While auditing an affiliate program, and going through all its major elements, we had a client ask:

Can we change our cookie length?  It seems too long to me…

Their cookie length was set at 120 days.

My answer to questions like this has been the same ever since I published this blog post: since 50% of affiliate-referred visitors delete cookies by day 45, why not keep that cookie life at least at the 45 days mark (and if longer, the more affiliate-friendly you’ll appear)?

Furthermore, having analyzed the above merchant’s affiliate program’s stats, we discovered the following return days distribution (judging by the past 500 affiliate-referred sales):

So, with 92% of affiliate-generated sales happening within 2 days of the original click, does it really matter if your cookie life is set at 30, 45, or 120 days? It doesn’t for you, as a merchant; but it does for affiliates. The longer — the more affiliate-friendly the program is, and the less it looks like you’re trying to skim the commission that they could’ve earned from their referral.

A few days ago Mikkel deMib Svendsen from Denmark published a blog post — which has already gone “hot” on Sphinn — where talking about Samy Kamkar‘s EverCookie he expressed concern for the future well-being of affiliate marketing as a whole. Here’s an excerpt:

Normally if you set a “permanent” cookie it can relatively easy be deleted. …With EverCookie multiple cookies are set. Currently Sammy’s EveryCookie support 10 different types of cookies!

The real smart thing about EverCookie is not just that it sets 10 cookies. Theoretically you could go through each of them … and delete them. But that won’t work with the EverCookie because as long as just one cookie is left this is used to set the other 9 cookies again…

If you are working in the affiliate space you can probably see the problem with this type of cookie. Basically, if I, as an affiliate of your company, can set an EverCookie on users no other affiliate will ever be able to overwrite it. The EverCookie essentially override the standard that most merchants and affiliate networks use where the last affiliate partner prior to a sale gets the commission on that sale. …Of course this will really upset all your other affiliates…. It could potentially kill your entire affiliate program — or affiliate network. At least if you don’t deal with it — fast and efficiently! [full post here]

Sounds scary, doesn’t it?

Well, working in the affiliate space myself, I actually do not see any reason for concern. If the news of EverCookie came coupled with a news that a major affiliate network decided to switch to EverCookie(s), that would’ve been a totally different situation. However, the way things look right now, there really is nothing to “deal with”.

As someone has already pointed out in the comments to Mikkel’s above-quoted post, cookies set by affiliates through affiliate program links are third-party cookies (as opposed to first-party cookies that affiliates themselves may be able to set). So there is absolutely no way for “an affiliate of [a] company” to “set an EverCookie on users no other affiliate will ever be able to overwrite”.

In addition to this, a good observation was made by David Bullock, Vice President of Technology at OneCoach. There actually is a context within which EverCookie may become problematic, and here’s Dave’s description of it:

EverCookie is the program/code that sets the cookies, and recreates them if some are missing. It has to be run from a website.

In order for the cookie to be regenerated, the EverCookie script has to be run again, the same situation as if the visitor revisited the Affiliate A’s site after getting a new cookie at Affiliate B and overwrote it with a regular cookie.

The only way this would be an issue is if the Merchant (not a rogue affiliate) regenerated the dormant affiliate cookies and overwrote the last legitimate cookie with an old EverCookie record. That would be very easy to spot since the merchant would have to be running the EverCookie scripts on their site.

So, technically it is possible for a merchant to start using EverCookie to overwrite “the last legitimate cookie” of an affiliate, robbing the latter of the commission that is due. But then again… this by no means kills affiliate marketing, because as soon as an affiliate network (or an affiliate) spots such merchant behavior, it’ll be brought to light (with all natural consequences). And no serious merchant wants that.

Earlier this week, it was announced that “the Council of the European Union has approved new legislation that would require Web users to consent to Internet cookies”. The text of the legislation reads:

Third parties may wish to store information on the equipment of a user, or gain access to information already stored, for a number of purposes, ranging from the legitimate (such as certain types of cookies) to those involving unwarranted intrusion into the private sphere (such as spyware or viruses). It is therefore of paramount importance that users be provided with clear and comprehensive information when engaging in any activity which could result in such storage or gaining of access. The methods of providing information and offering the right to refuse should be as user-friendly as possible. Exceptions to the obligation to provide information and offer the right to refuse should be limited to those situations where the technical storage or access is strictly necessary for the legitimate purpose of enabling the use of a specific service explicitly requested by the subscriber or user. Where it is technically possible and effective, in accordance with the relevant provisions of Directive 95/46/EC, the user’s consent to processing may be expressed by using the appropriate settings of a browser or other application [underlining mine].

In essence, the new legislation proposes that no cookie is installed on the end user’s machine without his/her explicit consent which must be sought every time a cookie is about to be recorded.

This legislation is not yet signed into a law, but is expected to become one if signed within the next 18 months (implementation due: 04/26/2011).

Will the EU Law Bury Affiliate Marketing?

If such a legislation becomes a law, will it really bury affiliate marketing in Europe as some are already being afraid? I do not believe so. While the majority of present day affiliate marketing tracking solutions do rely on cookies, the industry’s existence does not have depend on them. There is a way to track affiliate-referred sales/leads via cookie-less solutions, and at least two European affiliate networks are already employing them (AffiliateFuture and Webgains). So, while the is little joy for affiliate marketers behind the newly proposed legislation, it is certainly not the end of the world.

Bigger Picture — Wider Implications

The real problem is that if this draft becomes a law, many other areas of online marketing will be automatically affected. To mention but a few scenarios, cookies are being extensively used for/in:

• Affiliate marketing
• Ad serving
• Personalization and optimization of user experience
• Shopping carts
• Web analytics

The implications are significantly wider than just the affiliate marketing. In fact, as suggested above, affiliate marketing does have alternative solutions on hand. Are there effective ways to deal with the possible complexities on the other fronts mentioned?

Related articles and discussions:

• Big Threat to Affiliate Marketing? (discussion)
• EU Adopts Law Requiring User Consent for Cookies
• EU Cookie Rule Passes, But Ad Impact Still Unclear
• EU Proposal Could Cripple Common Web Ad Practices
• Consent Will Be Required for Cookies in Europe (legal take)
• New EU Cookie Law Smacks Of Windows Vista’s Constant Nagging
• EU: No Cookies Without Consent. Will EU Affiliate Programs be Killed? (discussion in comments)

I have a ZoneAlarm® Pro Firewall installed on my machine. This morning when I turned my computer on, it ran a routine scan for spyware and threats, and deleted the following cookies:

Two of the above (Apmebf and Qksrv) are Commission Junction (CJ) cookies, and one (Linksynergy) is a LinkShare cookie. All of these are set on the end-users’ machines to track affiliate-referred transactions.

The irony of the situation is that besides their recently launched program on the Google Affiliate Network ZoneAlarm has an older affiliate program on Commission Junction [details here]. When I click a CJ affiliate’s ZoneAlarm link, and land on the merchant’s website, it is precisely the Apmebf cookie that gets set on my machine:

Apparently, it gets set only to be deleted during the next routine clean-up of unwanted cookies, which obviously hurts ZoneAlarm itself. How ironic!

Really interesting results of a study on cookie retention have been published in one of the Sun Microsystems blogs yesterday. In his “Web Analytics Analyzed” blog Paul Strupp has revealed the following chart which demonstrates “what percent of users returning after X days on the same computer still have the same cookie”:

The key numbers/findings of this study reveal:

• “Very sharp drop” (to 72%) just 7 days after the initial visit
• 50% of cookies deleted by day 45
• 360 days past the initial visit the rate “levels out at around 20%”

The above data shows that the majority of Internet users who delete cookies do so within the first 30 days. Starting from day 60 the rate of decay acquires a more gradual character, dropping 45% to 40% between days 60 and 120, then from 40% to 30% from day 120 to 210, and from 30% to about 20% between days 210 and 360.

This study has immediate implications for the context of affiliate marketing. It helps merchants answer the question of  a fair cookie life to set; and it also makes affiliates better equipped for determining which merchants to partner with based on the cookie life they offer through their affiliate programs.

I have blogged about the problem of disabled cookies, and how situations when the end users refuse to accept cookies may hurt the affiliate tracking. In my response I have mentioned that there is one “if” and that is “if the platform chosen by the merchant relies on cookies for tracking” then the tracking will be affected.

There are, on the other hand, platforms — and by “platforms” I mean both affiliate software, and affiliate networks — that do not depend on cookies for tracking. Tracking may also be based on the end-user’s IP, or be URL-based (when affiliate IDs are being embedded in each URL), or incorporate a number of other solutions that aren’t tied to cookies.

Here’s a brief list of software providers and affiliate networks that support cookie-less affiliate tracking:

Software:

• 1AutomationWiz
• AffiliateTracking.com
• DirectTrack
• LinkTrust
• Post Affiliate Pro

Affiliate Networks:

• AffiliateFuture
• ClickBank
• oneNetworkDirect
• Webgains

If you know of any other cookie-less (or cookie-free) affiliate tracking solution providers, feel free to mention them below, and I’ll happily add them to the above lists.

Another good question was emailed to me by a merchant who is considering starting an affiliate program, and read my previous post on affiliate cookies and whether a shopper can have cookies from more than one affiliate on his/her computer. The question was:

What if the shopper has decided to browse the Internet in the highest security mode possible, and refuses to accept cookies? Will this negatively affect the affiliate tracking?

Short answer: If the platform chosen by the merchant relies on cookies for tracking, orders placed in the above-quoted context will indeed not track.

Long answer: While some people choose to disable cookies, believing that it provides them with higher online security through privacy, the vast majority of online shoppers do not. In many cases, the shopper will not be able to fully enjoy the shopping cart’s functions unless they choose to accept cookies [see the Yahoo! shopping cart example here]. In “A Practical Guide to Affiliate Marketing” (cf. pp. 24-26) I wrote:

…cookies are now such an essential part of the day-to-day Internet use that many websites will simply not function properly for the end-user unless he/she has the cookies enabled. Cookies help create a positive and enjoyable Internet experience through customization of each individual user’s utilization of the Internet.

The main question should be: how many online users actually turn cookies off? Commission Junction quotes 1%. Many online advertising agencies, affiliate networks, and websites stress the harmlessness of cookies and educate the end-users to keep those cookies turned on. For example, AllAboutCookies.org, a website of the Interactive Advertising Bureau Europe, emphasizes: “Because cookies are just harmless files, or keys, they cannot look into your computer and find out information about you, your family, or read any material kept on your hard-drive. Cookies simply unlock a computer’s memory and allow a website to recognize users when they return to a site by opening doors to different content or services. It is technically impossible for cookies to read personal information.”

Let us return back to the statistics, as they are what is most relevant to the problem in question. In an article on “Internet privacy”, Wikipedia states: “Many users choose to disable cookies in their web browsers”. However, it does not give any statistics to how many users! Commission Junctions states that the number is only 1%, Opentracker.net quotes 3%. Regardless of how hard I tried, I was unable to find any other statistics on the issue. If one looks at the overall statistics of Internet users — according to Nielsen//NetRatings’ researches, in the USA alone 200,000,000+ people use Internet — 1%-3% is “many users”. It is basically anywhere between two and six million people in the United States alone. However, it is by far not a considerable number, as 97%-99% of users have those cookies turned on.

If you take a look at the above-quoted Wikipedia article on the Internet privacy, you will see that their wording has changed since 2007 when I published my book, and it currently reads: “Some users choose to disable cookies in their web browsers — as of 2000 a Pew survey estimated the proportion of users at 4%” [italics mine]. This still leaves us with anywhere between 96% and 99% of those that have them turned on and we do not know how many of those that do disable cookies are actually online shoppers.

My conclusion today is the same as it was two years ago: “unless you are using an affiliate tracking that is not dependent on cookies, the affiliate program will not be able to credit affiliate accounts on the sales made by those users that have disabled their cookies. However, the percentage of users that disable cookies is small enough for your affiliates not to give it too much concern.”

A merchant wrote:

I wanted to see if you knew what happened if a shopper has more than one cookie from different affiliates, and then makes a purchase.

I think this would be very likely to happen and was wondering who would get the commission, etc.

This is a very good question for someone new to affiliate marketing to ask.

The way things currently work is that a vast majority of affiliate networks (and affiliate program software applications) have the last referring affiliate’s cookie set to overwrite the previous affiliate’s one. So, the above-mentioned scenario is generally impossible. Simply put, the end user has only one affiliate cookie on his/her computer, and it is always the cookie set by the last affiliate that referred the shopper to you. This rule is also known as “the last cookie wins” rule.

When setting up an affiliate program, the question of cookie life inevitably comes up. Affiliate cookie life is the time span that starts with the consumer’s click on the affiliate link and ends on the day beyond which you, as a merchant, do not wish to remunerate the affiliate for the visitor they sent to you. It is the time period within which you will pay the referring affiliate his/her commission on the orders placed by the referred customer.

While some of the larger brands set their affiliate cookie life at 24 hours (or thereabout), I would definitely not recommend doing this. Statistics speaks in favor of 365 days’ or even lifetime cookies. First of all, anywhere between 20% and 35% of online users delete cookies on a regular basis (weekly or monthly), either manually or with the help of various anti-spyware applications. Secondly, my analysis of return days in which sales occurred across the programs that I manage showed the following:

same day sale — 75%
sale within 1-30 days since the first visit — 19.5%
sale within 31-60 days — 3%
sale within 61-90 days — 2%
sale over 91 days after the first visit — 0.5%

Affiliates see the same stats too. I recommend my clients to set their default cookie life at the 90 days’ mark. Also, do offer your affiliates cookie life increases (to 180 and 365/unlimited days) as a bonus for their activity in your affiliate program. There is no reason not to.