a stress test for the industry. Phia’s rise had, until now, been defined by glamour rather than glitches. Backed by US$43.5 million in funding and a valuation of US$185.5 million, the startup assembled an investor roster that reads like a red-carpet guest list: Khloé Kardashian, Sydney Sweeney, Alix Earle, Karlie Kloss, Rachel Zoe and LVMH’s Alexandre Arnault, among dozens of others. Gates, the 23-year-old daughter of Microsoft co-founder Bill Gates, framed the company’s ambitions in grand terms, describing it on LinkedIn as “the AI alignment layer between brands and consumers.” By May, Phia counted 1.5 million users and 9,600 brand partners and was projecting nine-figure sales growth for 2026. That narrative gave the company outsized cultural visibility for a business that, functionally, is an affiliate marketing operation – one that earns a cut when its browser extension helps a shopper find a discount or a better price. It’s a model built on precise, auditable attribution: a publisher’s link is clicked, a cookie is set, a sale follows, a commission is paid. Bloomberg’s testing suggested Phia had stopped waiting for that sequence to occur naturally. What the bug actually did According to Bloomberg’s reporting, Phia’s mobile browser extension opened an invisible background tab during checkout on more than 50 retail sites – including Walmart, Nike and Zara – silently loading its own affiliate link before closing the tab within seconds. Independent researcher Ben Edelman, who reviewed the code alongside competitor Capital One Shopping, described this as a case of “forced clicks”: Phia claiming credit for referrals it never earned, rather than merely outmaneuvering a rival for an existing one. Edelman also identified a second, separate infraction – a “stand-down violation.” Under standard affiliate rules, if a shopper has already been referred by another publisher, competing platforms are required to step back. Phia, he said, correctly detected when a rival’s link was active but failed to withdraw its own, a practice explicitly barred by the terms of service at Impact.com, CJ Affiliate, Rakuten and Awin. The behaviour reportedly dated back to December, meaning it ran undetected for roughly seven months before external testing flagged it. Phia’s response was swift but narrow. The company called it a “bug” causing “misattributions from a subset of users” and said it resolved the issue within 24 hours of being alerted, adding that it undergoes regular audits. Bloomberg confirmed the fix upon retesting. Edelman was less charitable, telling Bloomberg he did not believe the pattern was accidental – a distinction that matters enormously for how regulators, platforms and advertisers ultimately respond. A familiar playbook, a growing list Phia is not the first shopping tool to be accused of this. PayPal’s Honey extension faced nearly identical allegations in 2024 and 2025, triggering a California class action and an exodus of affiliate-network partners; the case remains unresolved. Capital One Shopping settled a similar suit from influencers whose tracking codes were allegedly overwritten. And this is Phia’s second privacy-adjacent controversy in under a year – Fortune reported last November that the app’s extension had been capturing snapshots of users’ browsing activity, including sensitive financial and email content, before the company scaled back to logging URLs only. What makes the current scandal more consequential is the timing. Cookie stuffing is an old-economy fraud tactic resurfacing just as shopping shifts toward AI agents and one-click “agentic” checkout tools – Google’s new Universal Cart among them. As browsers themselves start acting on a shopper’s behalf, the industry’s ability to verify who actually earned a commission becomes both harder and more important. Affiliate marketing has always relied on an honour system stitched together by cookies and terms-of-service agreements; automation strips out the human clicks that made that system legible in the first place. The harder question for affiliate commerce Beyond Phia’s specific conduct, the latest cookie-stuffing scandal revives a more uncomfortable question: can a shopping-recommendation platform build a durable business on affiliate commissions alone? The model has worked best for creator-economy players like LTK and ShopMy, which tie commissions to influencers who demonstrably drive sales through content. Price-comparison tools promising to “never overpay again” face a structural temptation – the gap between what they’re owed and what they can silently take is often invisible to everyone but the merchant footing the bill. For an app that marketed itself as the trustworthy alternative to bloated big-tech shopping tools, the irony is pointed. Phia’s fix may have closed the code loophole. Whether it can close the credibility gap with brand partners, affiliate networks and its own celebrity-studded shareholder base is a considerably harder rebuild.