Phia's Cookie Stuffing Scandal Exposes a Diligence Blind Spot

Bloomberg found that Phia, the AI shopping app founded by Phoebe Gates and Sophia Kianni, was hijacking other retailers' affiliate commissions through a practice called cookie stuffing. The browser extension secretly swapped in its own referral code during checkout, cutting publishers out of earned commissions. Impact.com suspended Phia's account, and the company quietly patched the issue after Bloomberg contacted them on July 7.

Bloomberg found that Phia, the AI shopping app founded by Phoebe Gates and Sophia Kianni, was quietly hijacking other retailers' affiliate commissions. The $43.5 million question now is how nobody caught it first. Click a link to Nordstrom from a Wirecutter review, and something happens in the background you never see. According to a Bloomberg investigation, Phia's browser extension opens a hidden tab during checkout and swaps in its own referral code, cutting Wirecutter, or whichever publisher sent you there, out of the commission it earned. Bloomberg tested this across more than 50 retail sites. The pattern held. This is a known practice with a name. Cookie stuffing. It's been a violation of affiliate marketing rules since affiliate marketing existed, and independent researcher Ben Edelman, who has spent two decades studying exactly this kind of fraud, told Bloomberg the standard isn't complicated: commission gets paid when a real user makes a real click. The rules don't allow fake clicks, simulated clicks, imaginary clicks or hypothetical clicks, Edelman said. Capital One Shopping ran its own tests and corroborated the findings independently. Impact.com, the affiliate platform used by a huge share of e-commerce brands, suspended Phia's account once it reviewed the behavior. That's not a slap on the wrist. It's the infrastructure a shopping startup depends on to get paid at all, and losing access to it, even temporarily, cuts off the plumbing behind the entire business model. Phia's response, once Bloomberg contacted the company on July 7, was to fix it. A spokesperson told Bloomberg the necessary changes had been made, and a follow-up check by the outlet confirmed the extension had stopped auto-claiming clicks it never earned. Quietly patched. No public admission beyond a statement handed to the reporter who caught them, and no acknowledgment yet of how long the behavior had been running before Bloomberg noticed it. Where the $43.5 Million Came From Phia has raised $43.5 million. Kleiner Perkins led an $8 million seed round in September 2025. Khosla Ventures and Notable Capital led a $35.5 million Series A in January, with Kleiner Perkins returning for the second round. The angel list reads like a red carpet: Sydney Sweeney, Hailey Bieber, Paris Hilton, Priyanka Chopra Jonas, Khloé Kardashian, Kris Jenner, Sara Blakely, Sheryl Sandberg, more than 30 names in total, spanning fashion, music, film and sport. None of that is illegal or even unusual. Celebrity cap tables have become a standard feature of consumer startup rounds, and star power is often the point, not a red flag. But cookie stuffing is not some obscure model risk that needs a machine learning background to catch. It is one of the oldest tricks in ad tech, well documented since the early 2000s. Easy to test for, too. A diligence team can catch it in an afternoon: install the extension, watch the network traffic during checkout. Bloomberg did exactly that. So did Edelman, working independently and outside the deal entirely. Frankly, that's the uncomfortable part for the venture firms involved. A firm writing an eight figure check into a shopping app is supposed to understand how the app actually makes money. Affiliate commissions are Phia's entire business model, not a side revenue line. If the mechanics of that model were quietly built on overriding other publishers' links, that isn't a footnote to fix in a product update. It's the product. Why Nobody Checked the Plumbing Here's the thing about calling something an AI shopping assistant. The label sounds technical enough to wave off scrutiny that a plain browser extension would get immediately. Frame a company around a large language model and a personal shopper pitch, and reporters, investors, and users alike start asking about the model instead of the plumbing underneath it. Nobody was checking how the affiliate links actually resolved at checkout. Bloomberg did, months after the money had already landed and the celebrity investor list had already made headlines of its own. Phia isn't the first shopping tool built on affiliate revenue to face this kind of accusation, and it won't be the last. Browser extensions that promise deals and cashback carry a long, messy history with exactly this kind of quiet code running underneath a friendly interface. That's old news. What's different here is the scale of the round and the wattage of the investor list, which is precisely why this is getting national coverage now instead of being filed away as an ad-tech footnote nobody outside the industry reads. The extension is reportedly fixed. The Impact.com suspension stands. Nobody involved has said whether Phia's other affiliate partnerships, beyond the one platform that caught it, are still being reviewed. Also read: The UN's AI Summit Showed Robots Racing While Governments Argue Over Rules https://startupfortune.com/the-uns-ai-summit-showed-robots-racing-while-governments-argue-over-rules/ • Researchers hacked a quantum neural network on real trapped-ion hardware and gutted its accuracy https://startupfortune.com/researchers-hacked-a-quantum-neural-network-on-real-trapped-ion-hardware-and-gutted-its-accuracy/ • Sam Altman Calls Elon Musk Homeboy in Their Latest Fight Over AI Infrastructure https://startupfortune.com/sam-altman-calls-elon-musk-homeboy-in-their-latest-fight-over-ai-infrastructure/