Phia's Cookie Stuffing Scandal: Founders Knew About Affiliate Fraud for 7 Months, Leaked Slack Messages Show

Phia, the AI-powered shopping startup co-founded by Phoebe Gates (daughter of Microsoft co-founder Bill Gates) and Sophia Kianni, has become the center of a widening affiliate fraud scandal. A Bloomberg investigation published in August 2026, based on leaked internal Slack messages and source code, reveals that the founders knew about—and actively pushed for—features that automatically dropped affiliate tracking cookies on users' browsers without their knowledge or intent . This practice, known in the industry as "cookie stuffing," allowed Phia to claim affiliate commissions on sales it did not generate .

The Core Allegation: Cookie Stuffing

Phia's browser extension was designed to inject affiliate tracking cookies during the checkout process on retail websites—even when a user had not clicked a Phia coupon or interacted with the extension at all . This meant that if a shopper visited a retailer independently, or through another affiliate program like Wirecutter, Phia could still claim credit for the purchase . Independent researcher Ben Edelman identified a feature flag in Phia's own code named enable_coupon_auto_drop, which Bloomberg reported was switched on December 10, 2025, and switched off July 7, 2026 .

Legal experts quoted in the New York Post say the tactic can constitute federal wire fraud, carrying a maximum penalty of 20 years in prison .

When the Founders Knew

Phia initially claimed in July 2026 that it had learned of the misattributions only "within the last 24 hours" and blamed a "software bug" . Bloomberg's August 2026 reporting directly contradicts that timeline .

Leaked internal Slack messages show that as early as December 2025—at least seven months before Bloomberg's first inquiry—co-founders Phoebe Gates and Sophia Kianni were actively discussing the cookie-stuffing feature with engineers and executives .

In one December exchange, Gates messaged developers asking them to confirm the automatic cookie-dropping was working, writing that it should "capture every transaction" if the feature was functioning . Kianni was quoted in internal messages saying, "whatever we can do to keep these cookies dropping will be amazing" .

Internal communications show both founders pushed for the features that enabled the practice—it was not a rogue or accidental bug, but a purposefully built and monitored feature .

Revenue Centrality

The cookie-stuffing practice was not marginal—it was central to Phia's reported growth .

• A Phia data scientist estimated the practice accounted for roughly 51% of the gross merchandise value (GMV) the company claimed credit for in June 2026 .

• An internal chart seen by Bloomberg showed the fraudulent attribution was responsible for a significant portion of Phia's revenue .

• Bloomberg reported that daily revenue dropped substantially after Phia disabled the automatic cookie-dropping features .

• Just 40 days after Gates asked employees to confirm the cookie-dropping was working, Phia announced a $35.5 million Series A funding round while touting elevenfold revenue growth .

Retailers Affected

Bloomberg reported that the cookie stuffing affected multiple major retailers, including:

• Nike
• Nordstrom
• The Gap

These companies had affiliate commissions wrongly claimed by Phia for sales the startup did not generate . None of the retailers have publicly commented on the scandal as of the reporting date .

The Company's Response

After the new Bloomberg reporting, Phia stated it would review every transaction and reverse sales that were incorrectly attributed to it. The company said it had begun issuing transaction reversals to affiliate partners .

Broader Controversies

FTC Consumer Complaints

The FTC had fielded consumer complaints about Phia months before the Bloomberg reports, suggesting regulators were already receiving tip-offs about the company's practices .

Employee Turnover and Internal Discord

Leaked Slack messages reveal internal tension. Reports note that employees raised concerns internally about the practice . Following the scandal, Futurism reported that Gates believed there was a "traitor inside" the company leaking information .

Secret Data Collection

In November 2025, Fortune reported that four cybersecurity researchers found that Phia's browser extension had been capturing snapshots of every web page a user visited—including pages containing highly sensitive information such as bank statements and private emails—far more data than the company disclosed .

Suspension from Affiliate Platform

Following the initial July 2026 Bloomberg report, Phia was suspended from Impact.com, a major affiliate and influencer marketing platform .

Summary

Key Fact	Detail
Practice	Cookie stuffing (dropping affiliate cookies without driving a sale)
Founders knew	At least December 2025 (7+ months before public denial)
Revenue share	~51% of June 2026 GMV attributed via the practice
Retailers affected	Nike, Nordstrom, The Gap, and others
Legal risk	Up to 20 years for wire fraud
Initial company claim	"Software bug" discovered "within 24 hours"
Later response	Reviewing and reversing incorrectly attributed transactions
Other issues	FTC complaints, employee turnover, undisclosed data collection, Impact.com suspension