Tracking Pixels and Cookies Explained

Cookie tracking is the plumbing that has quietly decided who gets paid in affiliate marketing for the better part of two decades. It works invisibly, which is exactly why so few people notice when it starts to fail. I’ve watched it fail from every seat at the table — chasing “missing” commissions as an affiliate, explaining a shortfall to angry partners as an affiliate manager, and signing off the payout run as a brand owner. The pattern is always the same: the sale happened, but the cookie didn’t survive to prove it.

This guide covers how tracking pixels and cookies actually work, the difference between first- and third-party cookies, what a cookie window really buys you, why the whole model is degrading, and what serious programs are moving to instead. It’s the technical companion to our broader affiliate tracking overview.

How cookie tracking works, step by step

A cookie is a small text file a website asks your browser to store. Nothing exotic — the mechanics are documented plainly by MDN’s guide to HTTP cookies. In an affiliate context, that file becomes a memory of who sent you.

Here’s the chain as it runs on a live program:

1. The click. A visitor clicks an affiliate link. Before they land on the merchant, the tracker drops a cookie in their browser.
2. The contents. That cookie holds the affiliate ID, a timestamp, and usually a click ID and campaign parameters.
3. The browse. The visitor shops around, maybe leaves, maybe comes back tomorrow.
4. The conversion. They buy. The merchant’s confirmation page reads the cookie, sees the affiliate ID, and reports the sale.
5. The match. The tracker credits the affiliate and applies the commission rules.

The whole model rests on one assumption: that the cookie set in step one is still readable in step four. When that assumption held, cookie tracking was brilliant — cheap, simple, and good enough. It no longer reliably holds, and that single fact is reshaping the entire industry.

Pixels vs cookies: two tools, two jobs

People lump pixels and cookies together, but they do different work. A cookie stores an identifier over time. A pixel fires an event at a moment.

A tracking pixel is a tiny, usually invisible snippet — historically a 1x1 image, now often JavaScript — that loads on a page and pings a server. When it fires, it reports “this thing just happened” along with whatever data it can see: the referring source, device type, time, and often the value of a conversion. The cookie is the memory; the pixel is the messenger.

In a typical browser-based setup they work as a pair. The cookie remembers the affiliate from the click. The conversion pixel on the thank-you page fires when the sale completes, reads the cookie, and sends both facts back together. Break either half and the credit is lost — a stripped pixel means the event never reports, a blocked cookie means the event reports with nobody attached.

Here’s how the two compare in practice:

• Role: a pixel fires an event on interaction; a cookie stores an ID over time.
• Lifespan: a pixel lives on the page, momentarily; a cookie lives in the browser until expiry.
• Killed by: pixels are killed by ad blockers and script blockers; cookies are killed by clearing, ITP, and expiry.
• Sees: a pixel sees real-time conversion data; a cookie sees the original click’s identity.

First-party vs third-party cookies

This is the distinction that decides whether your cookie tracking survives contact with a modern browser.

A first-party cookie is set by the domain the visitor is actually on. If someone is on merchant.com and merchant.com sets the cookie, that’s first-party — browsers still largely trust it.

A third-party cookie is set by a domain other than the one in the address bar. Classic affiliate networks worked this way: the visitor was on the merchant’s site, but the tracking cookie belonged to network.com. That cross-site visibility is precisely what made third-party cookies powerful for attribution across many merchants — and precisely what privacy engineers decided to shut down.

That’s the crux. Affiliate marketing historically leaned hard on third-party cookies, so the industry is disproportionately exposed as those cookies disappear. Programs built on first-party cookies fare better, but even they hit the seven-day ceiling covered next.

Cookie windows: what you’re actually buying

The cookie window (or cookie duration) is how long the cookie lives after the click. A 30-day window means a visitor who clicks today and buys three weeks later still earns you the commission. Windows range from a stingy 24 hours to 90 days or more.

As an affiliate, the window looks like free money — a longer window means more of your influenced sales get counted. As a manager, I always saw it as a negotiating lever and a risk dial at once: generous enough to attract good partners, tight enough that I’m not paying for a sale the customer would have made anyway. This is where cookie duration bleeds directly into your attribution model, because a long last-click window quietly hands credit to whoever touched the visitor first.

Why cookie tracking is degrading

The ground has genuinely shifted, and it isn’t coming back. Four forces are eroding cookie tracking at once:

• Safari’s ITP. Apple has blocked third-party cookies by default since 2020 and caps first-party cookies set via script at seven days. On iPhone-heavy audiences, that alone guts long windows.
• Firefox’s ETP. Enhanced Tracking Protection blocks third-party cookies by default too.
• Ad blockers and privacy extensions. These strip tracking pixels before they fire and delete cookies outright. A meaningful share of your audience runs them.
• Third-party cookie deprecation. Google walked back forced removal in Chrome in 2024, so third-party cookies aren’t vanishing on a fixed date — but Safari and Firefox already block them, covering roughly 30–35% of global traffic today.

Put together, that’s not a rounding error. It’s a structural undercount, and it always breaks in the same direction: sales happen, cookies die, commissions go unpaid, and affiliates blame you rather than the browser. Layered on top is a compliance dimension — under UK GDPR guidance from the ICO, non-essential tracking cookies need consent before they’re set, so a visitor who declines the banner never gets a tracking cookie at all.

What replaces cookie tracking

The successor is already here, and it sidesteps the browser entirely: server-to-server (S2S) postback tracking.

Instead of stashing an identifier in the visitor’s browser and hoping it survives, S2S passes a click ID between the merchant’s server and the tracker’s server. When the sale completes, the merchant’s server fires a postback carrying that click ID straight to the tracker — no cookie to expire, no pixel to block, no browser to obstruct it. ITP can’t touch a server. Ad blockers never see it.

When I moved paid-media partners onto postbacks, our “lost” conversions dropped noticeably overnight — not because anyone performed better, but because we finally counted the sales cookie tracking had been dropping. The trade-off is complexity: S2S needs proper implementation on both ends and disciplined click-ID handling. It’s worth it. The full walkthrough is in our server-to-server postbacks vs. pixels guide.

If you’re weighing platforms today, we test the major tracking platforms against exactly that standard in our affiliate tracking software reviews, alongside the rest of our tracking guides.

Frequently asked questions

Some links on ClickProfits are affiliate links — see our affiliate disclosure.