How does affiliate tracking work?

Affiliate tracking is the process of following a visitor from the moment they click an ad to the moment they complete a purchase — then attributing that purchase back to the specific campaign, keyword, ad creative, and traffic source that produced the click. It is the mechanism that turns raw ad spend into measurable, optimizable performance data.

The tracking flow in five steps

Every affiliate tracking system, regardless of vendor, follows the same fundamental sequence:

1. Ad click — A user clicks an ad on Google, Meta, TikTok, a native ad network, or any other traffic source. The ad platform appends a click identifier to the destination URL (e.g., ?gclid=abc123).
2. Click capture — The visitor lands on the affiliate's page (pre-sell, landing page, or bridge page). A tracking script reads the click identifier and any UTM parameters from the URL and creates a session — a record containing the click ID, campaign name, keyword, device type, IP address, geographic location, and timestamp.
3. Link decoration — When the visitor clicks the affiliate's call-to-action link (leading to the vendor's checkout), the tracker appends a session identifier (often via a sub-ID parameter) to the outbound URL. This is the critical handoff: it ties the visitor's journey on the affiliate's side to the transaction on the vendor's side.
4. Conversion event — The visitor completes the purchase on the vendor's or network's checkout page. The vendor's system records the transaction along with the sub-ID that was passed through.
5. Attribution — The vendor fires a postback (or webhook) to the tracker containing the transaction ID, sale amount, and the sub-ID. The tracker matches the sub-ID to the original session and records the conversion against the correct campaign, keyword, and ad creative.

Click identifiers explained

Each ad platform uses its own click identifier — a unique string generated per click that allows conversions to be traced back to the exact click that initiated them.

Platform	Click ID parameter	How it works
Google Ads (Search, Shopping)	gclid	Auto-appended to the final URL. Valid for 90 days. Required for offline conversion import.
Google Ads (YouTube, Demand Gen)	wbraid / gbraid	Privacy-safe identifiers for cross-app and cross-web attribution. Only supported via API upload.
Meta Ads (Facebook, Instagram)	fbclid	Appended to outbound click URLs. Used by the Meta Conversions API for server-side matching.
TikTok Ads	ttclid	Works with TikTok's Events API for server-side conversion reporting.
Microsoft Ads	msclkid	Similar to gclid. Supports offline conversion import via API or file upload.
Taboola	{click_id}	Macro replaced at click time. Used for S2S postback conversion reporting.
MGID	{click_id}	Macro replaced at click time. Postback-based conversion tracking.

Postback (S2S) vs pixel tracking

There are two fundamentally different ways for a conversion event to travel from the vendor back to the tracker.

Pixel tracking (client-side)

A small piece of JavaScript or an image tag is placed on the vendor's thank-you page. When the buyer's browser loads that page, the pixel fires and notifies the tracker of the conversion. This method is simple but fragile:

• Ad blockers and privacy browsers can prevent the pixel from firing.
• If the buyer closes the browser before the thank-you page fully loads, the conversion is lost.
• Third-party cookie restrictions (Safari ITP, Firefox ETP, Chrome's Privacy Sandbox) increasingly block cross-domain pixels.

Server-to-server postback (S2S)

The vendor's server sends an HTTP request directly to the tracker's server when a conversion occurs. No browser is involved. This method is:

• Immune to ad blockers — The communication happens between servers.
• Immune to cookie restrictions — No cookies are needed.
• More reliable — Server-to-server calls have retry mechanisms and do not depend on page load timing.
• The industry standard — Major affiliate networks (ClickBank, MaxBounty, BuyGoods) and platforms (Hotmart, Kiwify) support postback URLs natively.

According to industry benchmarks, S2S postback tracking captures 15-30% more conversions than client-side pixels, primarily due to ad blocker prevalence and browser privacy restrictions.

First-party vs third-party tracking

The distinction between first-party and third-party tracking has become critical as browsers restrict third-party cookies.

Third-party tracking

The tracker operates on a different domain than the landing page. Cookies set by the tracker are classified as third-party and are blocked or limited by most modern browsers. This reduces the tracker's ability to maintain session continuity across page navigations.

First-party tracking

The tracker either operates on the same domain as the landing page (via a custom tracking domain or CNAME) or uses first-party JavaScript that stores session data in the browser's first-party context (localStorage, first-party cookies). This approach is more resilient to browser privacy restrictions and is the direction the industry is moving.

Server-side tracking: the future

The long-term trend in digital advertising is unmistakable: tracking is moving from the browser to the server. Every major ad platform now offers (or requires) a server-side conversion API:

• Google Ads — Offline Conversion Import API and Enhanced Conversions
• Meta Ads — Conversions API (CAPI), increasingly required alongside the pixel
• TikTok Ads — Events API
• Taboola / MGID — S2S postback URLs

For affiliates, server-side tracking via postbacks has always been the norm (since they do not control the checkout page). The shift benefits affiliates because ad platforms are now building infrastructure that aligns with the postback model affiliates already use.

What makes attribution accurate

Accurate attribution depends on maintaining an unbroken chain of identifiers from click to conversion. The most common points of failure are:

• Broken parameter passthrough — If the click ID does not travel from the landing page to the affiliate link to the checkout, the conversion cannot be attributed. Tracking scripts must decorate all outbound links with the session identifier.
• Delayed conversions — A visitor who clicks today and buys three weeks later may fall outside the click ID's validity window (e.g., GCLID expires after 90 days, but some networks have shorter windows).
• Cross-device journeys — A visitor who clicks on mobile but purchases on desktop creates two sessions. Without cross-device identity resolution (which requires login-based matching), these remain separate.
• Redirect chains — Each redirect in the funnel is a point where parameters can be stripped. Shorter funnels with direct tracking (no redirects) lose fewer conversions.

Affiliate tracking is, at its core, a chain-of-custody problem. The click ID is the evidence, the tracker is the chain, and the postback is the proof of outcome. Every break in the chain is a conversion you paid for but cannot measure.