What is Cookie Stuffing?
Cookie stuffing (cookie dropping) is an attribution fraud technique that sets an advertiser's affiliate cookie on a user's device without a click on the partner link—via hidden iframes, pop-unders, browser extensions, or malicious site scripts.
How the scheme works
The user later purchases from the merchant directly (organic or brand search). The stuffer earns commission despite driving no traffic. Merchants lose margin; honest affiliates see lower EPC. In CPA networks, cookie stuffing leads to permanent bans and payout clawbacks.
Investigation signals
- High CR with minimal or zero click traffic in the tracker.
- Low AOV and short path to purchase without landing visits.
- Merchant complaints about excess affiliate commissions.
Networks use click forensic logs, click-id ↔ conversion-time correlation, and iframe-drop blocks on their domains.
Legitimate cookies vs stuffing
Normal attribution: the user clicked a tracking link, the cookie was set transparently, conversion falls within the cookie window. Stuffing is silent placement without consent or a click path.