How a sale gets credited
The default is last click within a cookie window, usually 14 to 30 days. The final affiliate click before purchase earns the commission.
That model is simple and predictable, but favours parties close to checkout such as cashback and voucher sites.
Consent and privacy
Under GDPR you need a lawful basis for setting and reading identifiers. Agree with your legal advisor which consent category affiliate tracking falls under and what you measure on refusal.
Store no more personal data than needed: order id, value, currency and timestamp are enough to pay commission.
Looking beyond last click
Compare assisted conversions, share of new customers and where a partner sits in the journey. That shows who creates demand and who harvests it.
An incrementality test — pausing a partner and measuring the revenue impact — often teaches you more than any attribution model.
Verification
Reconcile affiliate transactions with your order system monthly. A structural gap of more than a few percent is a technical signal.
Re-test after every store release. Most measurement problems appear at an update, not at launch.