Phoebe Gates' Phia, cookie stuffing, and prison time for Bill Gates' daughter
Bloomberg reports Phia’s founders knew for seven months that their shopping extension was claiming sales it didn’t drive. Cookie stuffing has put people in federal prison before. Nobody at Phia has been charged with anything.
Bloomberg reported on August 11 that Phoebe Gates and Sophia Kianni had known since December that their shopping extension was taking credit for purchases it had nothing to do with.
The practice is called cookie stuffing. A decade ago it put two men in federal prison.
Nobody at Phia has been charged. No prosecutor or regulator has announced an investigation into the company over any of it.
What has happened so far is commercial. Affiliate network Impact.com pulled Phia from its marketplace and began clawing back commissions credited to the startup going back to June 20. Phia says it is reversing transactions for brand partners and hiring a head of compliance.
How cookie stuffing works, and what Phia’s extension did
An affiliate cookie is a receipt. You click a creator’s link, the retailer tags your browser, and when you buy something that creator gets a cut.
Cookie stuffing plants the tag without the click.
Bloomberg tested Phia’s extension across more than 50 retail sites in July and found it opening a background tab during checkout and dropping in its own referral code. Researcher Ben Edelman and rival Capital One Shopping ran separate tests and reported the same behavior.
That code lands on top of whoever actually sent you to the store. The creator who wrote the review gets bumped, and so does the retailer paying for its own ads.
Nike, Gap, and Nordstrom were among the merchants affected. Affiliate marketing is a boring business right up until somebody’s browser starts doing things nobody asked it to do.
What Bloomberg says Gates and Kianni knew
In July, Phia told Bloomberg it had learned of the misattributions within the previous 24 hours and pointed at its codebase.
The August reporting says otherwise. Bloomberg reviewed internal Slack messages showing Gates asking her team in December to confirm that “auto pop for cookie drop is live on ALL sites” carrying a coupon.
Edelman found the behavior sitting in Phia’s own code as a named feature flag, switchable on and off.
A Phia data scientist estimated in a July 7 Slack message that cookie stuffing accounted for roughly 51% of the merchandise value the company claimed credit for in June.
Daily revenue fell from about $80,000 to somewhere between $10,000 and $28,000 once the features came off. Run those out over a year and a business pacing near $29 million drops to between $3.7 million and $10.2 million. Phia raised $35 million in January, with Hailey Bieber and Sydney Sweeney among the investors.
Phia disputes that math. A spokesperson said the company switched off most of its monetization at the same time, not only the cookie features, and called the data scientist’s numbers preliminary work using “an incorrect methodology that overstated the potential impact.”
Why cookie stuffing can be charged as federal wire fraud
eBay and the FBI spent years building a case against the company’s two biggest affiliates. Shawn Hogan had collected around $28 million in commissions. Brian Dunning collected roughly $5.2 million.
Both pleaded guilty to a single count of wire fraud. Hogan got five months and a $25,000 fine in May 2014. Dunning got 15.
The 20-year figure comes from that case. Prosecutors argued the cookies themselves, sent across state lines, were the wire in wire fraud, and the statutory maximum on one count is 20 years.
Neither man got anywhere near it.
The posts quoting that number also skip the calendar. The FBI started looking at Hogan in 2006, indicted him in 2010, took his plea in 2012, and sentenced him in 2014. Eight years, with the victim company cooperating with federal agents the entire time.
Why the PayPal Honey lawsuit is the closer comparison
PayPal’s Honey extension got accused of the same trick in December 2024, after YouTuber MegaLag published a breakdown showing it overwriting creators’ affiliate codes at checkout.
That fight went civil. Creators filed class actions, a judge tossed the first amended complaint in November 2025 on standing, plaintiffs refiled in January with merchant contracts attached, and on June 22, 2026 the court let the case proceed. It is in discovery now, with trial tentatively set for late 2027.
Twenty months on, no prosecutor has charged anyone at PayPal.
Phia’s road probably looks more like that one. Contract claims, network enforcement, refunds, a long civil grind, and the criminal question sitting unopened unless somebody decides to open it.
The FTC does already have Phia in a file, for something else. Inc. obtained a redacted agency report through a records request showing consumer complaints starting in January over undisclosed advertising on social media and YouTube. Complaints are not an investigation.
Phia says it is issuing refunds and hiring a compliance chief. Impact.com has already made its call. The affiliates who lost the commissions are waiting to see whether anybody with subpoena power reads those December Slack logs the same way Bloomberg did.
Article compiled and edited by Derek Gibbs (entertainment editor) and the Clownfish TV newsroom.
D/REZZED is part of Clownfish TV. For more news, views, and rants on gaming, tech, and pop culture, visit clownfishtv.com. Watch the show on YouTube at @ClownfishTV where new episodes drop daily. Subscribe to the Clownfish TV podcast on Apple Podcasts, Spotify, iHeart, and wherever else you get your podcasts. Sign up for the free newsletter at more.clownfishtv.com.
Hat Tips:
Bloomberg (July 9 and August 11, 2026), original investigation, verified as the originating source for the browser-extension testing across 50-plus retailers, the internal Slack messages, the December start date, the feature flag, the 51% merchandise-value estimate, the daily revenue chart, and the affected retailers
Fortune (August 12, 2026), verified for the revenue figures, the July 7 data scientist message, Ben Edelman’s code review and his quoted assessment, and Phia’s methodology rebuttal
TechCrunch, Dominic-Madori Davis (July 10 and August 11, 2026), verified for the Impact.com suspension, Phia’s full on-record statement about transaction reversals and the compliance hire, and the Puck reporting on staff departures
Inc., Sam Blum (August 2026), verified for the FTC consumer complaints obtained by records request, the January start date, and the fact that the complaints concern undisclosed advertising rather than cookie stuffing
Courthouse News Service (June 2026), verified for the federal court declining to dismiss the consolidated Honey class action against PayPal
Slate and MarTech (May 2014), verified for Shawn Hogan’s five-month sentence and $25,000 fine, Brian Dunning’s 15-month sentence, the commission totals, and the FBI timeline