When Bloomberg asked Phoebe Gates’s shopping startup on July 7 why its browser extension appeared to be claiming affiliate commissions on purchases it had nothing to do with, the company answered the next day: a software bug, discovered within the last 24 hours, already fixed.
Then Bloomberg published the internal Slack messages, and the earliest one is dated December 18.
That gap is the story. Not the technique, which is old and has a name and a prison sentence attached to it. The gap between what a company told the public about when it found out and what its own employees were typing to each other seven months earlier.
What Cookie Stuffing Actually Is
Phia is an AI shopping assistant. Its browser extension sits at checkout, hunts for a discount code, and takes a cut from the retailer when a shopper uses one. That cut is an affiliate commission, and affiliate commissions are awarded on last-click attribution: whoever drops the most recent tracking cookie before the purchase gets paid, regardless of whether they influenced anything.
Cookie stuffing exploits exactly that. You drop the cookie without the click. According to the reporting, Phia’s extension opened background tabs across the major affiliate networks, including Impact, Awin and Rakuten, planting tracking cookies on shoppers who had never clicked a Phia link. If those shoppers then bought something, Phia collected. The networks prohibit this. Every one of them.
It is worth knowing how seriously US courts have taken this before, because “cookie stuffing” sounds like a growth hack and is not one. Shawn Hogan ran eBay’s largest affiliate program in the mid-2000s and made about $15.5 million doing essentially what Phia is accused of doing. The FBI investigated it as wire fraud, and Slate reported he was sentenced to five months in federal prison and a $25,000 fine after pleading guilty. That is the precedent behind the “up to 20 years” headlines circulating this week, and it is also the reason those headlines are overheated: nobody has charged anyone at Phia with anything, and as of mid-August no enforcement action had been announced.
The Seven Months
Here is the sequence, and it is worth reading in order.
- December 18: Gates writes in a Slack channel about whether a feature that automatically places tracking cookies is running across all retail sites, and raises concern that the problem is widespread.
- July 7: Bloomberg contacts the company.
- July 8: Phia publicly attributes the behavior to a software bug and says it learned of the issue within the previous 24 hours.
- July 9: Bloomberg publishes, with the Slack messages.
Fortune’s account of the reporting describes cookie stuffing at Phia as a deliberately built feature with a toggle, something that could be switched on and switched off, rather than a defect that crept in. A bug is something that happens to you. A toggle is something you operate.
Phia has not denied the substance so much as reframed the timeline. The company says any features causing misattribution were removed on July 7, that it is reviewing every transaction, that it has begun issuing reversals to brand partners, and that it is hiring a head of compliance. Yahoo Finance carried the company’s response to the allegations in full. Reversals and a compliance hire are the correct remedies. They are also what you do after the thing you said was a bug turns out to have been load-bearing.
The $80,000 Number Does the Arguing
Every other detail in this story is contestable. This one is not, and it is the reason the bug explanation collapses.
After Phia disabled the features, daily revenue fell from about $80,000 to somewhere between $10,000 and $28,000.
Run that backwards. If cookie stuffing were an incidental defect, switching it off would trim the edges. Instead it removed most of the business. Somewhere between two thirds and seven eighths of what Phia was booking on a given day depended on commissions for sales it did not drive. That is not a company with a bug. That is a company whose revenue line was substantially the bug.
Which reframes everything upstream of it. Phia raised $35 million at a $185 million valuation in January, on top of an $8 million seed round led by Kleiner Perkins that included Hailey Bieber and Kris Jenner. The pitch was traction: a million-plus users since launching in April 2025, revenue up elevenfold. Investors priced that growth. Nobody outside the company could see which portion of it was real, and the internal Slack suggests people inside the company could.
The System That Pays for Nothing
Now the uncomfortable part, and it is not really about Phoebe Gates.
Last-click attribution pays whoever touches the transaction last. It does not ask whether that touch caused anything. Browser extensions live at checkout by design, which means they are structurally positioned to be the last touch on almost every purchase a user makes, whether or not they contributed a coupon, a recommendation or a single moment of persuasion. An entire product category sits on top of that geometry.
We have watched this run before. PayPal’s Honey extension faced more than two dozen suits from creators alleging it swapped their affiliate links for its own, a fight Digiday called a wake-up call for the creator economy’s affiliate partnerships. PayPal’s defense was that Honey followed established industry practice, including last-click attribution. That defense is uncomfortable precisely because it is partly true. A judge let the consolidated creator class action proceed past dismissal in June, and the discovery that follows will be the most detailed look anyone has had at how the plumbing actually works.
The pattern is familiar from every adjacent consumer-tech enforcement story of the past two years, from Amazon’s Prime cancellation settlement with the FTC to the arms race over AI shopping agents that retailers are racing to embed themselves. Each time, a design that quietly converts user trust into revenue runs until somebody outside the company measures it.
Gates has said repeatedly that she wants Phia judged without reference to her last name. That is a reasonable thing to want, and this week it cuts against her: a startup with a less famous founder would have drawn no Bloomberg investigation at all, and the cookies would still be dropping. The scrutiny is the privilege working in reverse, and it is the only reason anyone outside the affiliate networks knows this happened.