Clicks, Cookies, and Commissions — How Affiliate Tracking Actually Works

The Commission Chain · Post 02 of 09

How The Money Actually Moves

Clicks, Cookies, and Commissions

A click and a sale can happen minutes or months apart, on two different devices. Here's the plumbing that connects them — and why that plumbing broke in 2026.

Tracking · Attribution · Commission Models

30-day standard window

S2S is now dominant

4 commission models

The Core Problem

How do you prove who sent the customer?

Every affiliate program is really solving one problem: a person clicks a link on someone else's website, then — sometimes immediately, sometimes three weeks later, sometimes on a different device entirely — they buy something. The program has to connect those two moments and pay the right person for it.

That connecting work is called attribution, and the basic flow behind almost every affiliate sale looks the same, whatever the underlying technology:

01

Affiliate posts a tracked link

→

02

Reader clicks it

→

03

Click ID is stored somewhere

→

04

Reader buys (maybe weeks later)

→

05

Sale is matched back to the click

The Old Way

Cookies and pixels — the original plumbing

For most of affiliate marketing's history, step three was handled by a cookie — a small file dropped in the visitor's browser the moment they clicked. Step five was handled by a tracking pixel: a near-invisible image on the "thank you" page that quietly reports the sale back to the network, tagged with whichever affiliate's cookie is sitting in that browser.

The industry standard cookie window has long been 30 days — click today, buy within a month, still get credited. Programs with longer purchase cycles, like SaaS subscriptions, commonly stretch that to 60 or 90 days, since a software buying decision rarely happens in one sitting.

"If the cookie duration is 30 days and someone buys on day five, you still get credited. Without a cookie at all, that sale simply disappears."

The catch: this whole system depends on the browser agreeing to store and forward that cookie. And in 2026, browsers largely stopped agreeing to.

The Shift

Why "cookieless" stopped being a warning and became the default

2020–24

The warnings

Safari and Firefox had already restricted third-party cookies for years; Chrome announced it would follow, and the affiliate industry treated it as a slow-moving future problem.

2026

The future arrives

Third-party cookie deprecation became "an operational reality" rather than a forecast, with Chromium-based browsers finalizing restrictions alongside Safari and Firefox's longstanding limits.

Now

Server-to-server takes over

Server-to-server (S2S) postback tracking — where the sale is confirmed directly between servers, no browser cookie required — has become the dominant, most accurate tracking method of 2026.

Two forces made this urgent rather than optional: browser privacy engineering, and simple ad-blocker math. With roughly a third of internet users globally now running an ad blocker, any program still relying purely on browser-fired pixels is quietly undercounting its own conversions.

The New Stack

What replaced the cookie

Modern tracking rarely relies on one method — it layers several, so that if one signal gets blocked, another still gets through:

First-party cookies

Set on the retailer's own domain rather than a network's — far more resilient to browser blocking

S2S postbacks

Servers confirm the sale directly to each other; no browser script to block at all

Durable click IDs

A generated, anonymous identifier ties a later conversion back to the original click

Deterministic email match

With consent, matching by email lets programs track a purchase across different devices entirely

The tradeoff running through all of it is privacy compliance: any of these methods now has to satisfy GDPR- and CCPA-style consent requirements, which is part of why "first-party and server-side" has become the industry's working answer rather than any single silver-bullet technology.

Getting Paid

The four ways commissions actually get calculated

Attribution answers "who sent this customer." The commission model answers "how much do they get paid, and for what."

• CPS
  Cost Per Sale (revenue share) The affiliate earns a percentage of the sale — the original Amazon Associates model, and still the most common structure in e-commerce.
• CPA
  Cost Per Action A flat payout for a specific action — a completed signup, a funded account, a submitted lead — regardless of the transaction's dollar value. Common in finance and iGaming.
• CPL
  Cost Per Lead Payout for a qualified lead reaching the advertiser — a filled-in form, a booked call — before any sale has happened at all. Common in B2B and insurance.
• RS
  Recurring revenue share Common in SaaS: the affiliate keeps earning a cut for as long as the referred customer stays subscribed, not just on the first payment.

The Bottom Line

Same question, sturdier answer

The question affiliate tracking exists to answer hasn't changed since 1996: who sent this customer, and what do they get paid for it. What's changed is the plumbing — from a single browser cookie that quietly does all the work, to a layered stack of first-party data, server-to-server confirmation, and durable click IDs built specifically to survive a browser that no longer wants to cooperate. The programs that adapted their tracking stack this year are the ones still getting an accurate bill for who actually deserves the commission.

Tracking-method details reflect 2026 industry reporting on cookie deprecation, ad-blocker penetration, and server-to-server adoption; specific attribution windows and payout terms vary program to program and are worth confirming directly with each network.

← 01 / Origins & History 03 / Major Networks & Reviews →

The Commission Chain — a short history of affiliate marketing

Read More: This article also appears at ScienceAffiliate.com.