Affiliate tracking and attribution: links, codes and postbacks

A player clicks your tracking link, the operator remembers your ID for a set window, and if the player signs up inside that window the referral is yours. Published windows vary: bet365 says visitors are "cookied for 30 days", and FDJ United runs a last-click cookie valid for 45 days. Browser privacy rules can shorten what the player's browser stores, which is why the method behind the cookie matters as much as the headline number. The programme terms quoted here were read in October 2026.

How a tracked referral works

1. The click. Your tracking link carries your affiliate ID, and often a campaign or click ID, to the operator.
2. The record. The operator stores that ID, in a cookie in the player's browser, on its own server, or both.
3. The registration. If the player registers within the cookie window, the account is tagged to you.
4. The qualification. The player then has to meet the programme's criteria, usually a first deposit within a further window, to count for CPA or start generating revenue share.
5. The report. The event shows in your dashboard, and on some platforms is sent to you as a postback.

Operators describe the mechanics in their terms. William Hill says it tracks by tracking URL, tracking software and cookies (7.1). Super Partners tracks by Affiliate ID and will not credit customers "who are not properly tagged". 888 makes the affiliate responsible for correctly formatted links (4.7).

Affiliate view

Test every link before it goes live, and again after any site or template change. A broken parameter is your loss under at least one published set of terms, and nobody will notice for you.

Two clocks: the cookie window and the deposit window

Attribution usually runs on two clocks: one from click to registration, and a second from registration to first deposit.

A long cookie with a short deposit window can pay less than a shorter cookie with a generous one, depending on how your audience behaves. Ask for both numbers.

Last-click attribution

Under last-click, the most recent affiliate click before registration wins. FDJ United states it plainly: "We operate a last-click cookie which is valid for 45 days", and its terms link a customer to the last affiliate who referred them based on the tracking cookie.

Last-click is simple to run and simple to explain. It also means an affiliate who introduced a player can lose them to one who caught the final click. That is the rule as written, not a fault, so it belongs in the conversation before you sign.

Conflicts still happen. LeoVegas lists adjustments for duplicate accounts, "attribution conflicts" and invalid traffic among the items that can change net revenue.

Operator view

Publish the attribution model in the terms, not only in an FAQ. FDJ United does both. A model an affiliate can read is one they cannot later claim they were never told.

Promo codes

A promo code gives the player something to type in, which ties the sign-up to an offer and, depending on the programme's set-up, to an affiliate. Codes are a permissioned channel in some programmes: 888 lets affiliates publish bonus codes only with prior written consent and in line with its guidelines (3.6).

If you use both a link and a code, ask the programme which one wins when they point to different affiliates, and get the answer in writing.

Postbacks and server-to-server tracking

A postback is a message the operator's platform sends to the affiliate's server when an event happens, such as a registration or a first deposit. Because it runs server to server (S2S), it does not depend on anything stored in the player's browser.

Platforms advertise this. According to an Intergame report, Affilka's postbacks cover registration, first deposit, any deposit, player qualification, prequalification, disqualification and net gaming revenue. SOFTSWISS's own Affilka page lists "event-triggered conversion tracking" and data updates that can run every 15 minutes. Our affiliate software comparison covers which platforms describe what.

Postbacks report events as they happen. Your monthly statement reports what you are paid on, after qualification rules and deductions. Expect the two to differ, and reconcile them each month rather than assuming either is wrong.

What browser privacy means for affiliates

Safari has changed how long browsers keep tracking data, in steps published by WebKit:

• February 2019 (ITP 2.1). Persistent cookies created by scripts in the page (document.cookie) are "capped to a seven day expiry". Cookies set by the server in an HTTP response are not covered by this cap.
• April 2019 (ITP 2.2). Those script-set cookies are capped to one day when the user arrives from a domain Safari classifies as a cross-site tracker and the landing URL carries a query string or fragment, which is how affiliate click IDs are usually passed.
• March 2020. Safari blocks third-party cookies by default: "Cookies for cross-site resources are now blocked by default across the board."

Chrome took a different path. Google said on 22 April 2025 that it "will not be rolling out a new standalone prompt for third-party cookies", leaving users to choose in Chrome's settings.

Our reading, which is an inference from the WebKit posts and not a claim any operator makes: a 30 or 45 day cookie window describes the programme's rule, but a cookie written by script in Safari may not last that long. Tracking that records the click on the operator's server, through server-set cookies, stored click IDs or S2S postbacks, is not subject to those client-side caps.

Worth knowing

Ask how the programme stores the click, not just for how long. "45 days" and "45 days, server-side" are different promises for a Safari user.

What to agree in the deal

Before traffic starts, both sides should have these in writing:

• Cookie window, and whether the click is stored server-side.
• Deposit or qualification window after registration.
• Attribution model, usually last click, and how conflicts with other affiliates are settled.
• Promo-code rules, including consent and what happens when code and link disagree.
• Postback events and timing, if offered, and which event triggers CPA.
• Link format and parameters, and who checks them.
• Prohibited methods. Entain, for example, allows cookies to be set only when a user clicks, not on an ad impression (5.15(g)).
• How missing players are raised, and within what window.

Affiliate view

Keep your own click and registration logs. They will not override the operator's records, but they turn "I think I'm missing players" into a specific question about dates and volumes.

Checklist

• Confirm both windows and the attribution model in writing.
• Ask whether clicks are stored server-side.
• Test links on Safari and Chrome before launch.
• Get written consent before publishing any code.
• Reconcile postback or dashboard data with the monthly statement.