Bloomberg Investigation: Phia Co-Founders Knew About Cookie Stuffing Months Before Public Disclosure
Phoebe Gates and Sophia Kianni, co-founders of the shopping app Phia, knew the company was engaged in cookie stuffing as far back as December 2025, according to a Bloomberg investigation published August 11, 2026. The finding, based on leaked Slack messages and sources familiar with the matter, contradicts Phia's earlier characterization of the practice as a technical bug.
Bloomberg's July 2026 investigation first reported that Phia was taking affiliate credit and commission for purchases it did not help generate. Cookie stuffing, the mechanism at issue, involves dropping affiliate tracking cookies onto a user's browser without a genuine referral click, so that the affiliate platform credits the stuffer for organic purchases the user would have made anyway. In Phia's case, Bloomberg identified Nike and Nordstrom among the retailers affected.
The August reporting goes further on intent. Bloomberg found that Phia's cookie stuffing was a purposefully built feature that could be toggled on and off, directly contradicting the "bug" framing a Phia spokesperson offered in early July. Leaked Slack messages show Gates and Kianni discussing cookie stuffing practices with other Phia executives and engineers, indicating awareness at the leadership level well before the practice became public.
The financial materiality of the scheme is notable. Bloomberg reported that cookie stuffing accounted for a good chunk of Phia's sales, and that the company saw a sizable drop in daily revenue once it ceased the practice. No specific revenue figures were disclosed.
The fallout has been swift. Following the July investigation, Phia was suspended from Impact.com, a leading affiliate and influencer platform. Separately, Puck reported that Phia has lost almost half its full-time employees since the beginning of the year, that several brands listed on the app were unaware of their inclusion, and that investors were put off by how aggressively Phia leaned into affiliate marketing. Phia had also previously faced controversy over collecting sensitive user data, including tracking user behavior across the web and transmitting it to its servers.
Phia launched in April 2025 with the pitch of a Google Flights for shopping, helping users find the best prices across retailers. In response to the latest allegations, a Phia spokesperson told Bloomberg the company rebuffed some of the publication's claims but said Phia would "learn from this."
The arc of this story follows a pattern the affiliate marketing ecosystem has dealt with for over two decades. Cookie stuffing is one of the oldest forms of affiliate fraud; it predates the current generation of shopping apps by years and has been the subject of Federal Trade Commission enforcement actions and platform-level crackdowns since at least the late 2000s. What is unusual here is the documented involvement of co-founders in internal communications about a feature that was later described as a bug. That gap between internal awareness and external messaging is what elevates this from an affiliate-network compliance issue to a credibility question for the company's leadership.
The impact on Phia's business has been immediate and structural. Losing access to Impact.com effectively cuts the company off from a primary channel for monetizing the traffic it does legitimately generate. Combined with the reported revenue drop after cookie stuffing was halted, Phia is facing a scenario where its monetization model has been significantly undermined on two fronts simultaneously: the fraudulent revenue stream is gone, and the legitimate one is harder to access.
For retailers, the episode is a reminder that affiliate program abuse remains a live concern. Brands listed on apps without their knowledge, as Puck reported, suggests that the discovery and vetting processes on both sides of the affiliate relationship can be surprisingly thin. For Phia's remaining investors and staff, the question is whether a shopping aggregator can rebuild a revenue base after its primary growth lever was exposed as fraudulent.
There is also a trust dimension that extends beyond Phia itself. The broader category of AI-assisted shopping agents, which Phia positioned itself within, relies on user willingness to share browsing and purchasing data in exchange for better recommendations. That exchange was already under scrutiny given Phia's earlier data collection controversy. A company caught misrepresenting both its data practices and its revenue mechanics will find that trust harder to rebuild than the code that caused the problem.
