Every affiliate commission depends on one invisible question: how does the network know this sale came from that link? The answer used to be simple. Now it is not.
Understanding the mechanics matters even if you never touch a line of code. Program managers who don't understand tracking approve broken integrations, blame affiliates for "missing" sales that were never recorded, and lose partners over disputes that a better setup would have prevented.
How cookie-based tracking works
When a shopper clicks an affiliate link, the network drops a small text file called a cookie into their browser. It stores the affiliate's ID and a timestamp.
If that shopper buys within the program's "cookie window" (commonly 30 days), the merchant's checkout page reads the cookie and credits the affiliate. This has been the default model since the late 1990s, and most people still picture it when they think about affiliate tracking.
The problem: cookies live in the browser, and browsers have spent the last several years trying to kill them.
Why cookies are breaking down
Apple's Safari introduced Intelligent Tracking Prevention (ITP) years ago, capping first-party cookie life and blocking third-party cookies outright. iOS users on Safari, a huge share of mobile shoppers, were already invisible to old-style tracking before 2025 even started.
Chrome's story has been messier. Google spent years promising to kill third-party cookies, tested the removal on 1% of Chrome users in early 2024, then reversed course in July 2024 and confirmed in April 2025 it would keep cookie choice with the user instead of a blanket ban. Ad blockers, private browsing modes, and multi-device shopping (click on phone, buy on laptop) all quietly erase cookie-based attribution regardless of what Chrome decides.
The net effect is the same either way: a meaningful slice of real, affiliate-driven sales never get credited. Affiliates see traffic and no commission; merchants see "free" conversions and undervalue the channel that produced them.
Enter server-to-server (S2S) tracking
S2S, also called postback tracking, skips the browser entirely. When a shopper clicks an affiliate link, the network generates a unique click ID and passes it to the merchant's server, often tucked into the checkout or order-confirmation URL.
When the order completes, the merchant's server sends that click ID straight back to the affiliate network's server, no cookie, no browser dependency, no ad blocker in the way. It is server talking to server, which is exactly what the name says.
This is why S2S has become the standard rather than a niche workaround. Industry estimates put roughly two-thirds of affiliate networks moving toward privacy-first, server-side tracking by 2025, and some implementations report double-digit gains in recorded conversion accuracy simply from switching over.
Notice that nothing in that chain lives inside the shopper's browser. That's the entire point: there's no cookie for an ad blocker to strip or a browser setting to expire.
Tracking pixels still have a role
A tracking pixel is a tiny, invisible 1x1 image loaded on a merchant's "thank you" page. When it loads, it fires a request back to the network confirming the conversion, similar in spirit to a cookie but triggered at the moment of purchase rather than at click.
Pixels are easier to implement than full S2S but share cookies' core weakness: they still run in the browser and can be blocked. Most modern programs treat pixels as a fallback layer, not the primary system.
Common mistakes in S2S implementation
Switching to S2S fixes browser-based tracking loss, but only if it's actually implemented end to end. A few gaps show up repeatedly.
- Wiring it up on desktop checkout only, then forgetting the mobile app checkout flow, sales made inside a native app still go untracked if the postback isn't fired there too
- Never testing with a real end-to-end order before rolling out to top affiliates, a single misconfigured parameter can silently drop every conversion for weeks
- Assuming S2S solves cross-device attribution: it fixes browser and ad-blocker loss, not a shopper who clicks on their phone and buys later on a laptop, that's a separate problem requiring deterministic ID matching
- Running pixels and S2S in parallel with no priority rule, so a single sale gets double-counted or the systems quietly disagree on which one to trust
A working S2S setup is worth a real test purchase before you trust the numbers it produces. Five minutes of manual verification catches problems that would otherwise take months to notice in aggregate reporting.
What this means for your program
If you manage affiliates, ask your network directly whether S2S postback is available and whether your top partners are actually using it. A network that still relies solely on browser cookies in 2026 is quietly under-crediting your best affiliates.
If affiliates are complaining about "phantom" traffic that never converts on their dashboard, check the tracking method before you check the affiliate. Cookie loss, not affiliate fraud, is the more common culprit.
For affiliates on the other side, ask merchants for S2S setup before signing an exclusive deal. A generous commission rate is worthless if half your real sales get lost between click and checkout.