Under affiliate marketing contracts, an affiliate link may only be invoked in specific circumstances. (Rakuten: only when “the user knowingly tak[es] an action”; Awin: “if the user voluntarily and intentionally interacted with the Ad Media or Tracking link.”) I wrote last month about Phia’s “auto_drop” feature forcing clicks when users visit a merchant’s shopping cart – a practice that no network allows. But even before Phia began forcing clicks, Phia was also improperly invoking affiliate links in other ways too. My article today shows two additional violations: 1) Invoking affiliate links when users merely close a Phia slider. 2) Auto-refreshing cookies periodically.
Affiliate link on-exit
On mobile devices, Phia’s shopping extension invoked its affiliate link when a user tapped the “X” to close a Phia slider and when a user merely tapped outside a Phia slider (i.e. tapped back to the merchant’s site).
Contracts do not authorize Phia to invoke its affiliate link (and claim affiliate commission) when the user dismisses Phia and returns to the merchant’s site. Tapping an X or tapping a merchant’s site – these are clearly not a user “knowingly taking an action” (as Rakuten requires, contemplating an “action” that is meaningfully connected to affiliate marketing). Nor are tapping X or a merchant site “voluntarily and intentionally interact[ing] with” affiliate content (Awin) since the X button and merchant site are plainly not affiliate content.
This iOS test video shows the on-exit affiliate link. Key steps:
0:06: Phia opens its “coupons found” slider.
0:10: Tab switcher shows no other tab is open.
0:12: Tap outside the Phia slider. (Notice no animation showing a tap within the slider.)
0:14: Tab switcher shows a new second tab open, loading the same merchant through an affiliate link.
As usual, skill is required to interpret Phia’s code. First, it’s minified, which removes variable names and function names. Second, it’s React, declarative rather than procedural. But here’s a key section, with // comments added by me. Notice that Phia correctly logs the user’s action as a dismiss (yellow), yet nonetheless invokes the affiliate link to claim commission (red).
y = (0, o.useCallback)(e => {
if (!e) { // slider is closing
const e = null !== f.progress && "complete" !== f.progress.phase;
f.cancel(), t.__debug || Ae.gf || c(), // invoke affiliate link and place cookie
e || Obe.getState().flush(), Z_.trackUserActivity({
action: tu.rc.DISMISS, // truthfully log this as a dismiss
module: A && !m ? tu.nV.MODULE_BRAND_OFFERS : tu.nV.MODULE_COUPON,
pageType: tu.g6.CHECKOUT_WEBPAGE,
actionId: crypto.randomUUID(),
sessionId: ny.getState().sessionId,
requestId: l.current ?? void 0
}), A && !m && t.onBrandOffersDismissed()
}
t.onOpenChange(e)
}, [f, t, c, A, m]),
Notably, Phia performs on-exit clicks only on mobile devices. A network or merchant testing only the Chrome extension – and assuming the Safari extension works the same way since it’s substantially the same code base – would not see this violation. Green highlighting shows the code implementing the restriction to mobile devices: On Chrome, Ae.gf=1, causes the || (logical OR) to stop processing before the c() call that invokes an affiliate link and places a cookie.
Phia’s on-exit clicks interact with auto_drop forced clicks in a subtle way. Consider the possibilities once Phia shows a slider, with on-exit clicks active but auto_drop off (either before i=auto_drop shipped, or after Phia turned it off):
1) The user could click a genuine affiliate link (a proper click under the governing contract).
2) The user could click X to dismiss the slider.
3) The user could click outside the slider.
4) The user could close the tab or browser, or power-off the device.
Once Phia activated its affiliate-link-on-exit code, only path 4 avoids an affiliate link. Notably, the on-exit functionality turns paths 2 and 3 into affiliate clicks even without auto_drop. With on-exit shipped as of November 11, 2025 (based on what I see in historic versions of Phia’s code), paradoxically auto_drop (shipped December 13, 2025) didn’t actually increase the number of affiliate clicks – not because automatic clicks aren’t harmful (they are!), not because they’re permitted by rules (they’re not!), but because Phia was already forcing so many clicks through its on-exit code.
Thus, to see the harm from Phia’s impermissible invocation of affiliate links, analysis should begin not with the December 2025 deployment of auto_drop, but with the November 2025 deployment of on-exit clicks. That broadly matches the growth I’ve seen in multiple sources that track Phia’s rise. (For example, affiliate merchants that work with Phia can see when its clicks and conversions grew.) This timeline extends the duration of Phia misconduct beyond what I alleged last month – and is certainly not consistent with Phia’s claim of problems limited to a single recent version (“a recent release”, as Phia claimed to Bloomberg last month).
For a separate assessment of the scope of Phia’s misconduct, I obtained data from an online tracking service that observes shopping sessions and affiliate clicks. Prior to November 2025, the tracking service observed that of Phia sessions that included a merchant’s shopping cart page, less than 10% included a user clicking an affiliate link. But after Phia shipped the on-exit code, more than 50% of such sessions included an affiliate link click (or fake click tracked as a click by this tracking service).
Two remarks on the chart. First, when Phia was caught forcing clicks in July 2026, discussion focused on auto_drop forced clicks. But once Phia stopped auto_drop, on-exit logic noticed no click had occurred yet, so it functioned as it was designed and ran a click on exit. The suspension of both auto_drop and on-exit is what drives the sharp drop at the right of the chart: With either system running, Phia achieved clickthrough (genuine clicks or fake clicks tracked as clicks by the tracking service) as high as 80%. But with both features disabled, clickthroughs dropped below 10%, where they had been before these features launched.
Second, one might ask why Phia users don’t more often click its affiliate links (why the baseline clickthrough rate is below 10%). The answer lies in both the quality of Phia’s coupons and the way Phia presents them. See video at 0:11, where Phia calls the coupons “a bit iffy” (i.e. unlikely to work) and asks users to copy-and-paste each coupon into the merchant’s site (without the auto-apply feature that some shopping assistants offer). After seeing this message a few times, most users stop investing time applying coupons. Based on likely user reaction, both the number of steps and the typical benefit, sub-10% user interaction with the “coupons found” screen is entirely believable.
Automatic cookie refresh
If a user browses merchant x, then returns to x after a timeout, Phia automatically refreshes the cookie by reinvoking the affiliate link. Key code snippets, again with // comments by me:
const t = Ae.gf ? A.desktop : A.mobile; // different cookie refresh configurations for desktop versus mobile
t?.passiveWhitelist?.some(e => window.location.href.includes(e))
&& K("passive_trigger"); // check whether current URL is on whitelist for cookie-refresh
The function K() checks the duration since the last time this merchant’s affiliate link was invoked:
if (a) {
const t = (Date.now() - a.timestamp) / Jp.dp, // elapsed time since last affiliate link
n = U.current,
i = Ae.gf ? n.desktop : n.mobile,
s = i?.chipTimeouts[a.networkId],
o = i?.chipTimeouts.default;
let l = s?.[e] ?? o?.[e]; // required time gap for this network
if (r && (l = 0), void 0 === l) return void L(!1);
if (0 !== l && t < l) return void L(!1); // if time less than threshold, do not invoke affiliate link
}
These automatic cookie refreshes violate the same network rules I described last month. CJ Publisher Service Agreement: “Software may not be used to force clicks [or] perform redirects without an affirmative click by a user” (but there is no affirmative click when a cookie is refreshed). Rakuten Affiliate Network Policies: A shopping plugin must provide “full and prominent disclosure each time the DSA is triggered” (emphasis added) (disallowing multiple affiliate links with only a single disclosure). Awin Code of Conduct: “Publishers only initiate tracking via a tracking link used for click tracking if the user voluntarily and intentionally interacted with the Ad Media or Tracking link.” The contracts nowhere contemplate one click authorizing multiple link invocations and multiple cookie refreshes hours or even days later. That’s not how “links” work – one link, clicked once, loads the specified URL once.
Phia’s cookie refreshes have a distinctive signature in timestamps. Ordinarily Phia opens its slider when a user is at a shopping cart – usually some minutes into a user’s session at a given merchant. (Consider the time required to browse products and select an item to buy.) But cookie refreshes occur as soon as a user reaches a merchant’s site. And that’s what tracking data shows. Initially, Phia’s affiliate links were basically never associated with the user’s first page-view of a shopping session, because multiple page-views are needed to reach the shopping cart. But after Phia pushed the cookie refresh code (October 7, 2025), as many as 12% of Phia’s affiliate links came in the first page of a shopping session.
Reflections
The historic versions of Phia’s plug-in reveal the company’s priorities — adding feature after feature to accelerate revenue. Phia’s forced clicks and other improper clicks do not present as a one-off error, nor are the problems limited to any single version. Instead, Phia was experimenting with multiple forms of improper clicks. The continued adjustments and optimizations repeatedly expanded the scenarios in which Phia collected commissions, even when users didn’t click and even when network rules didn’t authorize payment.
Today’s Bloomberg article discusses remarkable admissions in Phia’s internal communications, including founder Phoebe Gates instructing staff in December 2025: “can u confirm auto pop for cookie drop is live on ALL sites w a coupon to confirm we are monetizing on all gmv.” That telling remark confirms the duration of auto_drop, consistent with my article last month (and contrary to Phia’s remarks to Bloomberg last month that the problem was limited to a single recent release). But imagine if merchants and networks could see all of Phia’s communications (not just the subset that someone happened to share with Bloomberg, and Bloomberg chose to publish). I’d like to read the engineering specifications for each feature, discussion of alternatives, and further discussion of network rules. I’d also like to read correspondence with merchants and networks – what Phia told them it was doing, which I’d like to compare with what the code says.
Meanwhile, several people contacted me about Phia misconduct they reported to networks – and what, if anything, networks did about it. Clearly networks had trouble uncovering Phia’s violations, even when tipped off. Shopping plugins can be tricky to test, and in some ways mobile extensions are more difficult than desktop. If merchants are to remain confident in affiliate marketing, more must be done to improve compliance and deter violations.