How Affiliate Links
Actually Work

An affiliate link looks simple: a URL with ?aff=YOUR_ID on the end, or a clean vanity redirect like /go/coinbase. Behind that URL is the entire economic and legal infrastructure of the program — tracking parameters, attribution windows, disclosure obligations, and an abuse-detection system that doesn’t care whether you meant well.

If you skip any of those layers, you fail on a different dimension: technical (clicks don’t track), legal (FTC fines), or commercial (the program flags and terminates your account). This article walks through each layer so the links you put on your site work as advertised and don’t draw the wrong kind of attention.

Where Affiliate Links Actually Come From

Every affiliate link is issued by one of two entities: the merchant directly, or a network the merchant has hired to handle tracking and payouts. You don’t make up a tracking ID. You don’t invent a destination URL. Both pieces are assigned to you after approval — and the format tells you who’s running the program.

Direct program IDs look like this:

That ?aff= parameter is your publisher ID, hard-coded into the merchant’s own tracking system. The merchant’s checkout reads the cookie that the click drops, matches it back to YOUR_ID, and credits your account if the visitor converts.

Network-issued deep links look different — they resolve through the network’s redirector, not the merchant’s domain:

The network’s redirector does the same thing as the merchant’s direct tracking — drops a cookie, credits you on conversion — but the click first bounces through the network’s domain. That hop is what allows networks like Impact, ShareASale, PartnerStack, and CJ Affiliate to track across thousands of merchants from a single publisher account.

The lesson: if you didn’t fetch a tracking URL from an approved affiliate dashboard, you don’t have a tracking URL. A merchant’s bare domain with no parameters won’t attribute the sale to anyone. A bare domain with your made-up parameters is worse — it’ll just get stripped by the merchant’s checkout.

Direct Programs vs. Networks — Who Issues What

The list of networks we use — PartnerStack (SaaS/B2B), Impact (general/enterprise), ShareASale (broad catalog), CJ Affiliate (finance/travel) — determines the format of the tracking URL you’ll write into your content. The tradeoffs are discussed in How Affiliate Marketing Actually Works, but the link-issuance angle is worth its own lens:

What this means for how you write content: Direct-program links are clean enough to embed inline in your articles with no hard redirect required — the merchant URL with your ?aff= parameter is the link. Network links carry a long parameter string and benefit from one level of indirection (your own redirector) so you can update the destination without editing every page.

Both forms work. Mixing them in a single article is fine, as long as each link was issued through an actual partnership — not self-assembled from a guess of what the merchant’s parameter might be.

FTC + Network Disclosure — What “Disclosed” Really Means

Two separate bodies of rules govern disclosure: the FTC (US federal trade law) and each network or merchant’s Terms of Service. Both apply. Both are enforced. Both can shut you down independently.

The FTC rule (16 CFR Part 255): If you have a material connection to the advertiser (including being paid a commission), your relationship must be disclosed “clearly and conspicuously.” Since March 2023, that disclosure has to be simultaneous with the affiliate link — a separate disclosure page no longer satisfies the FTC on its own if the link itself isn’t labeled.

What “simultaneous” looks like in practice:

• Inline disclosure next to the link — “We earn a commission if you buy through this link” or a short tag like #aff visible in the rendered article before the user clicks.
• Disclosure at the top of the article — the “This article contains affiliate links” banner our own disclosure policy references.
• Both — the conservative position. A top-page banner plus inline disclosure next to each link cluster.

A standalone disclosure page (/disclosure) is still required for the deeper ethical basis — what you earn, how the model works, who you partner with — but it does not satisfy the FTC by itself anymore. The label has to be where the click is.

Network ToS specifics: Each network has its own disclosure rules on top of the FTC baseline. CJ Affiliate requires specific disclosures on every page containing an affiliate link. ShareASale prohibits certain promotional methods (email SPAM, brand bidding) and can revoke commissions earned in violation. PartnerStack publishes a creator-compliance guide that lists permitted and prohibited promotional formats, and an automated system flags non-compliant content monthly.

Skim the network ToS the day you’re approved, not the day you’re suspended. Most complaints about network penalties come from affiliates who never read the ToS and assumed compliance was the network’s problem.

Cookies and Attribution in Practice

Cookie attribution is the invisible scaffolding under every commission you earn. The browser cookie is what tells the merchant’s checkout who to credit. We walk through the deep math in how affiliate cookies actually work — this section covers the high-level mechanics so the rest of this article lands.

What the cookie records when someone clicks your link:

• Click ID — the unique identifier of your publisher account + the specific click instance. Usually a UUID or a numeric ID assigned by the merchant’s tracking system.
• Timestamp — when the click happened. Used to start the attribution window clock.
• Attribution window — the expiry time (typically 24 hours, 30 days, or 90 days, depending on the program). Once the cookie expires, it’s removed from the browser and stops attributing sales to you.
• Landing URL — what the visitor was looking at when they clicked, used for cross-checking against bot/abuse signals.
• Referrer — which page sent them. This is the field affiliate-abuse teams watch carefully (more on that below).

If the visitor converts inside the attribution window, the merchant’s checkout reads the cookie and credits the conversion to the click ID. If another affiliate’s cookie is already present (the visitor clicked a different affiliate’s link earlier), the newer cookie overwrites the older one — this is last-click attribution, the default model for almost every program.

The practical implication: the closer to the conversion your click is, the more likely you get paid. A visitor who clicks your link three times across four days will credit you on the conversion if they buy inside the cookie window. A visitor who clicks a competitor’s link once after clicking yours will credit the competitor. The race matters.

Redirects and the Affiliate-Abuse Trap

This is the section that explains the confusion the request called out. Building a custom-domain redirect like /go/coinbase is one of the most common patterns we see from new affiliates — and one of the most common abuse-team triggers. It feels smart: clean URL, no ugly parameters, brand-neutral, easy to share. It feels even smarter when you think you’ve been “approved.” But there’s a difference between being approved by a program and being approved to use its tracking URL in the form you want.

What a /go/coinbase redirect actually does — and where it goes wrong:

1. You create a redirect on your own site: /go/coinbase → 302 redirect to https://coinbase.com/affiliate/offer?aff=YOUR_ID.
2. The click chain is now: visitor’s browser → your domain → merchant domain. The “referrer” the merchant sees is your domain. The visitor never sees Coinbase’s URL in their address bar until after the redirect fires.
3. This is exactly the pattern affiliate-abuse teams flag. Not because redirects are illegal, but because redirects are what cookie-stuffers, brand-bidding fraudsters, and typo-squatters use to launder commissions or hijack organic traffic.

The affiliate-abuse detection systems look for:

The correct workflow. Five steps that look boring and are completely correct:

1. Apply to the merchant’s program or to the network running it. Real approval. Real email back. Real commission rate.
2. Use the official tracking URL exactly as the dashboard gives it to you. No cleaning up parameters, no swapping to a vanity redirect, no adding tracking pixels in front of theirs.
3. If you must short-link, use the network’s official redirector. Most networks offer a short-link service specifically for this. It looks like yourname.linkpartner.com, the network owns it, and it passes every compliance audit.
4. Disclose at the link. Inline label or top-of-article banner. Both is best.
5. Document the partnership. Screenshot the approval email, keep the dashboard receipt, store the program’s ToS link. If you ever get flagged for compliance, the audit is fast.

The cleanest setup for most affiliates: write the merchant’s tracking URL directly into your content. If it’s ugly (long Impact URL, multi-parameter ShareASale redirect), embed it as a button or anchor text rather than visible raw. The merchant sees a single network hop. The referrer is your domain. The disclosure label is right there. Three hours of writing compliance with zero abuse-triggers beats 300 redirects with 30 fraud flags.

What to Do This Week

Three concrete moves that change your affiliate-link hygiene in the next 30 days:

1. Audit every affiliate link on your site. For each, write down: merchant, your approval date, where you got the tracking URL, where it’s used, whether disclosure is inline. If any link doesn’t have all four, it’s a compliance debt.
2. Replace any custom redirect with the official tracking URL. If you built /go/merchant-name vanity redirects, swap them for the merchant’s official tracking link (cleaned up via button-style usage) or the network’s official short-link service. The vanity redirect looks professional. It also looks identical to fraud.
3. Add inline disclosure next to every link cluster. A single “We earn a commission on purchases through this link” sentence before each cluster satisfies the FTC simultaneous-disclosure rule and most network ToS. Update once, never worry about it again.

The link is the smallest, most overlooked part of an affiliate business — and the easiest place for one bad assumption to end the whole account. Treat it as the structural foundation it actually is.