Phia Attribution Scandal: 51% of June GMV Under Question

Roughly 51 percent. That is the share of June 2026 merchandise value a preliminary internal analysis attributed to Phia's disputed affiliate tracking features, according to Bloomberg's 11 August follow-up. Phia disputes the methodology, but the underlying revenue chart tells its own story: average daily revenue collapsed from about $80,000 before the shutoff to a band of $10,000 to $28,000 after. That is a 65 to 88 percent drop in daily run rate, depending on which end of the range you take.

The Numbers

Two numbers anchor this story, and both need to be read together. The first is the 51 percent share of June GMV that a preliminary internal analysis linked to the disputed practices, as Affiverse reported. The second is the revenue chart Bloomberg reviewed, showing daily revenue moving from about $80,000 to $10,000-$28,000 once the disputed functionality and other monetisation features were switched off in early July.

Those two data points are not quite the same claim. The 51 percent estimate is a per-transaction attribution question: how much of the credited GMV would not have flowed to Phia under a stricter definition of "deliberate shopper interaction"? The revenue drop is a top-line question that also captures Phia's decision to disable "most monetisation activity," per the company's own statement. Phia is explicit that the two should not be equated, and on that narrow point they are analytically correct. The revenue drop overstates the pure attribution effect because it bundles other switched-off features into the same before/after window.

Still, the bound matters. If we take the 65 percent low-end drop as an upper limit on how much revenue was pure "other monetisation," and the 88 percent high-end as an upper limit on disputed-feature dependency, the honest reader lands somewhere in between. The 51 percent internal estimate sits inside that band. It is not obviously wrong just because Phia's spokesperson calls the methodology incorrect.

The timeline compresses this further. The "enable coupon auto drop" feature was activated on 10 December 2025 and disabled on 7 July 2026, the same day Bloomberg first contacted the company for comment. That is a seven-month operating window. impact.com's correction covered actions pending or locked from 20 June 2026, and processed reversals on 29 July 2026. The source does not disclose how many transactions impact.com reversed or what dollar value they represented, which matters because it is the only third-party quantification we have of downstream damage. Without that number, brand partners at Nike, Gap, and Nordstrom (none of whom commented to Bloomberg) cannot independently size their exposure.

What's Actually New

The 9 July initial Bloomberg investigation described a browser extension that could claim affiliate attribution without deliberate shopper interaction. That framing was consistent with Phia's own explanation at the time: a code path in a recent release caused misattributions for a subset of users, and the company acted once notified. Bad code, quick fix, compliance hire pending. A familiar story.

The 11 August follow-up breaks that frame. Three things are genuinely new. First, the alleged duration: the disputed feature ran from 10 December 2025 to 7 July 2026, not weeks in a recent release. Second, the alleged intent trail: internal Slack messages, historical source code, and communications from co-founders Phoebe Gates and Sophia Kianni with executives and engineers about automatically setting affiliate tracking. Third, the architecture: not one buggy code path, but at least three named mechanisms.

The three mechanisms deserve engineering attention because they describe distinct failure modes, not variations on one theme. "Enable coupon auto drop" was remotely toggleable, which implies a feature flag system with server-side control. That is normal infrastructure hygiene when used for A/B tests or gradual rollout. It becomes evidence when the flag toggles behaviour that changes attribution outcomes for third parties who cannot see the flag state. "Passive trigger" reportedly reset a cookie at regular intervals on certain sites after prior Phia interaction, which is a scheduled or event-driven refresh loop. The third mechanism reportedly fired on any click after the coupon box appeared, including the close click, which is a UI-event handler intentionally over-scoped.

The engineering point here is that these are three architecturally different patterns. It is difficult to explain three independent implementations as an accident. Phia declined to comment to Bloomberg on the passive trigger and click-anywhere features. That is the silence worth noting.

What we still do not know: whether the feature flag telemetry was retained, and whether impact.com's reversal window (from 20 June) reflects the full exposure or just what it could reconstruct from its own event logs. If the disputed feature ran from December 2025, the impact.com correction window covers only the last 17 days of the seven-month period.

What's Priced In for Performance Marketing

Affiliate networks and performance marketers have priced in the existence of last-click attribution abuse for years. Cookie stuffing, forced-click patterns, and toolbar-based last-touch capture are not novel categories. What was not priced in is the size of the potential distortion at a single well-funded consumer shopping extension operating on major retailer traffic including Nike, Gap, and Nordstrom.

Also priced in: the fact that networks will issue reversals rather than terminations for a first major incident. impact.com's notice covered transactions pending or locked since 20 June, processed corrections on 29 July, and encouraged brands to contact Phia directly for future partnership matters. Notably, impact.com did not state that Phia had been permanently removed from the network, did not state that active partnerships had been terminated, and did not use the term "cookie stuffing" in its notice. That is the diplomatic language of an ongoing commercial relationship, not an expulsion.

What is not priced in for engineering teams running attribution stacks: the operational cost of retroactive reversals at scale. impact.com did not disclose how many transactions were affected or quantify the value of the reversals. For brand-side finance and marketing ops teams, that means the reconciliation work is manual, per-partner, and time-boxed to whatever window each network chooses. If a brand ran Phia across multiple networks, the reversal windows will not line up.

The Privacy Sandbox Attribution Reporting API is designed precisely to make this class of unilateral cookie-write invisible to the extension layer, because attribution moves into browser-managed aggregation. That does not solve the incentive problem, but it changes the surface where these games can be played. Teams still on last-click cookie attribution should read this incident as a preview of what the transition math looks like.

Contrarian View

The consensus reading is that Phia's revenue drop from $80,000 daily to $10,000-$28,000 proves the disputed features were the business. That is likely overstated. Phia's own explanation, that the company disabled most monetisation activity in early July rather than only the attribution features, is at least partially credible on its face. When a company is under a Bloomberg investigation and considering a compliance hire, disabling adjacent revenue streams is defensible risk management, not necessarily evidence that those streams were also tainted.

The 51 percent figure is a preliminary internal analysis, not an audit. Preliminary analyses done under time pressure during an investigation often use conservative assumptions that overstate the disputed share, because analysts flag any transaction they cannot cleanly justify. Phia's methodology objection is not implausible.

None of this excuses the seven-month operating window on a remotely toggleable feature that co-founders reportedly discussed in Slack. But the numeric bound on damage is genuinely uncertain, and readers should not treat 51 percent as the settled answer. The settled answer will come from a forensic audit, if one happens, not from a chart reviewed by a reporter.

Key Takeaways

• The disputed "enable coupon auto drop" feature ran from 10 December 2025 to 7 July 2026, disabled the same day Bloomberg contacted Phia for comment. That timeline, not the 51 percent estimate, is the hardest fact in the story.
• Daily revenue fell from about $80,000 to $10,000-$28,000 after shutoff, a 65 to 88 percent drop, but that range mixes the attribution effect with other disabled monetisation. Do not read it as a pure attribution number.
• Three distinct mechanisms are alleged: a toggleable auto-attribution feature, a "passive trigger" cookie refresh loop, and a click-anywhere handler. Three separate architectures are hard to explain as accidental.
• impact.com issued reversals covering 20 June onward and processed them on 29 July, but did not disclose transaction counts, dollar value, or terminate the partnership. The full downstream damage remains unquantified.
• Testable prediction: if Phia's dispute of the 51 percent figure holds up, we should see a forensic audit or third-party attestation published within 90 days, along with reversal disclosures from at least one more network beyond impact.com. If neither appears by mid-November 2026, the 51 percent estimate becomes the working number the industry defaults to.