Affiliate Tracking in 2026: Cookies, Server-to-Server Postbacks and Attribution

If a conversion is not tracked, it does not exist — at least not on your commission report. Tracking is the plumbing of affiliate marketing, and browser privacy changes over the past several years have made it leakier for anyone still relying on old-style third-party cookies. This guide explains how modern tracking works and what you can do to protect your earnings.

How a tracked affiliate sale works

1. A visitor clicks your affiliate link, which goes to the network's tracking server.
2. The tracking server records the click, generates a unique click ID and redirects to the advertiser's landing page.
3. The click ID is stored: traditionally in a cookie, increasingly also in the landing page URL and the advertiser's own database.
4. When the visitor converts, the advertiser's system reports the conversion with that click ID.
5. The network attributes the conversion to you, applies the commission and, after validation, approves it.

Everything depends on step 4 successfully finding the click ID. That is where the methods differ.

Cookie-based (client-side) tracking

In classic pixel tracking, the network sets a cookie when the visitor clicks. On the thank-you page, a tracking pixel or script loads from the network's domain, reads the cookie and records the sale. It is simple to install, which is why it became the standard.

The weakness is that the cookie belongs to the network's domain, making it a third-party cookie on the advertiser's site. Safari's Intelligent Tracking Prevention and Firefox's Enhanced Tracking Protection block or restrict third-party cookies by default, and they also shorten the life of some first-party cookies set by scripts. Google stepped back from its plan to remove third-party cookies from Chrome entirely, but a large share of mobile traffic in particular runs on browsers that already limit them.

Server-to-server (S2S) postback tracking

Postback tracking moves the critical step off the visitor's browser. The click ID is passed to the advertiser in the landing page URL, the advertiser stores it with the visitor's session or account, and when a conversion occurs the advertiser's server calls the network's postback URL directly, for example:

https://track.network.example/postback?click_id={click_id}&payout={amount}&status=approved

Because no browser cookie is needed, postbacks are far more resilient to cookie restrictions, ad blockers and cross-device journeys (as long as the advertiser can connect the conversion to the original click). They are standard in CPA, mobile and app-install networks and increasingly common in retail.

First-party and hybrid tracking

Many modern platforms combine methods. A common setup is a first-party tracking script hosted on the advertiser's own domain (so cookies are first-party), backed up by S2S calls. Some networks also let advertisers use a custom tracking subdomain. As a publisher you do not need to implement this yourself, but it is worth asking networks how they handle Safari and privacy-focused browsers.

Comparing the methods

Attribution models

Attribution decides who gets credit when several touchpoints are involved.

• Last click: the final affiliate click before the conversion wins. Still the most common model.
• First click: the first affiliate to introduce the customer wins. Rewards discovery content.
• Linear or weighted: commission is split between touchpoints. More common in large in-house programs.
• Lifetime / customer-bound: once a customer is linked to you, you earn on future purchases. See lifetime commission programs.

Also check the attribution window (the "cookie duration") and whether coupon or cashback sites can override earlier content clicks. Those rules matter more to content publishers than headline commission rates.

Sub-IDs: your diagnostic tool

Most networks let you add one or more sub-ID parameters to links, for example ?subid=best-hiking-boots-table. Sub-IDs show you which article, button or placement drives clicks and conversions. They also make tracking problems visible: if one sub-ID suddenly shows clicks but no conversions, you know where to look.

Use a consistent naming scheme such as page-placement-variant, and never put personal data (emails, names) into a sub-ID.

Common causes of lost commissions

• Broken or redirected advertiser landing pages that drop the click ID.
• Link shorteners or cloaking plugins that strip parameters.
• Consent banners on the advertiser's site that block tracking until the visitor accepts.
• Visitors switching from mobile (where they clicked) to desktop (where they buy).
• Coupon extensions overwriting the last click at checkout.

A practical tracking health check

1. Click each important link yourself and confirm the final URL contains the network's click ID parameter.
2. Compare clicks in your own analytics with clicks reported by the network for the same period; large gaps suggest blocked redirects.
3. Watch conversion rate by sub-ID weekly and investigate sudden drops.
4. Ask your affiliate manager whether the advertiser uses postbacks, and which browsers they have tested.
5. Keep a log of when you change link formats or plugins so you can correlate changes with results.

Privacy and consent

Tracking must comply with privacy law. In the UK and EU, storing or reading non-essential cookies generally requires consent under PECR and the ePrivacy rules, and personal data processing must have a lawful basis under the (UK) GDPR. Advertisers are mainly responsible for their own tracking, but publishers who place their own analytics or retargeting tags need consent too. Our compliance guide covers disclosure rules in more depth.

Frequently asked questions