The PayPal Honey Lawsuit: What "Commission Hijacking" Means for Affiliate Creators

What is the PayPal Honey lawsuit about?

PayPal Honey is the browser extension that automatically finds discount codes at checkout across thousands of online stores. A group of affiliate creators and bloggers, including the YouTube channel Wendover Productions, sued PayPal in January 2025, alleging that Honey overwrites an affiliate creator's own tracking cookie or affiliate ID at checkout with PayPal's own — diverting the commission from the creator whose content actually drove the sale to PayPal itself. Press coverage calls it "commission hijacking," and the case is still active: PayPal hasn't lost the case, but a judge has denied PayPal's attempt to get it dismissed, and it's now in discovery. Everything about the mechanism below therefore remains an allegation from the plaintiffs, not a court finding of wrongdoing.

How the alleged mechanism works

According to the complaint, an ordinary affiliate sale works like this: a creator posts a link or a code, the customer clicks or enters it, and a tracking cookie sets the creator's affiliate ID, which the merchant uses to pay commission. The plaintiffs allege that Honey, once installed in a customer's browser, sets a new cookie carrying PayPal's own affiliate ID right at checkout — on top of, or in place of, the creator's — so the merchant credits PayPal for a sale that was actually driven by the creator's content. That's a different mechanism from classic cookie stuffing, where the cookie is set with no genuine, prior click at all. Here, the plaintiffs allege a genuine click on the creator's link that then gets overwritten at the very last moment — hence "commission hijacking" or "last-click override" in the English-language coverage.

The plaintiffs' amended complaint, filed January 2026, also describes logic that, according to the plaintiffs, decided whether the override happened based on a profile of the person browsing — ordinary shoppers were allegedly targeted, while users who resembled an auditor or investigator (based on, for example, account age and browsing history) were allegedly exempted. This remains an allegation from the plaintiffs, not a fact established by the court — but it's exactly the kind of internal documentation that becomes discoverable following the June 2026 ruling.

How the case has unfolded

Networks reacted before any ruling on the merits

Several major affiliate networks acted against Honey while the case was still pending — independent of whether PayPal is ultimately found liable:

Overall, Honey's total merchant partnerships fell from roughly 35,000 in December 2024 to just above 28,000 at the low point — a decline of more than 7,000 merchants, even after Rakuten's May 2026 reinstatement. These three network decisions are commercial, not judicial — but they show the industry took the allegations seriously long before any ruling on the merits.

Is this the same as cookie stuffing?

No — and the difference matters if you run affiliate tracking yourself.

What can a brand or creator actually check?

Regardless of how the case is resolved, there are concrete things you can look for in your own affiliate dashboard:

• Check whether an unusually large share of conversions is credited to a "last click" right before checkout, from a source you never recruited as an affiliate.
• Compare timestamps: a genuine creator-driven sale typically shows some gap between the click on the creator's link and the purchase itself; an override at checkout, by definition, happens right at the moment of purchase.
• Ask your network directly (Awin, Impact.com and Rakuten are all named in the case) whether browser extensions in general fall under their last-click attribution compliance rules, and whether Honey specifically is still an active partner with them.
• If you're the affiliate or creator yourself: keep your own documentation (screenshots of your own links, content dates) for sales you believe were misattributed — that's exactly the kind of documentation the plaintiffs themselves used in their amended complaint.

Decision framework

• IF you run an affiliate program through one of the three networks named above → ask directly whether Honey (or similar browser extensions) is covered by your current program, and whether the network's attribution rules protect your own affiliates from a similar override.
• IF you're an affiliate creator seeing unexplainably low conversion numbers despite visible engagement → check whether a coupon-extension is installed among part of your audience, and compare against the numbers in discount codes vs tracking links.
• IF you're considering recommending a coupon extension as part of a partnership → note that the networks themselves (Rakuten, Impact.com, Awin) have suspended or restricted access for the exact extension this case is about.
• IF you're simply following the case as an interested observer → it's in discovery, which typically takes months to years before an actual trial; check the docket directly before citing a specific outcome as settled fact.

Make Influence's operational perspective

Make Influence's model is curated, not an open affiliate network where third-party browser extensions typically operate — but the case is still worth reading for a Danish brand that (as covered in our affiliate tracking network comparison) runs its own program through Awin or Impact.com. The takeaway we draw from this isn't the case's eventual outcome — that's outside what we can or should predict — but that last-click attribution is inherently vulnerable to a third party that was never part of the original agreement between brand and creator, regardless of whether that third party acts in good or bad faith. It's another argument for combining tracking methods, as covered in discount codes vs tracking links, instead of relying on a single, last-click-based signal.

FAQ

Has PayPal been found liable in this case?

No. This is a civil lawsuit that's still active. The court has only denied PayPal's attempt to get the case dismissed, which means the claims are allowed to proceed to discovery — that isn't the same as a finding of wrongdoing.

What's the difference between this case and classic cookie stuffing?

See the comparison above. In short: classic cookie stuffing happens with no genuine, prior click from the customer at all. In the Honey case, the plaintiffs allege there is a genuine click on the creator's link, which is then overwritten by the extension itself, right before the purchase completes.

Does this case affect Danish creators and brands?

The case itself is being heard in a US court under US law. But Awin, Impact.com and Rakuten, all named in the case for their own reactions, are international networks also used by Danish brands and creators — particularly Awin, which has a documented Danish platform. The mechanism itself (a browser extension overwriting an affiliate link at checkout) isn't tied to any particular country either.

What's the case actually called, if I want to follow it myself?

In re PayPal Honey Browser Extension Litigation, case 5:24-cv-09470, U.S. District Court for the Northern District of California.

When did the whole story actually start?

The original suspicion traces back to an investigative YouTube video by creator MegaLag in December 2024, which first publicly described the alleged mechanism. The formal lawsuit followed in January 2025.