Hi CIPA World! Before joining Troutman Amin, I kept up with a controversy involving Phia Holdings, Inc. (“Phia”), the company founded by Phoebe Gates (yes, that Gates) and Sophia Kianni. The popular shopping app and browser extension, Phia, helps shoppers find the best deals and alternative options across thousands of online retailers. But this summer, Phia drew attention for a different reason after Bloomberg reported that its browser extension was engaging in cookie stuffing.
In affiliate marketing, publishers generally earn a commission for referring consumers to retailers when those referrals result in purchases. Cookie stuffing can manipulate that process by allowing an affiliate to receive credit for a purchase even when the consumer did not actually use that affiliate to reach the retailer.
With Phia’s code being publicly available, on July 9th, Bloomberg reported its results from testing more than 50 websites and found that Phia’s browser extension could trigger affiliate attribution without deliberate shopper interaction. According to Bloomberg, an internal feature labeled “enable coupon auto drop” was configured to automatically place an affiliate tracking cookie every two hours, potentially allowing Phia to claim credit for purchases even when shoppers had not affirmatively used Phia to make them. This feature was disabled within 24 hours on July 7th after Bloomberg contacted Phia regarding their findings.
While Bloomberg alleges the cookies were deliberately placed with internal Phia Slack messages as evidence, Phia characterizes the conduct as a technical problem/bug rather than intentional cookie stuffing and disputes the implication about the magnitude of revenue attributable to the practice. Nonetheless, Phia set out to rectify the issue by announcing that the feature was removed, that they would be issuing reversals to affected brand partners, and that they would be hiring a head of compliance.
Why does this Matter?
This issue highlights a broader concern for businesses using affiliate marking and online tracking technologies: what happens behind the scenes matters. Businesses should know when tracking is triggered, what information their technology collects or transmits, and whether those practices match what is disclosed to consumers. Depending on how the technology operates, undisclosed tracking could also implicate Section 631(a) of the California Invasion of Privacy Act (“CIPA”).
Phia’s situation is a good reminder that even a feature intended for affiliate marketing can raise privacy concerns depending on what it does in the background. Ultimately, businesses need to know what their technology is doing and make sure their compliance practices keep up. To avoid… this.