If you run or manage an affiliate program, understanding tracking at a technical level will save you money, reduce disputes, and help you spot fraud before it costs you.

Here’s exactly what happens from click to commission.

The click

When a user clicks an affiliate link, the tracking platform:

1. Logs the click — recording a unique click ID (usually a ULID or UUID), the affiliate ID, the offer, timestamp, IP address, and user agent.
2. Sets a cookie — so the conversion can be attributed even if it happens hours later.
3. Redirects the user to the advertiser’s landing page, usually passing the click ID as a URL parameter (e.g. ?click_id=01HX...).

The click ID is the thread that holds everything together. It gets passed through the advertiser’s checkout or form flow and returns with the conversion.

The conversion

When a user completes the desired action (purchase, signup, form submission), the advertiser fires a postback URL — an HTTP request to your tracking platform that includes:

• The click ID
• Optionally: a transaction ID, order value, and status

Your platform matches the click ID to the original click record and creates a conversion event.

What can go wrong

Cookie deletion — users clearing cookies between click and conversion means the click ID is lost. Server-side postbacks (where the advertiser calls your URL directly) are more reliable than pixel-based tracking.

Postback fires twice — a common issue with some advertiser integrations. Your platform should deduplicate on the transaction ID so the same sale isn’t counted twice.

Clock skew — if a conversion arrives with a timestamp before the click, something is wrong. Flag these for review.

IP mismatch — if the click and conversion come from wildly different IPs or geolocations within minutes, it may indicate fraud.

Server-side vs client-side tracking

	Client-side (pixel)	Server-side (postback)
Reliability	Lower — blocked by ad blockers, ITP	Higher — direct HTTP call
Setup complexity	Low	Medium
Data richness	Limited	Full order data possible
Fraud risk	Higher	Lower

For most CPA networks, postback tracking is the standard. Client-side pixels are mainly used as a fallback or for display-based programs.

Reading your data

When auditing your affiliate program, check:

• Click-to-conversion time — legitimate conversions cluster in the first 1-2 hours. Spikes at 23+ hours may indicate cookie stuffing.
• Conversion rate by affiliate — outliers warrant scrutiny. An affiliate converting at 40% on an offer where others convert at 5% is a red flag.
• Unique IP ratio — if an affiliate drives 500 clicks from 3 IP addresses, they’re not sending real traffic.

Good tracking infrastructure surfaces this data automatically. Platforms like OfferMesh flag suspicious activity at the click level so you can review it before approving commissions.

---

Tracking is not glamorous, but it’s the foundation that everything else in affiliate marketing sits on. Get it right and disputes disappear. Get it wrong and you’ll spend half your time arguing with advertisers about numbers that don’t match.