The Phia Scandal and ‘Cookie Stuffing,’ Explained

Phia is back in the spotlight, but this time for unwelcome reasons.

Last week, the buzzy fashion-tech startup found itself at the centre of a Bloomberg investigation that revealed it was taking credit for sales it didn’t actually drive via a tactic called “cookie stuffing.” The story quickly sparked chatter online, in large part because of Phia’s already high profile, a product of not only its celebrity investors, but also its co-founder Phoebe Gates, daughter of Microsoft co-founder Bill Gates, who launched the business in April 2025 alongside Stanford classmate Sophia Kianni.

It’s quite a pivot from just a month ago, when the company was making headlines for its star-studded list of backers, which includes celebrities like Khloe Kardashian, Sydney Sweeney, Alix Earle and Mindy Kaling, as well as industry heavyweights such as Alexandre Arnault, Karlie Kloss and Rachel Zoe. At the time, the company said it had over 1.5 million users, more than 9,600 brand partners across fashion and was on track for “nine-figure sales growth” in 2026.

In less than two years in business, Phia has managed to become one of fashion’s most high-profile tech startups, attracting a good deal of attention and capital. In January, it announced a $35.5 million Series A round, bringing its total funding to $43.5 million and its valuation to $185.5 million. As well as its roster of famous investors, it gained support from prominent venture-capital firms such as Notable Capital, Kleiner Perkins and Khosla Ventures. Gates and Kianni have promoted Phia on their podcast, “The Burnouts,” which is part of “Call Her Daddy” host Alex Cooper’s Unwell Network, as well as on stages such as BoF’s VOICES 2025.

The Bloomberg investigation, which concluded the code causing the issues had been live since December, poked a hole in that polished exterior, raising questions about how Phia got credit for sales it didn’t earn, sparking conversations about why investors missed the problem and what comes next.

How does Phia work?

Phia has evolved over time, but today it’s best known for its browser extension that helps shoppers find the best price for an item online. Mobile users install it by downloading Phia’s app, which also has features like a sales calendar and shoppable editorials. Once customers download the plug-in to a browser such as Safari or Chrome, they shop as normal. If they find an item they like, they tap on the Phia extension and it will find lower-priced options in both the primary and secondhand markets. It will also automatically apply available coupon codes at checkout. Phia takes an affiliate commission on these sales.

But testing by Bloomberg and others, including the discount finder Capital One Shopping and independent researcher Ben Edelman, found it was claiming sales as its own that it wasn’t involved in.

What is “cookie stuffing” and how did Phia claim sales as its own?

Edelman, who consulted Bloomberg on its investigation and published his own findings online, said in an interview that there were two distinct violations taking place.

“The first and more unusual — maybe more serious depending on how you count it — is what I call forced clicks,” he said.

Under standard affiliate marketing agreements, for an affiliate to claim a sale, the shopper has to actually click its link. The merchant selling the item knows whose link a shopper arrived through because publishers of affiliate links use unique cookies — small snippets of code — that identify them as the source of the traffic they drive.

Bloomberg and Edelman found that when users were making a purchase on a mobile browser with Phia’s plug-in installed, Phia would open a tab in the background without the user having clicked its link and insert its cookie, letting it claim the sale. The practice, known as “cookie stuffing,” is the same that Honey, a discount-finding plug-in owned by PayPal, was caught doing in late 2024, resulting in legal action and multiple affiliate networks cutting ties. Bloomberg documented Phia performing the action on more than 50 websites it tested and across several affiliate networks whose terms of service prohibit the tactic.

“There is a material amount of money that moves when you invoke these links automatically, basically because normal users would only click [affiliate links] a fraction of the time — maybe one-tenth of the time,” Edelman said. The activity would have significantly increased Phia’s commissions.

The other issue Bloomberg and Edelman identified is what’s called a stand-down violation. When another publisher has made a referral, others like Phia must “stand down,” meaning they don’t try to interfere with the shopper or present their own affiliate links.

According to Edelman, Phia did a good job of tracking when a competing link was invoked, “but they forgot — or failed — to do the exact things the rules say you must do in that situation, namely not present your own affiliate link,” he said.

Phia told Bloomberg it fixed the offending parts of its code after they were brought to its attention, saying “a recent release our codebase was causing misattributions from a subset of users,” and as soon as it was notified its team “worked overnight to identify, mitigate, and has since resolved the issue.”

The company declined to comment when contacted by The Business of Fashion.

Who was affected by Phia’s activity?

There are two different victims of this behaviour. The forced clicks harm merchants, who would have paid for fake clicks that didn’t take place.

But the stand-down violation would hurt other publishers of affiliate links that drove sales Phia claimed as its own. The shopping search engine SSQRD, for instance, posted on Instagram that Phia could have conceivably received commissions for sales it was responsible for. Phia also could have claimed commissions that were meant for smaller creators with much less capital and influence.

Could Phia have done this accidentally?

Mistakes end up in code all the time. Could Phia’s activity have been an inadvertent bug? Edelman, for one, was not convinced based on his review of Phia’s code. The feature was even given a name, “auto_drop.”

“This has none of the telltale signs of accidents,” he said.

He also pointed out in his post online that the feature first appeared in a version of Phia’s app published on Dec. 13, 2025. Phia has released several updates since, he noted, making it hard to attribute the issue to a single mistake in a recent release, as Phia suggested in its comments to Bloomberg.

Should investors have caught this?

One question social-media commentators have raised is whether Phia’s backers should have spotted the problem. Investors such as venture-capital firms are supposed to perform due diligence to protect themselves from bad investments, which could include a review of the code behind a company’s technology to assess its general quality.

But Kate McAndrew, a general partner at the pre-seed venture fund Baukunst who is among those that were debating the topic online, said not every company gets a code review — and celebrities almost definitely aren’t doing them before they invest. Even if Phia’s venture-capital investors had done a review, they might not have caught the issue.

“Code reviews aren’t necessarily done to proactively seek out novel fraud,” she said. “That’s not the goal of diligence.”

It would likely take an expert eye to spot the problematic features in Phia’s code, and according to Edelman, fraud testers themselves could have missed it, because many only run tests on desktop. Phia’s cookie stuffing was only active on Apple’s iPhone operating system (for abstruse technical reasons that Edelman outlined in his online post).

What happens now?

Some of Phia’s affiliate partners, such as Awin, have already said they’re reviewing the situation. Impact.com said in a statement that after determining Phia’s behaviour was “inconsistent” with its policies, it has suspended Phia’s account and removed it from its marketplace while it investigates further.

Phia will almost certainly be engaged in damage control with its investors and brand partners as it tries to reassure them the company is still fundamentally stable. McAndrew said it’s likely the company’s board would be convened to discuss the situation and next steps.

It doesn’t help that Phia has been accused of questionable behaviour before. Last November, Fortune found its browser extension was collecting large amounts of customer data and grabbing snapshots of every page users visited, including those with sensitive details like bank statements.

McAndrew said some of Phia’s investors could be starting to look at getting their money back, though there’s no indication at this stage that anyone might be ready to pull out. Founders have returned capital in situations where, for instance, they realise there’s just no market opportunity and intend to shut down, but Phia isn’t in that position. Still, Gates and Kianni will undoubtedly be answering tough questions.

“Ultimately, everything rolls up to the founders,” McAndrew said.

The episode has prompted speculation that it could put even greater scrutiny in the future on female founders, and it also highlights ongoing issues in affiliate marketing. Edelman said testing has become more difficult because of factors such as the move to mobile, and while Honey and Phia don’t by themselves add up to a trend in the industry, it’s clear that more diligence is necessary.