How Influencer Tracking Actually Works

The three building blocks of a tracking link

An influencer tracking link looks like an ordinary URL, but it carries three layers of information: the destination address where the customer ends up, a click ID or referral parameter that identifies exactly which creator the link belongs to, and usually a set of UTM parameters that tell your analytics tool where the traffic came from. See the full naming convention for the UTM layer in UTM parameters for influencer campaigns. It's the click ID — not the UTM parameters — that actually ties the click to a later commission. UTMs are for your reporting; the click ID is for attribution itself. Lose one and you haven't necessarily lost the other.

From click to attributed sale — step by step

1. Click. The customer clicks the creator's link in an Instagram Story, a TikTok bio, or a video description.
2. Redirect. The link briefly routes the customer through the tracking system's own server before they land on the store. This is where the actual recording happens.
3. A cookie is set, or the click ID is carried forward. The system stores a cookie in the customer's browser containing the click ID, a timestamp, and the creator's ID. According to the affiliate network Awin's own description of how tracking works, the cookie is dropped at exactly this moment, and the affiliate's ID is embedded into the URL the customer is sent on to, so commission can later be paid out accurately.
4. The customer lands on the store. From here they behave like any other visitor — browse further, add to cart, maybe leave and come back later.
5. The purchase happens. Whether in the same session or later, inside the tracking window, the store's system sends a confirmation back to the tracking system.
6. Matching. The tracking system reconciles the cookie or click ID attached to the order against the original click.
7. Attribution. If there's a match, the sale is attributed to the right creator, and commission is calculated and paid out.

When the match in step six fails — because the cookie expired, was blocked, or was never set — the sale still exists in the store's own system, just with no creator attached to it. That's exactly the mechanism behind one of the most common questions in the field; see why influencer sales don't show up in Google Analytics for how the same problem looks from the analytics side.

Cookie, click ID, or IP — what each one catches

None of the four stands alone as a complete solution — see how the choice between the two most common ones, tracking links and discount codes, actually plays out in discount codes vs tracking links.

Why cookies alone aren't enough

A tracking cookie set by the tracking system's own server during the redirect is, technically, a third-party cookie from the store's domain's point of view — exactly the type browsers have clamped down on hardest. Safari and Firefox block third-party cookies by default, and even cookies set directly in the browser run into Safari's Intelligent Tracking Prevention: according to WebKit's own documentation, a JavaScript-set cookie carrying a query string from an ITP-classified domain can be capped at as little as 24 hours. See the full comparison of how long each platform actually gives you in attribution windows in influencer marketing. Chrome, as of 2026, has abandoned its original plan to fully deprecate third-party cookies and instead asks the user to choose — so cookie-based tracking in Chrome typically still works, but isn't guaranteed the way it is in Safari or Firefox.

The other major leak is the in-app browser: when someone clicks a link inside the Instagram or TikTok app itself, the page often opens in the app's own embedded browser rather than the customer's normal browser. That embedded browser typically doesn't carry cookies over between visits, so a purchase the customer completes a few minutes later in their actual browser can look like a brand-new, untracked visit.

How Make Influence tracks a click

According to Make Influence's own documentation of its tracking method, a tracking cookie is stored for up to 30 days, so sales can be attributed up to 30 days after a click. As a direct countermeasure to the in-app-browser problem, the click's IP address is also retained for up to 3 months — specifically to match purchases that happen after a click where the cookie was never set in the first place. That's a combination of cookie and IP fallback, not server-to-server tracking (see the next section) — a distinction worth keeping straight if you're comparing tracking across platforms.

Server-to-server tracking — the industry's answer to cookie loss

A number of affiliate networks now offer a cookieless method often called server-to-server or postback tracking: instead of storing anything in the customer's browser, the system generates a click ID, and when the store's own server registers a purchase, it sends a confirmation directly to the tracking system's server — bypassing the browser entirely. The advantage is that the method isn't affected by cookie blocking, ITP, or in-app browsers, because nothing depends on what's stored in the customer's browser. The trade-off is that the store's own system has to be set up to send that confirmation — it doesn't work automatically on top of a standard cookie setup, and it isn't the same as the cookie-and-IP model described above. That's a different technique again from the ad-platform Conversions and Events APIs Meta and TikTok run for paid social — see server-side and cookieless tracking in influencer marketing for how those compare.

What to look for in a tracking platform

Everything above is the same regardless of which platform runs it — a cookie, a click ID, and usually an IP fallback are the raw ingredients. What differs between platforms is which of those they actually combine, and how transparently they say so. Six questions are worth asking before you commit to one:

1. Which mechanisms does it combine? Cookie only, cookie plus IP fallback, or server-to-server as well — this determines how much of the blocked-click gap in the worked example below actually gets recovered.
2. How long is the attribution window, and is it disclosed anywhere you can check? A shorter window quietly pays creators — and reports — for less than they delivered; see attribution windows in influencer marketing.
3. Is a unique link and code generated per creator automatically, or does someone have to build it? Manual link generation is the first thing that breaks once a programme grows past a handful of creators; see why manual influencer marketing becomes messy.
4. What happens to a declined cookie-consent banner? Is the click simply lost, or does the platform model an estimate the way Google's Consent Mode does for ads? See Consent Mode and influencer tracking in the EU — most influencer tracking has no modeled substitute at all.
5. Are cookies and IP addresses retained under a documented legal basis and retention period? This is a GDPR question as much as a technical one; see influencer marketing and GDPR.
6. Can you see attribution per creator, or only an aggregate campaign total? Per-creator attribution is what makes tracking useful for deciding who to rebook, not just whether the channel "worked."

None of these questions has one universally correct answer, but a platform that can't answer them specifically is asking you to trust it on faith.

Worked example: what a blocked click actually costs you

The numbers below are illustrative only, built to demonstrate the mechanism — not a real Make Influence customer case, and not a benchmark.

Assume a creator's link generates 500 clicks that genuinely lead to 400 purchases. Pure cookie tracking correctly matches 320 of those 400 purchases (80%) — the rest are lost, mainly because the customer clicked in an in-app browser and bought later in a different one. Add IP fallback on top of the cookie, and if it matches a further 40 of the remaining 80 purchases, visible, attributed purchases rise from 320 to 360 — from 80% to 90%. The last 40 purchases (10%) stay invisible to both mechanisms, because neither the cookie nor the IP could be tied to that specific purchase. That's not a gap any single tracking mechanism closes entirely — see the broader countermeasures in how to measure influencer marketing when you can't track everything.

Decision framework

• IF your customers typically click from inside the Instagram or TikTok app → expect a real loss from in-app browsers, and choose a platform with a documented IP or server-to-server fallback, not just a cookie.
• IF your customers typically take more than a couple of days to decide → a short cookie lifetime will systematically understate your results; see the actual windows in attribution windows in influencer marketing.
• IF you're evaluating a new platform or network → ask specifically whether tracking is cookie-based, IP-based, or server-to-server, and how long each mechanism lasts — the answer determines how much of your real sales you'll actually see.
• IF you want the most complete coverage without switching platforms → combine a tracking link with a discount code, so you're not dependent on a single mechanism alone.

Common mistakes

• Assuming a tracking link is "invisible" to the browser. It isn't — it's a cookie like any other, and it runs into the exact same limitations as any other third-party cookie.
• Conflating the click ID with UTM parameters. UTMs are for reporting, the click ID is for attribution. Lose the click ID and you lose the commission, even though the UTMs still look correct in GA4.
• Assuming every platform has the same cookie lifetime. They don't — see the full comparison in attribution windows in influencer marketing.
• Choosing a platform without asking about the mechanism. Two platforms can report very different numbers for the same campaign purely because they use different tracking mechanisms.

Make Influence's operational perspective

In Make Influence's experience, the most common misunderstanding among new customers is treating tracking as a single switch that "works or doesn't." In practice it's a stack of several partially overlapping mechanisms, each covering a specific gap — and the better you understand which gap each one covers, the easier it is to explain a number that looks lower than the campaign felt. A drop in attributed sales often doesn't mean the campaign performed worse — it often just means more clicks this time came from an in-app browser.

Answering our own six questions above plainly: Make Influence combines a 30-day cookie with a 3-month IP fallback, not server-to-server tracking (see server-side and cookieless tracking in influencer marketing); both the cookie lifetime and the IP retention period are published on our own tracking page; unique links and codes are generated per creator automatically inside a campaign, not built by hand; a declined consent simply loses that cookie, with no modeled substitute (see Consent Mode and influencer tracking in the EU); and attribution is visible per creator — which is the mechanism behind the 930,000+ tracked sales the platform has attributed to creator links and codes to date.

FAQ

Do tracking links work if the customer uses an ad blocker?

Some ad blockers specifically block known tracking domains and can prevent the cookie from being set at all. How much this affects results varies a lot by ad blocker and setup, and there's no reliable aggregate figure for how much traffic it affects.

Does using a tracking link cost extra compared to a discount code?

No. The tracking technique itself doesn't cost anything. A discount code typically costs money because it carries a real discount — that's a cost of the incentive, not of the tracking mechanism.

Can the tracking cookie be used to follow me elsewhere on the web?

A cookie set for this purpose is limited to identifying the click ID, timestamp, and creator ID for that specific campaign — it isn't built to track general browsing behaviour.

Is a click ID the same thing as a UTM parameter?

No. UTM parameters are text in the URL that your analytics tool uses for reporting. The click ID is what the tracking system itself uses to decide who gets the commission. The two live in the same link but drive two different systems.

Why can two platforms show different numbers for the same campaign?

Because they rarely use exactly the same mechanism or the same tracking window. A platform with a shorter cookie lifetime or no IP fallback will systematically show fewer attributed sales than one that has both.

Does this cover app installs too?

No. Everything above assumes a browser session — cookies, click IDs and IP fallback all depend on it. An app install has no browser session to write into, so it uses a structurally different mechanism entirely; see how to track influencer-driven app installs for how attribution works there.

Does tracking data — cookies and IP addresses — count as personal data under GDPR?

Yes. GDPR's own definition explicitly names an online identifier as an example of personal data, and both a cookie ID and an IP address qualify. That means the tracking mechanics on this page have a data-protection layer on top of the technical one — see influencer marketing and GDPR: what brands need to know for the lawful basis, retention and processor questions this raises.

Does declining a cookie-consent banner stop the tracking cookie from being set?

Yes. If a customer declines marketing-cookie consent, the tracking cookie described above never gets set at all — and unlike Google's own tags, there's no modeled estimate to fill the resulting gap. See Consent Mode and influencer tracking in the EU for how that compares to Google Ads and GA4.