Affiliate tracking rests on one simple idea: remember who sent a visitor until that visitor signs up. For years that memory was a cookie set by the affiliate network’s own domain. Browsers have since made that approach unreliable. Here is what works now, and what its limits are.
Third-party cookies are gone in practice
A third-party cookie is one set by a domain other than the site you are visiting — for example, an affiliate network’s tracking domain setting a cookie while you browse a merchant’s site. Safari and Firefox block these by default, and other browsers restrict them. Tracking that depends on them silently loses referrals.
First-party cookies on your own domain
A first-party cookie is set by the site the visitor is actually on. The modern approach:
- A partner shares a link to your site with a referral code, such as
yoursite.com/?ref=anna4k9. - A small script on your site reads the code and stores it in a cookie on your domain.
- When the visitor signs up, your app reports the signup — with the visitor’s email or your billing customer id — together with the stored code.
- From then on, the customer is linked to the partner in your affiliate system. Payments are matched by customer, not by cookie.
Because the cookie belongs to your domain, browsers that block third-party cookies leave it alone.
What Safari still limits
Safari’s Intelligent Tracking Prevention (ITP) goes further than blocking third-party cookies. WebKit has documented two limits that matter for affiliate tracking:
- Script-written storage is capped at seven days. Cookies set with JavaScript (
document.cookie), and other script-written storage, are deleted after seven days of Safari use without the visitor interacting with your site. - After decorated links from tracking domains, the cap can be 24 hours. When a visitor arrives from a domain Safari classifies as a tracker, with identifiers in the URL, cookies set by script on the landing page can be limited to a day.
In practice: for Safari visitors, a referral stored by script is reliable for about a week, however long your cookie window is set. Visitors who sign up within that week are credited. Visitors who come back a month later may not be.
What this means for your program
Report signups, not just payments. The moment a referred visitor signs up, link them to the partner in your affiliate system. After that, the cookie no longer matters — the customer is matched on every future payment by email or billing customer id. The cookie only has to survive the gap between click and signup.
Use promo codes for long consideration cycles. A code assigned to a partner credits them on any payment that carries it, whenever it happens and on any browser. For audiences who hear about you on a podcast and buy three weeks later, a code is the reliable path.
Pass the referral into checkout. If your checkout runs on Stripe, Paddle or Chargebee, attach the referral code to the customer or invoice metadata at checkout. Then even a payment without a prior signup event can be matched.
Do not try to hide from the browser. Techniques that disguise tracking — redirecting through look-alike subdomains, fingerprinting — tend to be detected and penalised by browsers, and they erode visitors’ trust. Work with the limits instead.
Choosing a cookie window
Set your window to match how long your customers usually take to decide: 30 days for self-serve products, 60 to 90 for products with a sales cycle. Be honest in your terms that browser limits can shorten the effective window, and point partners to promo codes for longer journeys.
Checklist
- The tracking script is on every page of your marketing site, including pricing and signup.
- Your app reports each signup with the email or billing customer id.
- The referral code is passed to checkout metadata where your billing provider allows it.
- Partners have promo codes for audio, video and anything read aloud.
- Your terms describe the cookie window and its browser limits.
Tracking will never be perfect, but with first-party cookies, signup reporting and codes, the referrals you miss become the rare exception rather than a leak.
Doing this in Affiligato
The tracking script sets a first-party aff_ref cookie on your own domain for your program’s cookie window, and exposes affiligato.signup() for your app to report each signup with the visitor’s email or billing customer id. From that point the customer is matched on every payment, whatever happens to the cookie.
affiligato.referral() returns the partner’s code so you can attach it at checkout — as affiligato_ref in Stripe metadata, in Paddle’s custom data or in a Chargebee customer field. Promo codes assigned to partners credit them on any payment that carries the code, which covers the long, cross-device journeys no cookie can.
