying an affiliate CPA and crediting the same FTD to a paid campaign in the ROAS deck — double-counting that inflates both channels and quietly funds the same player twice. This is a dictionary problem before it is a payments problem: see the metric dictionary.

What fraud controls does cookieless affiliate tracking need?

The classics, all of which live server-side anyway: multi-accounting and self-referral detection (the same identity discipline as bonus abuse), traffic-quality cohorting per affiliate (an affiliate whose players behave unlike every other cohort on the same offer is a signal), incentivised-traffic markers, and commission clawback rules written into the terms before the first dispute rather than after it.

What makes an attribution dispute with an affiliate resolvable?

A shared, declared source of truth: the postback log with click IDs, timestamps, the precedence rule version and the attribution window in force — retained and queryable per player. Disputes become lookups when both sides agreed the rules up front and the operator can produce the chain per case. They become relationship damage when attribution lives in a black box either side can accuse.

Affiliate tracking, cookieless.

The durable chain

The three policies to write before the first dispute

Quality: cohort the traffic, not the promises

Reconciliation: the invoice is a query

Affiliate tracking — common questions

See it on a live stack.