Affiliate Tracking Explained: Cookies, Coupon Codes and Attribution

Affiliate tracking is the machinery that decides who gets paid. When it works, nobody thinks about it. When it fails, your best affiliate emails you screenshots of traffic they sent and commissions they never received — and then stops promoting you.

This guide explains how tracking actually works in 2026: the two mechanisms in common use, how attribution windows and models decide contested sales, what breaks tracking in practice, and how to stay compliant with GDPR while still paying people accurately.

How Affiliate Tracking Works

Every affiliate referral follows the same four-step path, regardless of platform:

1. Identification. The affiliate receives a unique identifier, embedded in a link (yoursite.com/?ref=sarah) or in a coupon code (SARAH20).
2. Click. A visitor follows the link. The identifier is recorded and stored in the visitor's browser as a cookie, along with a timestamp.
3. Conversion. The visitor subscribes. At checkout, the system checks for a stored identifier still inside its validity window.
4. Attribution. If one exists, the sale is credited to that affiliate and a commission is calculated against the payment.

The complications all live in step 2 and step 4. Browsers have spent a decade making step 2 less reliable, and step 4 is where two affiliates both claim the same customer.

Cookie Duration: How Long Should the Window Be?

Cookie duration is the period after a click during which a conversion still counts. It is the single most-scrutinized setting in your program, because it directly determines how much of an affiliate's traffic ever pays out.

The right length follows your sales cycle:

• 7-14 days: Impulse purchases and low-priced consumer tools. Rare in B2B SaaS and generally read by affiliates as stingy.
• 30 days: The SaaS default. Covers a typical evaluate-then-decide cycle for self-serve products.
• 60-90 days: Products with committee purchases, longer trials, or high price points. A genuine recruiting advantage — affiliates notice, and it costs you very little because most conversions still happen in the first two weeks.
• 180-365 days: Enterprise tools with multi-month evaluations. Uncommon, but it makes your program stand out in categories where everyone else offers 30 days.

The cost of a longer window is smaller than founders expect. In most SaaS programs, 70-80% of affiliate conversions land within 14 days of the click. Extending from 30 to 90 days typically adds a few percent to attributed conversions — while materially improving how your offer reads to a prospective affiliate. PromoteBoost lets you set any duration from 1 to 365 days per program.

Last-Click vs. First-Click Attribution

When a customer touches two affiliates before buying — reads a review in March, clicks a newsletter link in April — someone has to lose. The attribution model decides who.

Last-click

The most recent affiliate click before conversion wins. This is the industry standard and what nearly every SaaS program runs. It is simple, universally understood, and it rewards the touch closest to the decision.

Its weakness is well known: it under-credits the content that created awareness in the first place. The in-depth comparison article that put you on the buyer's shortlist loses to the discount-code site the buyer visited thirty seconds before checkout.

First-click

The earliest click inside the window wins. This favors discovery content and is genuinely attractive to reviewers and bloggers who do the top-of-funnel work. A handful of programs use it as a differentiator when recruiting content-heavy affiliates.

The downside is disputes. A click from 80 days ago beating one from yesterday feels wrong to the affiliate who sent the recent traffic, and you will be explaining the policy repeatedly.

Unless you have a specific reason, run last-click and say so plainly in your terms. Ambiguity about attribution generates far more affiliate frustration than the model itself.

Coupon Code Tracking

Cookie tracking has a structural blind spot: it requires a click. A podcast listener who hears your name while driving, a YouTube viewer watching on a TV, a reader of a printed newsletter — none of them arrive with a referrer.

Coupon codes solve this. The affiliate gets a personal Stripe promo code, the customer types it at checkout, and the code carries the attribution regardless of how they found you. Because the code is applied server-side at payment, it is immune to ad blockers, cookie restrictions and cross-device journeys.

Coupon tracking has a second advantage: it gives the affiliate something to offer. "Use SARAH20 for 20% off" converts better than a bare link, because the audience receives a concrete benefit for using it.

The trade-off is leakage. Codes get scraped and republished on coupon aggregator sites, where customers who never encountered the affiliate apply them anyway — and you pay a commission on a sale you would have made regardless. Watch for codes with high redemption volume and near-zero referral clicks, and consider unique or capped codes for affiliates whose codes keep escaping.

Most mature programs run both mechanisms. PromoteBoost supports cookie-based links and Stripe coupon tracking simultaneously, plus sub-IDs — an extra parameter affiliates append to their links (?ref=sarah&subid=newsletter-may) to see which placement produced which conversion.

Cross-Domain and Cross-Device Tracking

Cookies are scoped to a single domain. If your marketing site is yoursite.com and your app lives at app.yoursite.com, a cookie set on the first is not automatically readable on the second — and the checkout usually happens on the second.

The standard fix is to set the cookie on the parent domain (.yoursite.com) so subdomains share it, and to pass the identifier through the URL when the visitor crosses from marketing site to app. If your checkout is hosted by a third party, the identifier has to travel with the checkout session as metadata so it survives the handoff.

Cross-device is harder and largely unsolved by cookies alone. Someone who reads a review on their phone and subscribes on their laptop breaks the chain entirely — the two browsers share nothing. This is the strongest practical argument for offering coupon codes: a code travels with the person rather than with the browser.

What Breaks Affiliate Tracking

Roughly 10-25% of referred conversions go unattributed in a typical program. The causes, in descending order of impact:

• Safari's Intelligent Tracking Prevention. Caps client-side cookies at seven days regardless of the expiry you set. If a meaningful share of your traffic is Safari and your window is 30 days, you are silently losing attribution — first-party server-set cookies mitigate this.
• Ad blockers. Extensions that block third-party tracking scripts also block many affiliate scripts. First-party tracking survives most blocklists; third-party pixels frequently do not.
• Cross-device journeys. Discover on mobile, purchase on desktop. Unfixable with cookies.
• Cookie consent rejection. Users who decline non-essential cookies in a GDPR banner may never get an identifier stored at all.
• Long sales cycles. A 45-day evaluation against a 30-day window means the affiliate simply loses.
• Direct navigation. The visitor reads the review, then types your domain directly a week later. No referrer, no attribution — unless a coupon code is involved.

You cannot eliminate this entirely. What you can do is minimize it — first-party cookies, coupon codes as a parallel channel, a window long enough for your actual sales cycle — and be transparent with affiliates that some leakage exists. Affiliates are used to it; what they will not tolerate is being told tracking is perfect when their numbers say otherwise.

Affiliate Tracking and GDPR

Affiliate cookies identify individuals, which makes them personal data under GDPR. Three requirements matter in practice.

Consent. Affiliate tracking cookies are not strictly necessary for the service to function, so in the EU they generally require consent before being set. Most implementations place them in a "marketing" or "functional" category in the consent banner. Some operators argue attribution cookies are legitimately necessary for contractual payment obligations to affiliates — a defensible position, but one worth checking with counsel rather than assuming.

Transparency. Your privacy policy needs to state that you use affiliate tracking, what is stored, how long it is retained, and who processes it. This is a short paragraph, and its absence is a common and easily avoidable gap.

Data minimization and retention. Store the affiliate identifier and a timestamp. You do not need the visitor's IP address, browser fingerprint or browsing history to attribute a sale. Retain click data only as long as your attribution window and dispute period require.

Practically, consent rejection is a real source of attribution loss in EU-heavy programs — another reason coupon codes are useful, since a code applied at checkout is part of the transaction rather than a tracking cookie.

Choosing a Tracking Setup

Whatever platform you use, four things determine whether affiliates trust it:

• First-party cookies, set from your own domain rather than a third-party tracker.
• Server-side conversion recording, so the payment itself confirms the sale rather than a browser-side pixel that may never fire.
• Coupon tracking alongside links, to cover audiences that never click.
• Visibility for affiliates — a portal where they see clicks, conversions and pending commissions in near real time. Most disputes are really visibility problems.

PromoteBoost reads conversions directly from Stripe rather than relying on a browser pixel, which means a commission exists only when a payment actually cleared. It supports configurable cookie duration from 1 to 365 days, Stripe coupon tracking, sub-IDs for placement-level reporting, and a white-label affiliate portal on your own domain. The free plan includes all of it up to $10,000/month in affiliate-generated revenue.

If you are still designing your program, start with how to launch a SaaS affiliate program and what to pay your affiliates. Unfamiliar terms in this guide are defined in our affiliate marketing glossary.