Affiliate Tracking Not Working on Shopify?

How Affiliate Tracking Actually Works

Strip away the network jargon and every affiliate programme runs on the same three-step relay:

• The click. Someone clicks a publisher's link. The URL arrives at your store carrying a click identifier, a unique reference in the URL parameters that says "this visit came from this publisher's link".
• The wait. That identifier has to be stored somewhere, usually a cookie, sometimes browser storage, so it survives while the visitor browses, leaves, comes back two days later and finally buys.
• The conversion. When the order completes, the stored identifier gets passed back to the network along with the order value, and the network credits the right publisher with the commission.

Every affiliate tracking failure is a break in one of those three links: the identifier never arrives, doesn't get stored, or doesn't get passed back.

There are two ways the final step can happen, and the difference matters. The traditional way is a script tag: a bit of the network's JavaScript runs on your order confirmation page, in the customer's browser, and reports the sale. The robust way is a server-to-server postback: your store's own systems tell the network about the sale directly, machine to machine, no browser involved. Script tags are easy to install and easy to break. Postbacks are more work up front and then largely refuse to break, because ad blockers, consent banners and browser privacy features can't touch a message that never goes near the browser.

Why It Breaks on Shopify

Shopify stores have had a particularly rough time of it lately, for four compounding reasons.

1. The Checkout Scripts Are Gone

For years, the standard Shopify installation for networks like Awin, Rakuten, Impact and Partnerize was a snippet pasted into the "additional scripts" box on the order status page. Checkout Extensibility, Shopify's new checkout architecture, removes that mechanism entirely. When a store migrates, and Shopify has been migrating everyone, those scripts simply stop running. No error, no warning on your dashboard, just conversions that stop reporting from migration day. If your affiliate sales flatlined on a specific date, go and find out when your checkout migrated. Full detail here: how Checkout Extensibility breaks tracking.

2. The Custom Pixel Sandbox Loses the Click ID

The replacement Shopify offers is to run tracking as a custom pixel, but custom pixels run inside a sandbox, an isolated container that can't freely read the page URL, its parameters or your cookies. Remember step one of the relay: the click identifier arrives in the URL and has to be captured and stored. Code that did that happily on the old setup can fail inside the sandbox, which means the identifier is lost the moment the visitor lands, and every subsequent purchase from that visitor is untrackable no matter how well the conversion step works. I've written that mess up separately: what Shopify's custom pixel sandbox breaks.

3. Consent Blocking

Affiliate cookies are tracking cookies, so a properly configured consent banner won't set one until the visitor agrees. Visitor declines, cookie never exists, sale never attributes. That's working as intended, and it's a real cost of compliance. The problem case is misconfiguration: a consent setup that blocks the affiliate script for everyone, or blocks it in the checkout specifically, silently zeroes your affiliate reporting. The same failure has been wrecking Google numbers all year, and the diagnosis logic in why consent mode made conversions drop applies here almost unchanged.

4. Redirects That Strip Parameters

Affiliate clicks rarely travel in a straight line. They pass through the network's tracking domain, sometimes a link shortener, sometimes an app that localises URLs or forces www or https. Every hop is a chance for the click identifier to get dropped from the URL, and some redirect setups do exactly that. If the identifier isn't in the URL when the visitor finally lands, there is nothing to store, and the relay fails at step one. It's worth clicking your own affiliate links occasionally and checking the landing URL still carries the tracking parameters. You'd be surprised.

What Missing Commissions Actually Cost

It's tempting to see under-tracking as a money-saver. Fewer recorded sales, fewer commissions paid. That's exactly backwards.

Publishers lose trust first. Good affiliates watch their conversion rates per merchant closely, it's how they decide where to spend effort. When their clicks to your store stop converting on paper, they don't email you about it, mostly. They just move your links down the page, or replace you with a competitor whose tracking works. The best publishers, the ones with genuine audiences, are precisely the ones professional enough to notice quickly.

The network relationship suffers. Networks monitor merchant tracking health, and a merchant whose conversions don't report reliably becomes hard to recommend to publishers. You can end up quietly deprioritised without anyone telling you.

You lose the data even if you'd happily pay the commissions. With tracking broken you can't tell which affiliates genuinely drive sales and which just harvest commissions on customers who were coming anyway. That distinction is the entire basis for deciding commission rates, bonuses and who to build relationships with. Broken tracking doesn't just misprice the channel, it blinds you to how the channel works.

Commission Validation: Check Both Directions

The only way to know where you stand is to line the two systems up against each other: export a month of conversions from the network, export the same month of orders from Shopify, and match them up, order by order, using the order references the network stores against each conversion.

Sales in Shopify with no matching network conversion are your under-tracking, the broken relay covered above. But run the comparison the other way too, because over-reporting is real and nobody looks for it:

• Commission on cancelled and returned orders. The conversion fires at checkout; the refund happens days later and the network never hears about it. If nobody feeds returns and cancellations back into the network's validation process, you approve and pay commission on revenue you refunded. Most networks hold conversions in a pending state for exactly this reason, but the window only helps if someone actually uses it.
• Duplicate firing. A conversion script that runs on every visit to the order status page, and customers do revisit that page, can report the same order more than once if the setup doesn't guard against it.
• Attribution you didn't intend. Last-click affiliate attribution happily claims customers who clicked a voucher-code site in the final ten seconds of a purchase they'd already decided on. That's a commercial policy question more than a bug, but you can't have the policy conversation without accurate data.

If dashboard numbers that nobody validated are steering real money, it can go spectacularly wrong in both directions. I've seen an analytics setup invent growth that didn't exist, and written up how it was found: the store that reported growth that wasn't real. Affiliate reporting deserves the same scepticism as every other dashboard: reconcile it against orders, or assume it's wrong.

The Fix: Server-to-Server Where It Counts

The durable fix follows one principle: move the conversion report out of the browser. Concretely, for a Shopify store that usually means:

• Capture the click identifier reliably at landing, in a way that doesn't depend on the sandbox behaving, and store it against the visitor's session.
• Attach it to the order, so when checkout completes the order record itself knows which click it came from.
• Report the conversion server-side, from your systems to the network's postback endpoint, with the order reference and value. Ad blockers, consent-blocked scripts and browser privacy features never enter the picture. Consent still applies, this is a legal question, not a technical one, but a correctly consented conversion now actually arrives.
• Feed refunds and cancellations back, so the network's validation reflects reality and you stop paying commission on returned goods.

Most major networks support server-to-server conversion reporting; the setup details differ per network, so it's one to confirm against your network's own documentation rather than a blog post, this one included. It's the same architectural shift as sending Meta and Google events from the server, and if you're fixing one channel it's worth fixing them together, which is what server-side tracking is about.

If you'd rather establish what's actually broken before rebuilding anything, that's the sensible order to do it in, and it's exactly what my tracking health check is for.