Affiliate cookie duration, also called the cookie window, is how long after a click a conversion can still be credited to the affiliate who sent it. Windows range from 24 hours at Amazon Associates to 30 days at Shopify and 120 to 180 days at Semrush and HubSpot, as of October 2026. Browser privacy limits can make the effective window much shorter than the advertised one.
This guide explains how the window is applied, how attribution models interact with it, and how to pick one for your own program. If you run a program, note that brands reporting conversions through S2S postbacks can enforce the full window on the server instead of depending on a browser cookie.
How an attribution window works
When a visitor clicks an affiliate link, the tracking system records the click with a timestamp and a click ID. It then stores a reference to that click, traditionally in a cookie that expires at the end of the program's window. When a conversion arrives, the system checks for a valid click inside the window and credits the affiliate.
The window is a rule in the tracking system, not just a cookie setting. That distinction matters in two ways:
- Expiry. A conversion after the window closes earns nothing, even if a cookie somehow survived.
- Overrides. A newer click from another affiliate usually replaces the earlier one. Amazon's commission terms, for instance, end the referral session when the customer clicks through another Associate's link (Amazon Associates).
Some programs add conditions on top. Amazon's session lasts 24 hours from the click, but an item added to the cart in that time still qualifies if the order is completed no later than 89 days after the initial click-through. Shopify tracks referrals for 30 days from the click, and if the referral starts a free trial, it tracks whether that store becomes a paying store for up to 400 days (Shopify).
The cookie duration glossary entry has a simple worked example of the cut-off.
Typical cookie windows by program
Published windows tend to follow the buying cycle: in the examples below, the retail marketplace uses the shortest window and the software subscriptions the longest. These are the published terms as of October 2026:
| Program | Window | Other terms that affect credit | Source |
|---|---|---|---|
| Amazon Associates (US) | 24 hours | Items added to the cart within 24 hours count if ordered within 89 days of the click; another Associate's click ends your session | Associates policies |
| Shopify Affiliate Program | 30 days | Free-trial referrals tracked up to 400 days for conversion to a paid plan | Shopify Affiliates |
| Semrush Affiliate Program | 120 days | Last-click attribution | Semrush |
| HubSpot Affiliate Program | 180 days | 30% recurring commission for up to one year | HubSpot |
Program terms change, so check the current terms before you commit traffic. The window is also only one input: a long window with a low payout can still be worth less per click than a short window on an offer that converts well.
Last-click vs first-click attribution
The window decides how long a click can earn credit. The attribution model decides which click earns it when several affiliates touch the same customer.
Last-click. Under last-click attribution, the most recent qualifying click inside the window gets 100% of the credit. It is the default in most affiliate programs because exactly one partner is paid per conversion and the rule is easy to audit. Semrush, for example, states that its program uses last-click attribution with a 120-day cookie life.
First-click. The first qualifying click keeps the credit for the whole window, and later clicks don't override it. That rewards content partners who introduce the customer, but it can lock out the partner who actually closed the sale, and it fails if the first click's cookie is lost.
Example: a program with a 30-day window and a $40 CPA.
| Day | Event | Last-click result | First-click result |
|---|---|---|---|
| 1 | Customer clicks Affiliate A's review | Click recorded | Click recorded, A holds credit |
| 9 | Customer clicks Affiliate B's coupon link | B is now the latest click | A keeps credit |
| 12 | Customer buys | B earns $40 | A earns $40 |
Ad platforms have moved in the same direction. Google Ads says the first click, linear, time decay and position-based models are no longer supported, leaving data-driven and last click (Google Ads Help).
The model and the window interact. With last-click, a longer window mostly helps whoever clicks last, often coupon and cashback sites. With first-click, a long window means the introducing partner keeps credit for months. MassPartner campaigns use last-click attribution with a cookie duration set per campaign, 30 days by default.
How browser limits shorten the effective window
The advertised window assumes the browser keeps the reference to the click. Safari's tracking prevention (WebKit) breaks that assumption in several ways:
- Third-party cookies are blocked by default, so a cookie set on the network's domain can't be read on the brand's site.
- Cookies created in JavaScript, and other script-writable storage such as localStorage, are deleted after seven days without user interaction with the site.
- Link decoration cuts that further: if the visitor came from a domain classified as a cross-site tracker with a query string in the landing URL, cookies created in JavaScript on the landing page are capped at 24 hours.
The result: a Safari visitor on a 30-day program whose click is stored only in a script-set cookie may have a seven-day window in practice, or less.
Example: three Safari customers on a program with a 30-day window.
| Scenario | Purchase day | Click stored in | Credited? |
|---|---|---|---|
| A | Day 5 | Script-set cookie | Yes |
| B | Day 10 | Script-set cookie | No, the cookie was deleted |
| C | Day 10 | Click ID saved on the user record at sign-up on day 0 | Yes |
Cross-device journeys and cleared cookies cause the same loss in every browser: a cookie on a phone means nothing to a laptop. Only a click ID stored server-side and tied to an account survives those cases. Our guide to cookieless affiliate tracking walks through the migration.
How to choose a cookie window for your program
- Measure your own conversion lag. Pull the time from click to conversion for past affiliate sales. A window that covers most of that distribution, for example the 90th percentile, credits partners for the sales they influenced without paying for long-forgotten clicks.
- Check what partners can get elsewhere. Content affiliates compare windows across competing programs. A much shorter window than your category's norm makes recruitment harder.
- Price the cost. Longer windows pay for more conversions that might have happened anyway. Example: if extending from 30 to 60 days adds 5% more credited sales on a $40 CPA, budget for 5% more commission spend and decide whether those partners earn it.
- Write it down. State the window, the attribution model, override rules and any coupon or brand-keyword exceptions in your affiliate agreement, so disputes have a reference.
- Make the tracking match the promise. If attribution relies on a script-set cookie, Safari users effectively get seven days or less. Storing the click ID server-side lets you honor the window you advertise.
If you're setting up a program from scratch, our guide on how to start an affiliate program covers the other terms to decide alongside the window. For affiliates, the same checklist works in reverse: weigh the window together with the attribution model, the payout and whether the brand reports by postback.
Set cookie windows per campaign
In MassPartner, brands set cookie duration per campaign, and conversions can be reported by tracking script or S2S postback, with fraud checks on every click. See what's included on the brand platform overview.
FAQ
How long do affiliate cookies last?
It depends on the program. Published windows range from 24 hours at Amazon Associates to 30 days at Shopify and 120 to 180 days at Semrush and HubSpot, as of October 2026.
What is a good cookie duration for an affiliate program?
One that covers your typical click-to-purchase lag, measured from your own sales data. Among the programs above, Shopify uses 30 days, while the software programs from Semrush and HubSpot use 120 and 180 days.
Does a new affiliate click reset the cookie?
Under last-click attribution, a newer click from another affiliate replaces the earlier one. Whether a repeat click from the same affiliate restarts the window depends on the program's terms.
Do affiliate cookies work across devices?
No. A browser cookie only exists on the device where the click happened. Cross-device credit requires the brand to store the click ID on the user's account.
What happens if the cookie expires before the purchase?
The affiliate earns nothing for that sale. If the browser deleted the cookie early, a click ID stored server-side can still credit the sale within the program's window.