No Cookie Without a Click: PMA Puts Affiliate Toolbar Standard to September Vote

The Performance Marketing Association has proposed a shared industry standard for affiliate toolbars, browser extensions, and other browser-based shopping helpers, with members set to vote from 1 September.

Announced by the PMA on 18 August, the framework sets common expectations for networks, subnetworks, software publishers, brands, and merchants. Approval would make it an official PMA position, but the standard would remain voluntary, non-binding, and dependent on businesses adopting it.

Why This Vote Matters for Affiliate Marketing

• One shared baseline: The proposal would establish common expectations for networks, subnetworks, browser-extension publishers, brands and merchants.
• Clearer attribution rules: It addresses user consent, cookie overwriting, stand-down behaviour, coupon removal and enforcement.
• Voluntary rather than binding: Approval would make the framework an official PMA position, but it would not become law or create a PMA policing regime.
• Adoption will determine its impact: The standard will only change day-to-day practices if companies incorporate it into their contracts, policies and compliance processes.

What the Proposed Standard Covers

Despite the use of “toolbar” in its title, the full proposed framework has a wider scope. It uses “publisher” to cover toolbars, browser extensions, and any other browser helper.

The document separates its provisions into required and suggested standards. The required section is presented as the minimum expected of companies that adopt the framework, while the suggestions leave room for different commercial models.

For networks and platforms, the required standards include:

1. Testing software before approving a toolbar or extension, including checks that it does not automatically place cookies or overwrite another publisher’s cookie without user action.
2. Including standardised stand-down clauses in network terms and conditions.
3. Maintaining installation and deletion requirements for software publishers.
4. Creating a process to suspend or remove non-compliant publishers.
5. Allowing payments to be withheld or reversed during periods of non-compliance, with reversed funds returned to brands, less network transaction fees.

The proposal recommends (but does not require) ongoing testing, record keeping and transaction-level attribution tools. It suggests quarterly testing as one possible approach. It also says networks could pass additional compliance costs to software publishers, provided those charges are disclosed in advance.

Subnetworks that accept toolbar publishers would be expected to follow the network requirements and give merchants the option to exclude toolbar publishers from their programmes. However, identifying the specific toolbar publishers or supplying unique software-publisher IDs is currently listed as a suggestion rather than a requirement.

The Rules Proposed for Browser-Extension Publishers

The most consequential section concerns when software can intervene in a transaction and claim attribution.

Under the proposed required standards, a cookie, coupon code, or promotion must not be applied without an affirmative click or other voluntary interaction from the consumer. Software must stand down when an existing affiliate cookie is present for the length of that session, only placing its own cookie if the consumer actively engages with the extension.

This is not an absolute ban on overwriting an earlier referral. It creates a user-interaction threshold. One of the questions for the industry will therefore be what constitutes meaningful engagement and whether every eligible interaction represents enough incremental value to justify a change in attribution.

The proposed publisher requirements would also:

1. Prevent software from interfering with the ordinary use of a merchant’s website.
2. Require a public process through which merchants can request that coupon codes be removed.
3. Require codes to be removed within 24 hours of notice from a brand.
4. Require brands and networks to be notified within five business days of a material change to the way the software operates.
5. Prevent a publisher suspended from a programme from attempting to re-enter it through a subnetwork.

The PMA suggests that publishers should source coupons directly from merchants, networks or merchant-verified third parties rather than scraping codes submitted by users. It also recommends that extensions give brands a specific opt-in or opt-out choice and provide networks with test accounts capable of reproducing each user class.

Brands and Merchants Would Have Responsibilities Too

The framework does not place responsibility solely on extension publishers.

Brands and merchants adopting the standard would need to publish clear policies before promotions begin. Those policies should explain stand-down rules involving other affiliates and paid channels, permitted changes to a merchant’s website or search appearance, attribution behaviour, enforcement timelines, and the consequences of non-compliance.

The proposal also suggests that merchants consider different commission rates for software publishers when their incremental value differs from that of other partner types.

This is an important part of the framework. Attribution disputes often become arguments about individual publishers, even though merchants and networks determine the contractual and technical rules under which credit is awarded.

Affiverse previously reported on how the dismissal of creator claims against PayPal raised questions about whether affiliate contracts clearly establish entitlement to commissions. A shared standard could help businesses make those expectations more explicit, although it would not replace programme terms or resolve existing legal disputes.

Why the Proposal Is Arriving Now

Browser-extension attribution has become one of affiliate marketing’s most visible governance problems.

Recent controversies involving PayPal Honey and Phia have intensified scrutiny of software that can intervene close to checkout and claim attribution without deliberate shopper interaction. Phia disputes parts of the reporting about its attribution features and says it has removed functionality that caused misattribution.

Major platforms then responded differently. Rakuten Advertising removed Honey from its network, impact.com suspended the account and announced additional technical safeguards, and Awin suspended payments and blocked new programme access while pursuing remediation. Affiverse’s comparison of those network responses shows how enforcement can vary even when the underlying concern is similar.

Google also tightened its Chrome Web Store Affiliate Ads Policy in 2025. It requires disclosure, a related user action, and a direct, transparent user benefit before an extension can add an affiliate link, code or cookie. The PMA framework goes beyond the browser-store relationship by allocating responsibilities across the affiliate supply chain.

The proposal does not name Honey, Phia or any other company. It is designed to address the operating model behind a broader class of software publishers, rather than respond to a single case.

The Difficult Questions Remain

The proposal provides more specificity than a general commitment to “fair attribution”, but several questions will shape the September discussion.

Will the Industry Adopt It?

Will the major networks, platforms and merchants formally adopt the required provisions if the PMA approves them? An official trade-association position may influence contracts, but the PMA has made clear that it will not police compliance.

What Counts as Meaningful Engagement?

Is active engagement alone the right threshold for allowing an extension to replace an existing affiliate cookie? Google’s Chrome policy additionally requires a tangible benefit at that moment, such as a valid discount or cashback. The PMA proposal lists affirmative interaction as a requirement while treating restrictions on coupon sourcing as a recommendation.

Should Subnetwork Transparency Be Mandatory?

Giving merchants the right to opt out is useful only when they can reliably identify how software publishers are entering and operating within their programmes.

Who Pays for Compliance?

Passing continuous testing costs to toolbar publishers could encourage better behaviour and place the expense with the business creating the risk. It could also increase barriers for smaller, legitimate extension developers.

The September Vote and the Real Test of Adoption

PMA members will receive further information about the voting process at the beginning of September. The framework will become an official PMA stance if a quorum is reached and a majority of voting members approves it.

Even if adopted, the vote will be the start of the implementation conversation rather than its conclusion. The practical test will be whether networks incorporate the clauses into their terms, merchants update their programme policies, subnetworks expose software relationships, and publishers can demonstrate compliant behaviour consistently across browsers, locations and user types.

For an industry that has debated toolbar attribution for decades, securing agreement on a minimum standard would be meaningful. Whether that agreement changes day-to-day attribution will depend on what companies do after the vote.