What Creators Should Know About Attribution

This one isn't written for shoppers. If you put affiliate links in video descriptions, newsletters, or posts, the money you're owed depends on a mechanism most people never look at directly — and on the behaviour of software you have no control over.

Short answer: almost every affiliate programme pays on last click. Whoever's tracking link fired most recently before the purchase takes the entire commission. That means a browser extension appearing at checkout can displace you after you did all the work of persuading someone to buy. In 2026 the industry finally started enforcing rules against this, but enforcement is uneven and the underlying incentive hasn't changed.

Here's the mechanism, what actually changed, and what you can check yourself.

The mechanism, precisely

You post a link. Someone clicks it. A cookie is set attributing that visit to you, typically for somewhere between 24 hours and 30 days depending on the programme.

Then the visitor browses. Adds to cart. Reaches checkout. At that moment a coupon extension offers to find a code, they click it, and the extension's tracking fires.

Under last-click, the extension's click is now the most recent. The commission goes to the extension. Not split — all of it.

Two things make this worse than it sounds:

It happens even when nothing was found. An extension that searches for codes, finds none, and saves the shopper nothing can still have taken the click. That was the core of the allegations that broke this open in December 2024.

You can't see it. Your dashboard shows a click and no conversion. That looks identical to a visitor who simply didn't buy. There's no line item that says "displaced."

What "stand-down" means

The industry's answer has a name. A stand-down rule requires an extension to detect that an affiliate attribution is already attached to a visit and not overwrite it. The extension only claims commission when nobody else has earned it.

An extension following stand-down earns less. That's the entire point — it's a decision to take money only when the tool contributed something.

The reason this matters more in 2026 than it did in 2024 is that it stopped being an honour-system commitment. In May 2026 Rakuten Rewards published an open-source stand-down SDK on GitHub, which means an extension can no longer argue that reliable detection is technically hard. Around the same time, a draft code of conduct for affiliates using browser extensions and other client software was opened for public comment.

So the question you can now ask any extension is narrow and answerable: do you implement stand-down detection, and which SDK or method?

What actually happened in 2026

The sequence, because the details are frequently reported wrong:

• December 2024 — investigations by MegaLag and economist Ben Edelman document alleged commission diversion by Honey, including code that allegedly behaved differently when it detected compliance testers.

• December 2024 — creators file a class action against PayPal in the Northern District of California.

• November 2025 — the court denies PayPal's motion to compel arbitration.

• January 2026 — Rakuten Advertising terminates Honey; impact.com suspends it; Awin confirms policy breaches and suspends payments. PayPal deactivates the disputed code and states it affected under 0.1% of Honey's traffic.

• May 2026 — Rakuten publishes the stand-down SDK; Honey implements it and returns to the network. The draft code of conduct opens for comment.

• June 2026 — the court denies PayPal's motion to dismiss; the creators' claims survive.

• July 2026 — Bloomberg reports allegations against a different shopping extension, Phia.

That last item is the one creators should sit with. The enforcement action wasn't the end of a story about one company. It was the first application of a standard to a category where the incentive to displace is structural. We covered the shopper-facing side of this in how coupon extensions make money.

What you can actually check

You have less visibility than you should, but not none.

1. Compare click-to-conversion by traffic source. If one link placement converts far below your others with no obvious explanation — same audience, same product, same price point — displacement is one candidate. It's not proof; seasonality and audience intent explain most variance. But a persistent unexplained gap on a high-intent placement is worth escalating.

2. Test your own funnel with extensions installed. Click your own link in a clean browser profile with a common coupon extension installed. Complete a test purchase if the economics allow, or at minimum inspect the cookies and query parameters at checkout to see whose identifiers are present. This is the only direct evidence available to you.

3. Ask your network what it enforces. All three of the major networks made public statements in 2026. Ask yours: do you require stand-down, how do you test for it, and what happens when a publisher fails? A network that can't answer specifically is telling you something.

4. Watch for the reverse problem too. Cashback services displace creators by exactly the same mechanism, and they're often less scrutinised because the money visibly reaches a consumer. The mechanism doesn't care who benefits.

5. Push for longer attribution windows where you can negotiate. A 24-hour cookie is far more vulnerable to a checkout-time displacement than a 30-day one. On direct merchant deals this is negotiable more often than people assume.

What doesn't help

Some commonly suggested fixes don't work, and it's worth knowing why before spending effort on them.

Telling your audience not to install extensions. They won't, and it makes you sound like you're protecting your income rather than theirs. A creator who explains the mechanism honestly gets more goodwill than one who issues instructions.

Link cloaking. It changes how the link looks, not who fires last.

Deep links to product pages. Helps conversion, doesn't help attribution — the displacement happens at checkout, well after the landing page.

Moving to discount codes instead of links. Better in one way: a code entered manually is attributable to you at the merchant level regardless of cookies. Worse in another: codes get scraped and redistributed within hours, and then aggregators earn from your code without sending anyone. Both effects are real; which dominates depends on the merchant.

What we do, and why we're saying so

Couponly builds a coupon extension. That makes us part of the category this article is about, so treat the following as a claim to be checked rather than a reassurance.

If an affiliate attribution is already attached to a visit — a creator's link someone followed to the store — we leave it alone. The extension being installed doesn't change who gets credited. That's stated on why you can trust Couponly and written into our Terms, and it's checkable using method 2 above.

We'd rather you verify it than believe it. If you test our extension against your own funnel and find something that doesn't match what we've published, tell us — that's a bug, and we'd want to know before you write about it.

If you're comparing tools across the category, the four models and the five checks are in Honey alternatives in 2026.

The uncomfortable part

The 2026 enforcement was real and it improved things. It also happened because one investigation was unusually thorough and one journalist was unusually persistent — not because the system detected the problem itself.

The structural position hasn't moved: last-click still rewards whoever is present at the final moment, regardless of who did the persuading. Stand-down rules are a patch on that, implemented voluntarily, verified inconsistently, and enforced differently by each network.

Which means the practical advice is unglamorous. Know the mechanism. Test your own funnel occasionally. Ask your network specific questions and note whether the answers are specific back. And treat any tool's claim about attribution as something to verify rather than something to accept — including ours.

Frequently asked questions