Two affiliates send the same shopper to the same store. One writes a long review the shopper reads on a Tuesday. The other runs a coupon site the shopper visits 90 seconds before checkout on Friday. Only one of them gets paid, and the thing that decides which is not effort, not influence, not who created the demand. It is a number in the program's terms that most marketers never read: the attribution window.
That number controls a surprising amount. It decides how long a click stays worth money, which partner wins when several are in the running, when a commission becomes safe to spend, and whether a payout already in an affiliate's account can be taken back. Get it wrong as a brand and you either underpay the partners doing real work or hand budget to the ones merely standing at the till. This piece is about that one number and the three clocks hiding inside it.
Origin: a window the early web needed in order to count anything
Affiliate marketing predates most of the modern web. William J. Tobin ran a beta of an internet revenue-share program for PC Flowers and Gifts in cooperation with IBM in 1994, filed for a tracking and affiliate-marketing patent in January 1996, and was granted U.S. Patent 6,141,666 in 2000. Amazon opened Associates in July 1996 and turned the model from private bilateral deals into a public program anyone with a website could join. From the start, all of it depended on one question: when a sale happened, who sent the buyer?
The browser cookie became the answer because it was the only tool available. A shopper clicks an affiliate link, the merchant or network drops a small file in the browser recording which affiliate sent them, and if a purchase follows, the checkout reads that file and credits the partner. Simple, deterministic, and good enough to build an industry on. But a cookie cannot live forever. It needs an expiry date, and that date is the attribution window. Without one, a click from three years ago could claim a sale today. With one, the merchant draws a line: clicks count for this long and not a day more.
So the window was never a clever design choice. It started as the answer to "how stale is too stale." Almost everything contentious about it today traces back to one fact: a number invented to bound a technical problem turned out to decide who earns a living from it.
Present: three clocks people keep mixing up
Ask ten marketers what an attribution window is and you will get answers describing three different things. They all involve time, and conflating them is the most common source of confusion in affiliate payouts.
The cookie window, also called cookie duration or click-to-conversion window, is the one most people mean. It starts when the shopper clicks the affiliate link and runs forward. If the purchase lands inside it, the affiliate is in the running for commission. If it lands outside, that click is worth nothing. As Avelon describes it, a 30-day window credits a click that converts on day 20 and ignores the same click converting on day 31. Durations in the wild run from 24 hours to 90 days and beyond. Amazon Associates is famously stingy at 24 hours, though items a shopper adds to cart inside that day stay tracked until the cart expires, usually after 90 days. The common standard is 30 days. B2B and software programs stretch to 60 or 90 because their buying cycles run longer.
The lookback window is the same idea pointed backwards. Instead of starting at a click and looking forward to a sale, it starts at a sale and looks back for clicks to credit. In a pure last-click affiliate setup the two produce identical results, so the terms get used interchangeably. They stop being interchangeable the moment a brand runs multi-touch attribution, where several touchpoints in the lookback period each receive a share of credit. For most single-network programs, treat lookback as the analytics-flavored name for the same clock.
The locking period, sometimes called the validation period, is a completely different clock and the one beginners never see coming. It does not run from the click. It runs from the sale, forward, and it answers a different question: not "does this affiliate qualify" but "is this commission final yet." During the locking period a recorded sale sits as pending while the merchant confirms the order was real, the payment cleared, the goods were not returned, and the traffic was not fraud. Only when the lock expires does the commission become owed money. impact.com walks an action through pending, then locked, then clearing, then paid, with the locking step existing so a brand can still reverse a sale that does not deserve a payout.
Cookie window decides who is eligible. Locking period decides when the money is safe. Confuse the two and you will misread your dashboard for months.
Last click, but only inside the window
Here is the rule that ties the cookie window to who actually gets paid. The dominant attribution model in affiliate marketing is last click. The commission goes to the most recent affiliate whose cookie is still alive at the moment of purchase. Not the first affiliate. Not the most persuasive. The last one.
Now layer the window on top. Last click does not mean the last affiliate ever. It means the last affiliate inside the window. If a shopper clicks Affiliate A on day one and Affiliate B on day five and buys on day six, B wins. Whether A even remains in contention depends on a setting called cookie overwriting. With overwriting on, B's click deletes A's cookie and B takes everything. With overwriting off, the program runs first click: A's cookie cannot be displaced and A keeps the sale no matter how many partners follow. Some networks offer a middle path with soft cookies, which record later touches without overwriting the original hard cookie.
This is the mechanism behind the affiliate industry's loudest recent scandal. In December 2024 the YouTuber MegaLag published an investigation alleging that PayPal's Honey browser extension modified affiliate links at checkout, claiming the commission even when it applied no discount. PayPal's defense, recorded in the public account of the episode, was that Honey followed industry rules including last-click attribution. That defense was technically accurate, and that is the uncomfortable part. An extension that activates at the final click, inside the window, after a content creator already did the persuading, is last click working as designed. The scandal was not a broken rule. It was a rule doing what it says, and an industry noticing it did not like the result. Honey shed millions of users, and on January 12, 2026 Rakuten Advertising removed it from its network.
Window length quietly picks winners
A merchant who treats the cookie window as a sleepy setting in the program config is making a strategic decision without realizing it. Length is not neutral. It tilts payouts toward different kinds of partner.
Short windows favor the bottom of the funnel. Set the window to 24 hours or 7 days and you mostly pay whoever was last, because only partners active right before checkout fit inside such a narrow gap: coupon sites, cashback portals, browser extensions, retargeting partners. The content creator whose review the shopper read three weeks ago is long expired. Long windows favor the top. Push the window to 90 or 365 days and a click from a review or comparison article written weeks before the purchase is still alive when the buyer converts, so content publishers and niche site owners benefit.
This is why affiliates and brands pull in opposite directions, and the pull is structural rather than greedy. Affiliates want longer windows so more of their clicks survive to payday. Brands instinctively want shorter ones to avoid paying for sales they suspect would have happened anyway. The reason the brand instinct is often wrong is that the timing data does not back up the fear. Refersion, summarizing affiliate purchase patterns, reports the large majority of affiliate sales arrive within the first seven days of the click, with only about 1 percent landing after day 15. A long window costs the merchant little in extra payouts. What it buys is a recruiting signal: it tells serious publishers the brand is not playing games with their credit.
Window length also shapes behavior, not just accounting. A short window trains partners to chase the last click, because that is the only click that pays, and they drift toward coupon codes, brand-term bidding, and checkout interception. A long window makes upper-funnel content economically rational, because a sale that arrives three weeks later still lands in their account. The window is not just measuring affiliate behavior. It is teaching it.
When the money gets taken back
The cookie window decides who earns a commission. It does not decide whether they keep it. That is the locking period's job, and on its far side sits the part nobody enjoys: reversals and clawbacks.
A reversal voids a commission before it is paid out. The sale was recorded, sat pending through the locking period, and during that time something disqualified it: the order was canceled, the product returned, the payment charged back, the traffic flagged as fraud. FastSpring is blunt about the logic: no revenue was ultimately collected, so no commission is due. Crucially, a refund does not reverse the commission automatically. Some rule has to do it, which is why the locking period exists as a deliberate buffer.
A clawback is the harsher cousin. It claws back a commission already paid. The refund or chargeback arrives after the locking period closed and the money already left for the affiliate, so the brand recovers it from the next payout. Clawback policies typically work by deduction: the recovered amount is subtracted from what the affiliate earns next, and a negative balance carries forward. An affiliate can genuinely owe a network money.
Locking periods vary and are worth checking before you count on a payment. Historically Commission Junction used a default lock date of the 10th of the month and ShareASale the 20th, as catalogued by affiliate veteran Geno Prussakov. FastSpring locks a month's actions one full month after that month ends and pays out around the 15th. Many programs tie commission eligibility to the close of the refund window, often 30 days. The detail to internalize is that "pending" is not "paid," and the gap between them is where a brand still holds every right to take the commission away.
For affiliates, this reframes how to read a dashboard. A pile of pending commissions is not income. It is a forecast, and a high reversal rate is a warning sign, sometimes of fulfillment problems on the merchant's side, sometimes of low-quality traffic on the affiliate's. The locking period is the channel's quality-control valve, and the reason performance marketing can promise that brands pay for outcomes, not for clicks that evaporate.
Future and impact: the window in a world after the cookie
Every clock above assumes the same machinery: a third-party cookie set on a click and read at checkout. That machinery is failing. Safari and Firefox block third-party cookies by default, ad blockers strip them, and a click on one device followed by a purchase on another breaks the chain entirely. When the cookie does not survive, the window is moot. There is nothing left to expire.
The response is a move to first-party and server-side tracking. Programs increasingly pass a click identifier through to the merchant's own systems and confirm the sale server to server, then match it back to the originating affiliate. The attribution window does not disappear in that world. It moves. It stops being a cookie lifespan and becomes a rule inside the merchant's data, the same question of how long a click stays creditable, enforced where a privacy setting cannot reach.
The harder pressure is on last click itself. As shoppers research inside AI assistants and the click drifts later or vanishes into a chat answer, crediting one final touch inside one window looks shakier every year. Brands are moving toward multi-touch credit and toward incrementality testing, which asks the question the window never could: not who got the last click but which partners produced sales that would not have happened otherwise. That is the deeper lesson of the Honey episode. Last click rewards proximity to the purchase, and proximity is not the same as influence.
So the attribution window is not going away, but it is being demoted. For years it was the whole answer to who gets paid. It is becoming one input among several, alongside server-side signals and incrementality data. The brands that run clean programs treat the window as a deliberate lever, not a default left untouched since launch. That one number was never just a technical setting. It was always a decision about who in your partner base deserves to get paid, and pretending otherwise just means you made the decision by accident.
Council summary
This post argues that the attribution window is not one setting but three separate clocks (cookie window, lookback window, and locking period), and that treating any of them as a default quietly decides who in a partner base gets paid. Review confirmed the named facts against primary sources: the Amazon Associates 24-hour session and 90-day cart rule, Refersion's finding that roughly 1 percent of affiliate sales convert after day 15, and the Commission Junction and ShareASale lock dates from Geno Prussakov. The origin paragraph was corrected, since Tobin ran the IBM beta in 1994 but only filed his patent in January 1996, and the Honey timeline was fixed to the verified Rakuten removal date of January 12, 2026. The takeaway: set window length as a deliberate lever, read "pending" as a forecast rather than income, and expect last-click attribution to lose ground to server-side tracking and incrementality testing.
Comments