Affiliate Tracking, Attribution Windows, and Postback Hygiene

Affiliate disclosure: We may earn from partner links. We follow local rules. Readers should see offers and risks with clear terms.

Cold open: the week the numbers broke

On Monday, deposits looked fine. By Wednesday, first-time buyers from affiliates fell 22%. Partners asked why clicks were strong but sales were gone. The PPC team swore bids were steady. Dev said, “We only moved a pixel to a new subdomain.” Friday came with panic. The fix was not a budget change. It was about tracking rules, a short window, and a postback that fired twice, then not at all.

This guide is the field kit I wish we had that week. It shows how to see the path, pick fair windows, and keep postbacks clean. No fluff, just steps you can run today.

The two‑minute clarity test

Let’s name the parts in plain words:

Click ID: a unique code for a click.
Session vs user: a visit vs the person across visits.
First‑touch vs last‑touch: first click gets credit vs last click gets credit.
View‑through: a user saw an ad, did not click, then converted.
Lookback window: how long after a click or view you still give credit.
FTD / first purchase: the first real money event.

One rule to hold close: attribution windows are business rules; postbacks are plumbing. Get the rules wrong and you reward the wrong partner. Get the plumbing wrong and you drop money on the floor.

Anatomy of a click‑to‑conversion path

Here is a simple path. A user clicks an affiliate link. They go to your tracking domain, then to your site. Your site stores a click ID (cookie, local storage, or server side). The user signs up. Your app fires an event. Your server also logs it. Later, the user makes a deposit or buys. Your system sends a server‑to‑server (S2S) postback to the network, with the click ID and the event data. The network confirms and records a payout.

Loss can happen anywhere. A long redirect chain drops the click ID. A cookie gets blocked. A single‑page app (SPA) changes routes and the pixel never loads. Time zones do not match, so the event sits outside the window. Consent gates hold scripts and the event never fires. Your BI shows one day; your network shows another.

Failure modes no one warned you about

Here are the top traps we see, and how to spot them fast:

SameSite cookie changes break cross‑site flows. Symptom: clicks track, but repeat visits lose the click ID. Fix: use first‑party cookies or S2S IDs.
Content Security Policy blocks the pixel. Symptom: script blocked in console. Fix: add the script host to CSP.
MMP vs network windows differ. Symptom: 5–15% gap in late events. Fix: line up lookbacks and time zones.
No idempotency causes double sales. Symptom: two payouts for the same order ID. Fix: dedupe on a stable key.
DST/time zone skew. Symptom: end‑of‑month drops or spikes. Fix: store UTC and source time zone.
Postback retries without a dedupe key. Symptom: bursts of dupes during outages. Fix: require a unique event_id.
PII in URLs. Symptom: emails in query strings. Risk: policy and legal pain. Fix: remove PII; hash if you must.

How long should my affiliate attribution window be?

Short answer: set windows by event and by buyer journey. Low‑price, fast buys can live in shorter windows. Longer, high‑trust paths need more time. In search and display, match your windows to platform rules so you can compare apples to apples. For paid search, you can check and tune attribution settings in Google Ads to fit your goals. For social, be aware of Meta’s attribution window defaults (often 7‑day click, 1‑day view, and set per ad set).

For multi‑step funnels (sign‑up → KYC → FTD/first purchase), think in layers. For example: 30‑day click for sign‑up; 7‑day click for FTD; 1‑day view‑through for sign‑up only if you can prove value. If you pay on first purchase, keep view‑through off by default, or cap it at 1 day.

The table you will actually use

You can use this as a quick desk reference. It shows each platform, common default windows, if you can change them, if S2S postbacks are in play, and a few gotchas. If you also use GA4 to review models, see Attribution in GA4 for how its lookbacks and models differ. Note: verify details in the linked docs for your account type and region.

Google Ads	Up to 90d click; ~1d view (varies by network)	Yes (by conversion action)	Yes (offline conversions with GCLID)	Mismatched window vs BI; offline import time zone skew
Meta Ads	7d click / 1d view (default)	Yes (per ad set)	Yes (Conversions API; FBCLID)	Aggregated Events limits; dedupe with event_id is required
Apple SKAdNetwork	Timer‑based; no classic “window”	Partly (conversion values, timers)	Postbacks via Apple (privacy thresholds)	LockWindows; delayed postbacks; no user‑level IDs
AppsFlyer (MMP)	Config by app / event	Yes (granular)	Yes (event postbacks; macros)	Wrong macros; time zone mismatch between app and AF
Adjust (MMP)	Config by event / partner	Yes	Yes (callbacks)	Versioning not tracked; callback floods without dedupe
Branch (MMP / deep links)	Config by event	Yes	Yes (postbacks)	Incorrect deep link routing; web‑to‑app loss
CJ Affiliate	Program‑set (often 30d click; view varies)	Yes (by program)	Yes (pixel and S2S; CID)	Cross‑device gaps; coupon / TM+ rules conflict
impact.com	Program‑set (by event)	Yes	Yes (S2S; Event Tokens)	Event mapping drift; postback auth not enforced
Everflow / TUNE	Program‑set	Yes	Yes (TSID / TransactionID)	Non‑idempotent retries; mixed time zones

Postback hygiene: the boring work that saves your month

Postback hygiene means your events get sent once, arrive once, and can be trusted. It is less about tools and more about discipline. If you care about real payouts and fair partner pay, you need it.

Read platform docs when you wire things up. For mobile and MMP flows, see Callbacks and postbacks (AppsFlyer), Adjust callbacks, and Branch postbacks. They show auth, macros, and retry rules.

Use stable IDs: click_id or transaction_id plus an event_id. Add idempotency keys to stop dupes.
Sign and verify. HMAC‑SHA256 works. Rotate keys each quarter.
Stamp events in UTC using ISO 8601. Store the source time zone too.
Keep a clear event map. Version changes (v1_register, v2_register).
Retry with backoff. Cap attempts. Dedupe by (event_id + partner_id).
Alert on 4xx vs 5xx. 4xx means your data is bad. 5xx means the host is down.
Send no PII. Practice data minimization under GDPR.
Separate sandbox and prod. Test often. Log payloads and responses.

Example: signed postback payload

Tip: keep the signature over a canonical string: partner_id|event_id|timestamp|value. Reject if the clock skew > 5 minutes.

Quality note: for brand safety and traffic quality, some teams use the TAG Certified Against Fraud program as an extra layer.

Case file: regulated flows and iGaming nuance

In iGaming and other high‑risk niches, a “conversion” is not just a button click. There is KYC. There are bonus terms. A user may read three guides, sign up on day 5, pass KYC on day 9, and make the first deposit on day 12. If your window for FTD is only 3 days, you under‑credit the partner that did the work.

Content partners also add trust. A clean, well‑written review helps users choose. For Spanish‑speaking users who want to play on phone, a guide to mejores casinos móviles can shape a long path from read → compare → sign up → deposit. In such cases, set a longer click window for registration, and a shorter one for FTD. Disclose affiliate ties on the page, and spell out bonus rules in plain words.

Be strict on compliance. Know your local rules and ad codes. For general guidance on clear, prominent disclosures, see the FTC endorsement/affiliate disclosure rules. For age limits, show “18+” or “21+” where needed. Link users to help if they need support with gambling harm.

Resilience tactics for 2026: first‑party, S2S, consent

Use first‑party tracking. Host your trackers on your domain. Feed events to your server, then to partners.
Adopt server‑side tagging. See GTM server-side. It reduces script calls in the browser and keeps IDs safe.
Honor consent. If you operate in the EU/UK, support the TCF framework. Gate non‑essential tags until consent is given.
On iOS, know Apple’s AppTrackingTransparency rules. Expect low opt‑in. Plan for modeling.
For app ads, learn SKAdNetwork documentation. You get delayed, aggregate postbacks. Set conversion values with care.

The operator’s checklist

Pass click_id and transaction_id to your backend.
Dedupe with event_id + partner_id (48h window).
Sign postbacks (HMAC‑SHA256). Rotate keys quarterly.
Use UTC and ISO‑8601. Log source time zone.
Version events (v1_register, v2_register).
Set per‑event windows (30d signup; 7d FTD).
Cap view‑through at 1d or off by default.
Retry with backoff. Cap attempts.
Alert on 4xx/5xx and latency spikes.
Quarterly audit 50 conversions vs BI.

Five quick Q&A to clear the fog

Is a longer window always better?

No. Long windows can over‑credit early clicks and starve closer touchpoints. Match window length to event risk and buy cycle.

Should we credit view‑through at all?

Only with proof. Keep it short (1 day). Use holdouts or geo tests to see lift. Turn it off if you cannot prove value.

Why do my MMP and my network show different numbers?

Windows and time zones differ. Also, MMPs may block some events for privacy. Align settings and compare on UTC.

Can first‑party cookies fix everything?

No. They help a lot, but consent, app flows, and cross‑device still need S2S and modeling.

How do we treat cross‑device paths?

Use server IDs, login events, and modeled credit. Be clear with partners on rules for such cases.

Close the loop

Track what matters. Write down your windows. Keep postbacks clean. Watch time zones and retries. Audit each quarter. Share the rules with partners so trust grows both ways. When numbers dip, start with the path and the plumbing. Most fixes live there.

Appendix: how to spot issues fast

Run a live click. Watch the network tab for redirects and CSP blocks.
Check that the click ID is set and stays for at least your window.
Trigger a test event. Confirm one postback sent, one received.
Compare counts across tools in UTC. Fix any DST drift.

Author

Alex Rivera, Affiliate Operations Lead. 9+ years in performance marketing and iGaming. Worked with GA4, AppsFlyer, Adjust, impact.com, CJ, and custom S2S stacks across EU/LatAm.

Method note: Table defaults compiled from vendor docs and accounts. Verify in your environment. Last doc check: Oct 2024.