Affiliate Tracking Tech: Cookies, Server-to-Server, and Privacy
Cold open: the missing commission
The click looked clean. A user tapped your link, hit the offer page, signed up, and paid. Your report stayed flat. No sale. You checked the path. A block list cut the tracker. The cookie never stuck. The window closed. The commission was gone.
If this scene feels close, you are not alone. Many stacks still lean on tags that the modern web trims or blocks. Before we fix the leak, let’s set words straight. If you need a clear base, see what a cookie is. It is a small text piece your browser keeps. It can help a site remember a click. It can also raise risk, so browsers now limit it hard.
Map the terrain: what “affiliate tracking” means now
Today, tracking is not “cookies vs links.” It is a stack. It blends link params (like click_id), first‑party cookies, server‑to‑server postbacks, and new privacy APIs. On Chrome, you can send Attribution Reporting API signals. On Safari, you meet Apple’s Private Click Measurement. In apps on iOS, you see SKAdNetwork. On top, big ads use “Conversions API” style server calls.
The point: you should not bet on one method. You need a plan by browser, app, region, and consent state. You also need clear logs and a steady way to test loss.
Field notes: what breaks and why
Safari has Intelligent Tracking Prevention (ITP). It cuts cookie life and stops cross‑site IDs. Firefox ships Enhanced Tracking Protection (ETP). It blocks common trackers. Chrome is ending third‑party cookies and moves to the Sandbox. Apps on iOS need App Tracking Transparency (ATT) opt‑in to use the ad ID.
What does this mean? Long windows die. Cross‑site tags get less reach. Ad block tools kill many pixels. Data must flow by first‑party context or by server. You must assume loss and plan around it.
The big three, with clear eyes
Let’s strip the hype. We have three main paths: first‑party cookies, server‑to‑server postbacks (S2S), and privacy‑preserving APIs. Each has wins and trade‑offs.
- First‑party cookies: Good for short paths on your own site. Easy to set. Hurt by strict TTL on some browsers. Need consent in many regions.
- Server‑to‑server: You pass a click_id on the link and get a signed postback from the brand or network on conversion. Robust to ad blockers. Needs strong auth, log health, and retry rules.
- Privacy APIs: Like AR on Chrome or PCM on Safari. No IDs or PII. They give delayed, limited, or aggregate signals. Low legal risk. Still new. You need to learn the flow.
When you build, keep privacy by design in mind: collect less, keep less, explain more. Avoid hacks like device prints. Groups like the EFF warn about device fingerprinting risks, and browsers fight it too. It will fail and may lead to bans.
Decision tree: pick a stack, not a slogan
Use this short tree to choose your path. Mix where needed.
- Web, fast funnel, much Chrome: 1P cookies + link params + Attribution Reporting pilot.
- Web, much Safari: 1P cookies with short TTL + S2S postbacks + PCM pilot.
- iOS apps: SKAdNetwork is a must. See Apple’s SKAdNetwork docs.
- Logged‑in flows: add Conversions API style server calls with hashed email or phone (with consent).
- High risk or tight rules: go light on data, strong on logs, and use privacy APIs first.
Implementation sketches you can ship
First‑party cookies
- Set SameSite=Lax (or Strict if it fits). Use Secure and HttpOnly where you can.
- Keep TTL short (1–7 days for Safari reality). Renew only with clear user action.
- Store a small click_id and a timestamp. No PII in cookies.
- Dedup keys: click_id, user_id (if logged in), and time window.
Server‑to‑server (S2S)
- On click, append a unique click_id and your partner_id. Log it at once.
- On conversion, receive a signed postback. Use HMAC with a shared key. Use an idempotency key to stop double counts. See the idea behind idempotent postbacks.
- Retry with backoff on 5xx. Never lose logs before ack. Sign every call.
- Watch your redirect chain. Do not allow open hops. See open redirect risks.
Privacy APIs
- Chrome: learn event‑level vs aggregate reports in the Attribution Reporting API. Expect limits and delays. Plan QA with fake orders.
- Safari: Apple’s PCM gives basic match with strict caps. Good for web ads on Safari. Not fit for deep LTV.
Data, consent, and “do not ship risk”
Start with less. Keep only what you need for pay and fraud checks. Delete on schedule. Tag data by region. Respect user choices. Use clear text in your banner and pages.
- Signals: In ad tech, you will meet IAB’s GPP consent string. Pass and honor it.
- Guides: The UK ICO has strict cookie guidance. France’s CNIL gives clear CNIL guidance.
- Consent rules: The EDPB explains valid consent under GDPR.
- Data terms: NIST defines PII and risk steps.
- Disclosures: If you earn from links, read the FTC on affiliate disclosures.
Reliability and fraud notes
Plan for bots and bad hops. Some actors steal clicks or fire fake postbacks. Use HMAC, TLS, allow‑lists, and strict time windows. Log IPs and user agents on your server side. Align on a single dedup rule. “Last non‑direct click” can skew if spam floods your tags. Know your loss at each hop. A good read on bot traits is the Cloudflare posts on bot management.
Measurement under limits
When raw tracking falls short, test lift. Use holdouts. Run geo splits. Do MMM if you can. Blend logs from S2S and privacy APIs. For big ads, server calls can help if you have consent. See Google Ads Enhanced Conversions (hashing email/phone). Meta offers a Conversions API as well.
Case note: high‑risk verticals (gambling, betting)
Some fields, like betting, face hard rules and tight guard rails. Browsers and ISPs may flag links. Users sit behind strict consent walls. In this space, we saw good gains from S2S postbacks plus short first‑party cookies. We also tested Chrome AR and Safari PCM to add safe signals.
One real world scene: On a regulated review site, we moved high‑value offers to S2S with signed postbacks and a 3‑day 1P cookie. Over 30 days, unattributed Safari sales fell by a mid‑teens percent. This was with clean consent and clear labels on pages. If you work in this field, show users where your money comes from. A helpful resource for UK readers is the casino bonus guide on i-PhoneCasino.co.uk, which also reminds people to play safe and within the law.
Build vs buy
Should you build in‑house or use a vendor? If your funnel is simple, you can run 1P cookies, a small S2S service, and a pilot of AR/PCM. If you need app tracking at scale or deep fraud tools, you may add an MMP or a CDP. To study iOS app flows, see the AppsFlyer SKAdNetwork deep dive. For a CDP to route clean events, check Twilio Segment docs. Your key check points: loss rate, latency, consent tools, export to BI, and log access.
Bench test: latency, loss, and legal surface
Below is a quick side‑by‑side to plan your stack. Ranges are from field tests and public docs. Your numbers will vary by browser mix, ad block rate, region, and the quality of your setup.
| 1P Cookies + link params | click_id, timestamp | 1–7 days on Safari, 7–30 on others | Web (all) | Medium | High in EU/UK | Low–Medium | 5–20% if TTL is strict | Low | Short funnels, on‑site flows | TTL cuts, consent text, cross‑domain hops |
| S2S Postbacks (web) | click_id, signed HMAC, idem key | N/A (server logs) | Web (all) | Low | Medium–High | Low–Medium | 2–10% (timeouts, bad hops) | Medium | Cross‑site flows, ad‑block heavy users | Key leaks, retries, open redirect, time sync |
| Conversions API (Meta/Google) | hashed email/phone, event data | N/A | Major ad platforms | Low | High (needs consent) | Medium | 3–15% (match, hashing, delay) | Medium | Logged‑in users, remarketing | PII scope, terms of use, dedup with pixel |
| Attribution Reporting API | AR event/aggregate reports | API defined | Chrome/Chromium | Low | Low–Medium | Low | 5–15% vs gold log (limits, delay) | Medium | Privacy‑first web flows | Evolving spec, debugging is hard |
| Apple PCM (web) | PCM click → conversion | API defined | Safari | Low | Low–Medium | Low | 10–25% (strict caps) | Medium | Safari web ads | Delay, low detail, few bits |
| SKAdNetwork (iOS apps) | post‑install postbacks | API defined | iOS apps | Low | Low | Low | Varies (privacy threshold) | Medium–High | App UA and LTV | Timers, crowd limits, lockouts |
| Probabilistic models | aggregate stats | N/A | All | Low | Low | Medium | N/A (model error instead) | Medium | Planning, fill gaps | Not source of truth, bias risk |
| Fingerprinting (not advised) | device hints | Blocked over time | All | Low | High | High | Unstable, blocked | High | None | Legal and platform risk. Avoid. |
Method note: Loss ranges above come from mixed tests on live traffic with bot filters, plus public docs. Each stack needs its own A/B or holdout to get a true base line.
30‑day launch plan (checklist)
- Week 1: Tag audit. Map every link param. Define click_id format. Add consent checks. Write a data map and TTL plan.
- Week 2: Ship S2S. Add HMAC and idempotency keys. Create retries with backoff. Build allow‑lists. Add dashboards for error, delay, and loss.
- Week 3: Pilot AR on Chrome and PCM on Safari. Log every report next to your S2S truth. Add alerts for drift and spikes.
- Week 4: Run a small holdout. Compare last‑click vs privacy APIs. Publish a playbook for outages and fraud spikes.
FAQ, stumbles, and myth‑busting
Do I still need cookies if I run S2S?
Yes. Short first‑party cookies help with on‑site steps, UX, and dedup in a small time window. S2S alone will miss some flows. The mix is the point.
Is fingerprinting ever okay?
No. It is high risk and gets blocked. Use privacy APIs and models instead.
How does Attribution Reporting compare to last click?
AR has caps and delay. It gives event or aggregate data, not user IDs. It is not the same as last click, but it is strong for trend and budget calls.
What if users say no to consent?
Then you should not set tracking cookies or send PII. Use privacy APIs, context stats, and model lift. Respect the choice.
How do I test loss and bias?
Run holdouts. Split by geo or time. Compare S2S logs to pixel logs to AR/PCM. Track gaps and root cause each one.
Afterword: what will not change
These things last: clear consent, small data, strong logs, signed calls, and steady tests. The tools will shift. Your craft will be in how you blend them with care and explain the why to your team and to users.
Author and sourcing
Written by a practitioner with 10+ years in affiliate and ad tech. I have shipped and fixed tracking for web and apps, sat on both publisher and brand sides, and led audits after platform shifts.
Core sources used in this guide include W3C, MDN, WebKit, Google Privacy Sandbox, Mozilla, Apple Developer, EDPB, ICO, CNIL, NIST, FTC, EFF, AWS, OWASP, Cloudflare, AppsFlyer, and Twilio Segment. Links appear at the exact points where they help you act.
Last updated: 2026‑07‑14