Cookie Stuffing Lands AI Shopping App In Hot Water

Introduction

A shopping app co-founded by Bill Gates’ daughter, Phoebe Gates, recently became the center of a cybersecurity controversy.

Phia, an AI-powered shopping assistant co-founded by Gates and Sophia Kianni, helps shoppers compare prices and find deals. In July 2026, reports alleged that Phia’s browser extension used a technique known as cookie stuffing to take credit for purchases that it did not actually generate. As a result, their affiliate platform suspended the extension while they reviewed the suspicious activity. Phia initially attributed the behavior to a software issue and said that they had fixed the problem.

It sounds like a dispute between retailers and advertisers, so why should it matter to you? Cookie stuffing affects shoppers too, and this case shows exactly why you need to be careful about what browser extensions you install.

What Is Cookie Stuffing?

First, we need to understand how affiliate marketing works.

Imagine you click a link from a website recommending a pair of shoes. The retailer may place a small tracking file, called a cookie, in your browser. If you buy those shoes, that cookie tells the retailer which website referred you so it knows who should receive a commission.

Cookie stuffing manipulates that process.

For Phia, it went like this: Investigators alleged that the extension could automatically register its own referral when shoppers visited participating retailers, including situations where another source actually sent the shopper. In testing, the extension reportedly opened content in the background and replaced another affiliate’s referral information with Phia’s own.

Simply put: Imagine your friend sends you to a store, but somebody else walks up to the cashier and says, “I sent them here. Give me the commission.” That’s essentially what’s happening on the back-end of your browser.

Meanwhile, the shopper received their item and maybe even a referral discount. As a result, they may never realize what happened.

Why Does This Matter to You?

Cookie stuffing generally targets advertising commissions, rather than your bank account or password. That makes it different from malware designed specifically to steal your information. Instead, competing referral partners feel the negative impact.

For the end user, the cybersecurity concern comes from how much access we give our browser extensions.

Extensions can add useful features to your browser, but some request permission to view or modify information on the websites you visit. Depending on the permissions involved, an extension can potentially observe browsing activity or change how pages behave. Since you installed it on the browser, the app doesn’t have to ask permission over and over again before it engages with your web pages.

That does not mean every extension is dangerous. It just means you need to treat browser extensions like any other software you install. If a program can interact with your browser, then you should know who created it and what permissions you gave it.

Phia Isn’t the Only Recent Example

The Phia controversy is also part of a larger debate surrounding shopping extensions.

For example, PayPal’s Honey browser extension faces ongoing litigation from content creators who allege that Honey replaced their affiliate tracking information during checkout and took commissions from purchases it did not generate. Allegations involve a hidden browser tab that overwrote an existing affiliate ID with Honey’s own, though PayPal disputes this. Litigation remains ongoing.

RetailMeNot faced similar allegations.

These cases show why seemingly harmless browser add-ons deserve more attention.

How to Protect Your Browser

You probably have extensions installed right now that you have not thought about since adding them. Take time to check what you have downloaded to your browser.

A few good habits include:

• Remove extensions you no longer use.

• Download extensions only from trusted sources.

• Check what permissions an extension requests before installing it.

• Be cautious when an extension wants access to every website you visit.

• Keep your browser and extensions updated.

• Avoid installing unapproved extensions on work devices.

If an extension suddenly changes behavior or requests new permissions, do not automatically click Allow. Instead, find out why it needs that additional access first.

Conclusion

The Phia controversy primarily revolves around misattributed sales commissions, but it also highlights a much broader cybersecurity concern around browser extensions in general.

We give these applications considerable access because they make our lives easier, and then we often forget they’re even installed. Many of them run in the background and don’t ask twice for permission.

Periodically check what’s installed, remove what you no longer need, and pay attention to the access that you grant your programs. Sometimes the biggest browser risk is the little icon in the corner that you forgot was even there.