Kudos, a shopping extension powered by Wildfire, in its current version invites users to “auto-activate Boost”—at which point any click, even Dismiss, invokes an affiliate link. This is a bad deal for merchants, who pay commissions for things users would have bought anyway. Plus it violates rules from applicable affiliate networks, which only allow shopping extensions to invoke affiliate links when users actually click. In a particularly brazen twist, this feature shipped turned on by default for approximately seven months, and Kudos only disabled it when I and others caught competing shopping extension Phia with a similar violation.
Kudos’ current practice
When a user installs Kudos, a post-install screen invites a user to “Auto-activate boost.”
The user can also turn on “Auto-activate Boost” from the Kudos settings screen. A mouseover bubble repeats text from the post-install screen.
In a representative test, with Auto-activate Boost turned on, I requested temu.com. A Kudos window appeared, proposing that I “Activate extra earnings” or “Activate & close”. I instead clicked “Dismiss”. Kudos opened a new tab invoking Kudos’ affiliate link to Temu, and when that tab finished loading, Kudos closed it. Video. I saw the same behavior when clicking elsewhere, for example on the “Exclusions Apply” link.
While my screenshots and video show Kudos practices on Chrome on a desktop PC, Kudos’ Safari Mobile extension has the same Auto-activate Boost setting. On Safari Mobile, Kudos’ new tab opens invisibly to the user (versus flashing briefly in the tab bar on Chrome for desktop). As I demonstrated for Phia in July, a user can reveal the invisible window by opening Safari’s tab-switcher with excellent timing—though normal users would have no reason to attempt that, not to mention get the timing just right.
Previously turned on by default
Through version 4.520.0, Kudos pre-activated the Auto-activate Boost setting. Through and including that version, the Boost settings screen (popup.js) got the value for the Auto-activate Boost setting from code that treated the setting as on by default (Code below shown pretty-printed for readability.)
[u,d] = useState(e?.preferences?.disableAutoBoostActivation ?? null) y = u ?? false v = !y ... createElement(Pfe, null, "Auto-activate Boost", ...), ... isOn: v, onChange: k
If the user never touched the setting, u would be null, which would make y false, so v (set to not y) would be true, and the Auto-activate Boost setting in the settings screen would be set to isOn=true.
Kudos’ auto-activate code followed much the same logic. From container.js:
y && !0 !== t?.preferences?.disableAutoBoostActivation
Here, y denotes whether the merchant supports Kudos’ Boost benefits (unrelated to the variable y from the prior code snippet). !0 is always true. With true on the left, the !== operator evaluates to true when the right side is anything other than true. If the right side is null, undefined, or false (such as for a user who left the Auto-activate setting at its default), the right side will not equal true, so the overall expression will evaluate to true and Kudos will proceed with the automatic click.
Timing
Historic versions of the Kudos extension reveal that the Auto-activate Boost feature was added in 4.308.0 (shipped December 18, 2025). That’s the peak of the holiday shopping season—an advantageous time for Kudos to claim extra commission, with merchants and networks badly positioned to notice changes in time.
When Auto-activate Boost shipped in December 2025, it was turned on by default, as described in the preceding section.
Kudos reversed this default in version 4.527.2, released July 17, 2026. That’s eight days after I revealed shopping extension Phia forcing clicks. The best interpretation is that Kudos realized it was likely to get caught as I or others continued testing more shopping extensions.
Rakuten policies require that an extension maker “notify us [Rakuten] in writing” about any “revision” of an extension. I’d like to see evidence that Kudos and Wildfire actually did what this rule requires—a particularly important step for a material revision such as even offering an automatic click feature, not to mention turning it on by default.
Contracts on point
The prohibition on automatic clicks is a network rule, designed to increase the incrementality of affiliate traffic and protect merchants from undue expense.
Relevant contract provisions:
- CJ Publisher Service Agreement: “Software may not be used to force clicks [or] perform redirects without an affirmative click by a user”.
- Rakuten Affiliate Network Policies: “The DSA [downloadable software application] must not force clicks or ‘cookie stuff’. The DSA must not insert a cookie onto the user’s computer without the user knowingly taking an action. … The only way the Supplier cookie can be set is by a voluntary click from the user.” Leaving no doubt, Rakuten continues: “The offer may not automatically redirect to the advertiser website, even if the user has indicated that they ‘always’ want to receive rewards… It must be clicked on by the consumer before the offer can be redirected.”
- Awin Code of Conduct: “Publishers only initiate tracking via a tracking link used for click tracking if the user voluntarily and intentionally interacted with the Ad Media or Tracking link.” (emphasis added in each quote)
Kudos might say users should be allowed to turn on automatic clicks if they want. But users cannot alter network rules because users are not the beneficiaries of those rules, and are not even privy to the contracts that establish those rules.
Towards resolution
Wildfire and Kudos should disable automatic clicks, and explain how this feature shipped. Who designed it? Who approved the feature generally? Who approved the decision to turn on Auto-activate Boost by default, and to turn that off in July 2026? Did anyone tell the networks about any of this?
Networks should audit Kudos and Wildfire traffic since December 18, 2025, when the feature appeared.
Merchants should demand refunds for commissions paid on auto-activated clicks, along with the fees passed through to their networks. If it’s not possible to determine which commissions came from automatic clicks, networks should make a reasonable estimate, erring on the side of returning more to merchants.
Wildfire and Kudos should also pay the costs merchants and networks incur to investigate and remediate.
My bottom line: Merchants paid commissions on sales Kudos claimed credit for, through clicks plainly outside governing contracts. Merchants and networks are entitled to learn how much money Kudos took from them, and to get it back.