Phoebe Gates' Shopping App Phia Caught Stuffing Cookies to Steal Affiliate Commissions

Phia, the AI shopping extension co-founded by Phoebe Gates and Sophia Kianni, got caught claiming commissions on sales it never actually generated. Multiple investigations, including one from Bloomberg, one from Capital One Shopping, and an independent breakdown by researcher Ben Edelman, all found the same thing: Phia's extension was quietly inserting its own affiliate code into checkout flows without users asking it to.

The technique has a name. It's called cookie stuffing, sometimes called attribution fraud. Edelman documented it in detail, including video showing Phia's affiliate link getting loaded into a hidden second tab on iOS after a user visited a merchant's site. The company didn't drive the sale. The code just showed up anyway, replacing whatever referral credit should have gone to the actual publisher who earned it.

Phia runs on an affiliate model. When someone finds a product through the app and buys it via an affiliate link, Phia takes a cut. According to Hindustan Times, when Phia's code force-inserted itself into a transaction, it was taking a cut it didn't earn, and taking it from whichever other publisher or retailer program actually should have gotten paid.

Impact.com Pulled the Plug

This isn't just researchers grumbling. Impact.com, one of the biggest affiliate networks in the business, told Bloomberg it suspended Phia's account after finding behavior in the extension "inconsistent with our platform policies." That's a concrete, measurable consequence: a major ad network cut Phia off. Affiliate fraud isn't a gray area for platforms like Impact.com. It's a bannable offense, and Phia got banned.

The code responsible reportedly went live in December 2025, according to both Edelman and Bloomberg. That means this wasn't a one-day glitch. It ran for months before anyone outside the company flagged it publicly.

What Phia Says Happened

Phia's defense is that this was a bug, not a scheme. A company spokesperson told Bloomberg: "Within the last 24 hours, we were made aware that in a recent release our codebase was causing misattributions from a subset of users. As soon as we were notified, our team worked overnight to identify, mitigate, and has since resolved the issue."

That's a specific, on-record claim. Software bugs that misroute credit do happen, and "a subset of users" affected by a bad release is a plausible technical explanation. Nobody has published evidence that Gates or Kianni personally ordered the cookie-stuffing behavior, and no regulator has announced an investigation or filed any charges.

The bug framing presents a technical problem, though. Cookie stuffing isn't the kind of error that tends to happen by accident. Deliberately loading a hidden second tab that fires an affiliate click, as Edelman's video reportedly shows, is a specific technical behavior. It's the kind of thing that gets built, not the kind of thing that spontaneously emerges from a typo. Whether that was intentional design that got misused, or a genuine defect in how attribution was coded, hasn't been independently verified beyond the company's own statement.

The Money Behind the App

Phia's growth numbers explain the story's significance. Hindustan Times reports the app hit 21st on the App Store and 20,000 downloads within its first week after launching last spring, crossed 370,000 downloads within three months, and topped 500,000 downloads by September 2025. The company raised $8 million early on, then another $35 million in January, pushing its valuation to $185 million roughly a year after launch.

That's a lot of money and a lot of scale riding on an affiliate revenue model that depends entirely on accurate attribution. If the app is taking credit, and commissions, for sales it didn't drive, that's not a cosmetic problem. It's the business model itself malfunctioning at the exact moment the company was raising serious capital on the strength of its growth numbers.

What's Unresolved

Neither Bloomberg nor Hindustan Times reported that Impact.com or any other affiliate network has reinstated Phia's account since the suspension. No regulator, state attorney general, or federal agency has announced a formal probe into the company's affiliate practices. Whether other affiliate networks Phia works with took similar action, and whether publishers who lost commissions get reimbursed, remains unreported. Phia's own statement doesn't say how many users or how much commission volume was affected, numbers that would tell the public how big this actually was.