Affiliate tracking is the invisible machinery that decides who gets paid for a sale. This complete guide explains how it works — from the tagged link and the click-to-commission journey to cookies, server-side postbacks, pixels, attribution windows and what''s quietly breaking tracking as third-party cookies disappear.
Jul 12, 2026 13 min read
Every affiliate commission you've ever earned started with a single, invisible event: a piece of software correctly remembered that you sent the customer. Get that right and you get paid. Get it wrong — a dropped cookie, a mismatched click, a broken link — and the sale you drove quietly credits to no one, or worse, to someone else. Affiliate tracking is the unglamorous machinery that decides who gets the money, and it is the single most important thing in affiliate marketing that most people never bother to understand.
Here's the uncomfortable part: tracking is getting harder, not easier. Third-party cookies are dying, browsers are actively blocking cross-site tracking, and a meaningful share of conversions now slip through the cracks of the old methods. Whether you're a publisher who wants to actually get paid for your work, or an advertiser who wants a program partners can trust, understanding how tracking works has gone from "nice to know" to "the difference between a program that works and one that quietly leaks money."
This is the complete, plain-English guide to how affiliate tracking works: what happens between a click and a commission, the tracking methods (cookies, server-side postbacks, pixels), how attribution and cookie windows decide who wins the sale, what's breaking tracking right now, and how to make sure you're tracked properly.
How affiliate tracking works — the journey from a tagged click to a credited commission, and the methods that record it.
What is affiliate tracking?
Affiliate tracking is the system that attributes an action — a sale, a lead, a sign-up — back to the specific affiliate whose link drove it. It's the accounting layer of the entire industry: the mechanism that watches a customer travel from your content to a merchant's checkout and records, reliably enough to pay real money on, "this one came from that affiliate."
Without tracking, affiliate marketing simply couldn't exist. The whole model rests on paying for performance, and you can't pay for performance you can't measure. Tracking is what turns "I think my content drove some sales" into "these 47 orders are provably yours, here's your commission." Everything else — commissions, EPC, attribution, payouts — is built on top of it.
The core idea is simple even if the plumbing isn't: give every affiliate a unique identifier, embed it in the links they share, and follow that identifier from the click all the way to the conversion. The complexity is entirely in doing that reliably across different browsers, devices, privacy settings and weeks of delay between the click and the purchase.
Affground's take: most affiliates treat tracking as someone else's problem — the network's job, invisible until it fails. That's backwards. Tracking is your paycheck's plumbing, and the affiliates who understand it catch the leaks everyone else eats silently. A 2% tracking loss on a five-figure month is real money vanishing, and you'll never notice it if you don't know how the system is supposed to work.
The heart of it: the tracking link
Everything begins with a tracking link — a special URL that carries your identity. When you join a program, you're given links that look something like a normal merchant URL with extra parameters bolted on, or that route through the network's tracking domain first. Encoded in that link are the pieces the system needs:
Affiliate ID — who you are. The non-negotiable core.
Click ID — a unique fingerprint for this specific click, so a later conversion can be matched back to it.
Offer / campaign ID — which program or offer the link points to.
Sub IDs (optional) — your own labels (which page, which placement) so you can track what's working on your side.
When a reader clicks it, that link typically routes them through the network's tracking server for a fraction of a second — long enough to record the click and set up the tracking — before redirecting them to the merchant's site. That invisible pit-stop is where your claim to any future sale gets registered.
From click to commission: the journey step by step
Here's what actually happens between a reader clicking your link and a commission landing in your account:
1The click. A reader clicks your tracking link. The request hits the network's tracking server, which logs the click along with your affiliate ID and a freshly generated click ID.
2The tag is stored. The system stores that identity — in a cookie in the reader's browser, and/or as a server-side record keyed to the click ID. This is the "memory" that will connect a later purchase back to you.
3The redirect. In milliseconds, the reader is forwarded to the merchant's site, none the wiser. They just see the product page they expected.
4The browse (and the wait). The reader shops, maybe leaves, maybe sleeps on it, maybe comes back days later. The stored identity waits, valid for the length of the attribution window.
5The conversion. The reader buys. On the confirmation page, the merchant fires a conversion event — a pixel, tag, or server-side postback — reporting the sale (and often the order value) to the network.
6The match & attribution. The network matches that conversion to the stored click — via the cookie or the click ID — and attributes the sale to you, according to its attribution rules.
7The commission (and validation). A commission is recorded as pending, held through the return/validation window, confirmed once it clears reversals, and finally paid out.
Steps 2 and 6 are where tracking lives or dies — how the identity is stored, and how the conversion is matched back to it. That's exactly where the different tracking methods differ.
The click-to-commission chain: store an identity at the click, then match the later conversion back to it — reliably, across days and devices.
The tracking methods, compared
There isn't one way to track; there are several, and which a program uses largely determines how many of your conversions actually get counted.
Method
How it stores/matches
Reliability
The catch
Cookie (client-side)
Stores ID in the browser; reads it at conversion
Declining
Blocked/deleted cookies, no cross-device
Server-side / postback (S2S)
Passes a click ID; matches server-to-server
High
Needs proper setup on both sides
Pixel / tag
Fires a conversion pixel on the thank-you page
Medium
Can be blocked; page must load fully
Fingerprinting
Infers identity from device/browser signals
Low & fading
Privacy-hostile, imprecise, restricted
Cookie-based tracking
The classic method. When a reader clicks, the network drops a cookie — a small file in their browser — storing your affiliate ID and the click details. When they later hit the merchant's confirmation page, the network reads that cookie and credits you.
Cookies are simple and have powered affiliate marketing for decades, but they're increasingly fragile. They can be blocked by ad blockers or privacy tools, deleted by the user, expired before the purchase, and they can't follow a customer across devices — click on mobile, buy on desktop, and a cookie-only system loses you entirely. Crucially, browsers themselves now restrict cross-site cookies (Safari's ITP, Firefox's tracking protection, and the industry-wide retreat from third-party cookies), which is why cookie-only tracking leaks more every year.
Server-side / postback (S2S) tracking
The modern, resilient approach. Instead of relying on a browser to hold a cookie, the click ID travels as a parameter and the conversion is reported server-to-server: when the sale happens, the merchant's server sends a postback — a direct call carrying the click ID — to the network's server, which matches it to the original click. No browser cookie required.
Because it doesn't depend on the user's browser cooperating, S2S survives ad blockers, cookie restrictions and cross-device journeys far better. It's why serious performance programs and networks have moved toward it. (We go deep on the mechanics in our guide to server-side tracking.)
Pixel and fingerprinting
Pixel tracking fires a tiny invisible image or script on the conversion page that reports the sale — reliable enough when the page fully loads and isn't blocked, but still browser-dependent. Fingerprinting tries to identify users from device and browser signals without a cookie; it's imprecise, increasingly restricted by privacy law and browsers, and best treated as a fading fallback, not a foundation.
Affground's rule: before you pour effort into promoting a program, check how it tracks. A program that supports server-side/postback tracking will credit you for conversions a cookie-only program silently loses. Two identical offers can pay you materially differently purely because one has modern tracking and the other is still betting your income on a browser cookie surviving for 30 days.
Attribution: who gets the credit, and for how long
Tracking records the journey; attribution decides who gets paid for it. Two settings do most of the work.
The attribution (cookie) window is how long after the click a conversion still counts. It ranges from 24 hours to 90 days or more, and it matters enormously: people rarely buy on the first visit, so a 24-hour window forfeits every sale that happens after a day's thought, while a 30- or 90-day window captures them. Same traffic, same offer — the longer window simply pays you more.
The attribution model decides who wins when more than one affiliate touched the sale:
Last-click — the final affiliate before purchase gets 100%. The industry default.
First-click — the affiliate who first introduced the customer gets the credit.
Multi-touch — credit is split across every touchpoint that contributed.
Most programs are last-click, which rewards bottom-of-funnel content (the review or comparison read right before buying) over top-of-funnel discovery. Knowing which model a program uses tells you what kind of content it actually pays for. (Attribution and tracking together are what let you compute your real earnings per click.)
Who runs the tracking: networks vs in-house
Someone has to own all this machinery. Two options:
Affiliate networks / platforms provide tracking as core infrastructure — generating links, recording clicks, matching conversions, handling attribution and paying out — across thousands of programs behind one system. Most affiliates rely on them, and the network's tracking quality directly affects your income.
In-house programs run their own tracking software (or a SaaS tracking platform). This gives the merchant more control and often better first-party/server-side setups, but scatters your tracking across separate logins.
Either way, the tracking technology is doing the same job. This is why running a program on a reputable, technically strong platform is itself a trust signal — publishers know their conversions will actually get counted.
Where reliable tracking lives
These established networks and platforms are built around robust tracking infrastructure — accurate click and conversion recording, server-side options, and transparent reporting:
Browse the full affiliate networks directory to compare platforms on tracking technology, attribution terms and reporting transparency.
What's breaking tracking right now
Tracking used to be a solved problem. It isn't anymore, and every affiliate and advertiser should understand why:
Third-party cookie deprecation — browsers are phasing out the cross-site cookies that a lot of legacy tracking relied on.
Browser privacy features — Safari's Intelligent Tracking Prevention and Firefox's protections actively limit or shorten tracking cookies.
Ad blockers & privacy tools — block tracking scripts, pixels and cookies outright for a meaningful slice of users.
Consent & privacy law — GDPR-style consent banners mean some users are never tracked at all.
Cross-device journeys — clicking on one device and buying on another defeats browser-bound tracking.
Mobile & in-app — app environments don't behave like the cookie-based web.
The common thread: anything that depends on a browser faithfully storing and returning a cookie is getting less reliable. That's the whole reason the industry is shifting toward server-side and first-party tracking — methods that don't ask the user's browser for permission to remember who sent them.
Affground predicts: within a few years, server-side tracking won't be the premium option — it'll be the baseline, and cookie-only programs will be visibly leaking conversions their partners can measure. The advertisers who migrate early will win the best affiliates, because publishers increasingly know how to check whether a program will actually credit their work. Tracking quality is quietly becoming a competitive advantage, not a back-office detail.
Common tracking problems (and how to catch them)
Tracking fails in specific, recognisable ways. The usual suspects:
Missing conversions — sales you know you drove that never show up. Often cookie loss, a broken link, or a conversion tag that didn't fire.
Broken or truncated links — a mangled tracking link that drops your ID mid-journey.
Attribution disputes — another channel (or a coupon site firing at checkout) stealing last-click credit.
Cross-device gaps — mobile clicks converting on desktop and going uncredited.
Reversals — legitimate (returns, cancellations) or erroneous clawbacks you should question.
The defence is boring but effective: test your links, watch your click-to-conversion patterns for sudden drops, keep records, and raise discrepancies with the network promptly and specifically. Programs with transparent, near-real-time reporting make this vastly easier — another reason reporting transparency is a feature, not a nicety.
How to make sure you're tracked properly
If you're a publisher:
1Use the exact tracking links provided — don't hand-edit URLs in ways that strip parameters.
2Prefer programs with server-side/postback tracking and reasonable attribution windows.
3Test the full journey — click your own link (properly, per program rules) and confirm the click registers.
4Watch your reports for unexplained conversion drops, and flag them fast.
5Keep your own sub-ID tracking so you can see which pages and placements actually convert.
If you're an advertiser:
1Implement tracking correctly on the conversion page — test that the tag/postback fires on every sale.
2Offer server-side tracking so partners' conversions survive cookie loss.
3Set a fair, clearly stated attribution window and model.
4Give partners transparent, timely reporting so trust doesn't erode over invisible data.
5Audit regularly for tracking gaps — leaked conversions cost you good affiliates.
Affground's verdict
Affiliate tracking is the invisible foundation the entire industry stands on: the system that turns "I drove this sale" into a provable, payable fact. It works by tagging every affiliate with a unique identity, storing that identity at the moment of the click, and matching it back to the conversion whenever it eventually happens — through cookies, server-side postbacks, or pixels, governed by attribution rules that decide who wins the credit. Simple in principle, and increasingly hard in practice.
That growing difficulty is exactly why understanding tracking now pays. As cookies crumble and browsers clamp down, the gap between programs on modern server-side tracking and those still betting on a browser cookie is widening into real money — money publishers lose silently and advertisers leak invisibly. The affiliates and programs who treat tracking as a first-class concern, not an afterthought, will simply get paid more accurately than those who don't. Affground's bet: in the post-cookie era, tracking literacy stops being optional — and the people who understand the plumbing are the ones who stop leaving money in it.
Frequently asked questions
How does affiliate tracking work?
Affiliate tracking gives every affiliate a unique identifier, embeds it in the links they share, and follows it from the click to the conversion. When a reader clicks a tracking link, the network records the click with your affiliate ID and a click ID, and stores that identity in a cookie and/or a server-side record. When the reader later buys, the merchant fires a conversion event (a pixel or a server-to-server postback) that the network matches back to your click, then credits you a commission.
How do affiliate tracking links work?
A tracking link is a URL that carries your identity in its parameters — an affiliate ID (who you are), a unique click ID (so a later sale can be matched to this exact click), an offer or campaign ID, and optional sub IDs for your own labelling. When clicked, the link usually routes through the network's tracking server for a fraction of a second to record the click, then redirects the reader to the merchant's site. That invisible pit-stop is where your claim to any resulting sale is registered.
What is the difference between cookie tracking and server-side tracking?
Cookie (client-side) tracking stores your affiliate ID in the reader's browser and reads it back at conversion — simple, but fragile because cookies can be blocked, deleted, expire, or fail across devices, and browsers increasingly restrict them. Server-side (S2S) or postback tracking instead passes a click ID and reports the conversion server-to-server, with the merchant's server sending a postback to the network. Because it doesn't depend on the browser keeping a cookie, S2S is far more reliable and survives ad blockers and cross-device journeys.
What is an attribution window in affiliate marketing?
The attribution window (or cookie window) is how long after a click a conversion still counts toward your commission — anywhere from 24 hours to 90 days or more. It matters a lot because people rarely buy on the first visit: a 24-hour window forfeits sales that happen after a day's thought, while a 30- or 90-day window captures them. Two identical offers can pay very differently purely because one has a longer window.
Why do affiliate conversions sometimes not track?
Common causes include cookie loss (blocked, deleted or expired cookies), broken or hand-edited tracking links that strip parameters, a conversion tag or postback that didn't fire on the confirmation page, cross-device journeys (clicking on mobile, buying on desktop) that browser-bound tracking can't follow, and another channel stealing last-click credit at checkout. Testing your links, watching for sudden drops in your click-to-conversion rate, and choosing programs with server-side tracking all reduce these losses.
Does affiliate tracking still work without third-party cookies?
Yes, but the method matters. Legacy tracking that relied on third-party cookies is leaking more as browsers phase them out and enforce privacy protections. The industry is shifting to server-side (postback) and first-party tracking, which don't depend on the browser storing a cross-site cookie and therefore keep working in a post-cookie world. Programs on modern server-side tracking will increasingly credit conversions that cookie-only programs silently lose.
What is last-click attribution?
Last-click attribution gives 100% of the commission to the last affiliate whose link the customer clicked before buying. It's the industry default, and it rewards bottom-of-funnel content — the review or comparison read right before purchase — over top-of-funnel discovery. Alternatives include first-click (crediting the affiliate who first introduced the customer) and multi-touch (splitting credit across every touchpoint). Knowing which model a program uses tells you what kind of content it actually pays for.
