Affiliate cookie duration: twenty platforms' defaults, the settings, and what Safari does to them

By Jimi Barkway · Published 7 September 2026 · Part of the blog

What cookie duration do affiliate programs use?

In shortFourteen of the twenty platforms on this site's calculator print a default. The spread is narrow: 30 days on four, 45 on one, 60 on five, 90 on four. Sixteen let you change it. Two print a maximum, and both say 365 days. Whatever the number, Safari caps a cookie set by a script at seven days. After a decorated link from a domain it has classified, the cap is one day. So the default is a policy for most browsers and a ceiling of a week in one.

The research method was simple. I put four questions to twenty vendors' help centres and docs on 7 September 2026. What is the default window, in days? Can the merchant change it, and is there a maximum or a per-campaign setting? Is the cookie set on the merchant's domain, or does the link go through the vendor's first? First click or last click by default? Then I set the answers against Safari's own release notes. I found that the number founders argue over, 30 or 60 or 90, is the smaller question. Who set the cookie and how the link arrived matter more.

Three words first. A cookie window is how long after a click a sale still counts for the affiliate. A first-party cookie is one set on your own domain, by a script on your own page. Browsers treat it more kindly than one set from another domain. And last click is the rule that credits the last affiliate link a customer clicked. First click credits the first. Those three are what the four questions measure.

What is the typical default?

In short60 days is the most common printed default, on AffiliateRail, Rewardful, FirstPromoter, PromoteKit and Ambassly. 90 days is next, on Dub, PartnerStack, Partli and Endorsely. 30 days is on Affonso, Trackdesk, Refgrow and refVenue. Tapfiliate alone prints 45, and its help centre says why: "industry standards can vary from 30 to 90 days".

Two more show a number without calling it a default. Tolt's docs put 30 in every example. A fresh program returned 30 from its API on 20 August. But no Tolt page calls 30 the default, and a help-centre search for "cookie" returns nothing. Komissio's home page shows "Cookie window 60 days" in a setup example. Four print no number at all: Partnero, Reditus, LeadDyno and Impact. LeadDyno's setting is in months, and blank means indefinite. Impact's window is a contract term.

Let's say you want to match the middle of the market. 60 days does that. Let's say you sell a product with a long decision, such as a tool bought by a team after a month of trial. 90 days is where four platforms already sit. Tapfiliate and Trackdesk both let you go to 365, which Trackdesk explains: "All major browsers cap cookie lifetimes at a year". Let's say you sell an impulse purchase. 30 days is where four platforms sit. The number you pick is a policy on what counts as your partner's sale.

Can you change it, and per what?

In shortSixteen of twenty print that you can. Ten let you set it per campaign, program or offer. Rewardful, FirstPromoter and PromoteKit set it per campaign. Tapfiliate, Partnero, Ambassly, Endorsely and refVenue set it per program. Trackdesk sets it per offer, and Impact per template term. Affonso and Dub set it per script install. AffiliateRail, Reditus, LeadDyno and Refgrow print one setting for the whole account. Tolt, Partli, Komissio and PartnerStack print nothing about changing it.

Per campaign matters when partners differ. A newsletter sends buyers the same afternoon. A review site sends them a month later. Those are two windows, not one. On Rewardful the setting sits under the campaign's advanced settings, "enter the number of days". On FirstPromoter it is "Cookie life (days)" on the campaign, "Default is 60 days". On Dub it is a parameter on the script, so one install has one window.

The two printed maximums are both a year. Tapfiliate: "The maximum cookie time you can configure is 365 days." Trackdesk: "365 days", with the browser reason above. The other eighteen print none, which does not mean there is none. It means the page does not say. A founder who wants two years should ask before assuming the field takes it.

What does Safari do to all of this?

In shortIt shortens it. WebKit's Intelligent Tracking Prevention 2.1, from March 2019, caps cookies set through document.cookie at seven days. ITP 2.2, a month later, caps them at one day in one case. That is when the visitor arrived from a domain Safari has classified as a tracker, and the landing URL carries a query string or fragment. An affiliate link is exactly that. ITP 2.3 deletes script-writable storage after seven days without a visit. A 2020 update capped CNAME-cloaked cookies at seven days too.

So on Safari, a 60-day window set by a script is a seven-day window, and sometimes a one-day one. The vendor's number is the policy; the browser's number is the ceiling. Four vendors print their own note on it. Ambassly: Safari "can cap client-set cookies to about 7 days in common referral flows". PartnerStack: "a cookie will be capped at 7 days if the user does not return to your website". Komissio and Impact print ITP pages of their own. The other sixteen leave it to you to know.

The way round it is to stop relying on the cookie. Fifteen platforms print a server-side route. Your own server reads the click and passes it to your billing system, so the sale is matched on the invoice rather than the browser. Six print a reverse proxy or a tracker domain of your own. Then the cookie is set by your domain rather than through a third party. Dub's script option is "useful for setting up reverse proxies to avoid adblockers". AffiliateRail prints "a tracker domain of your own". The cookieless tracking article walks the whole mechanism. The Stripe tracking article shows the invoice route.

Where does the cookie live, and does the link bounce first?

In shortTen vendors say "first-party" in their own words. Five more describe a cookie on your domain without the words. Five say nothing. Separately, five send the click through the vendor's domain before yours: Dub, PartnerStack, Trackdesk, Impact, and Partli's default link. Thirteen go straight to your domain with a parameter, which is the shape Safari treats best.

The two questions are different. A cookie can be first-party and still arrive after a bounce through the vendor's domain. That is what Dub, PartnerStack and Trackdesk do: the redirect captures the click server-side, then the script on your page writes a first-party cookie. That is a sound design. It is also the shape ITP 2.2's one-day cap is aimed at, because the referring domain is a tracker's and the landing URL is decorated. A direct link with ?via=abc on your own domain has no bounce. Rewardful, PromoteKit, Endorsely and eleven others use that shape.

The attribution model is the last column. Seven default to last click, two to first, four offer both without printing a default, seven print nothing. Rewardful is the one of the big four that defaults to first touch, switchable per campaign. First touch is the same rule as first click: the first affiliate link the customer clicked gets the credit. Affonso prints its model as fixed. The Rewardful comparison covers what first touch changes for a program with several partners on the same customer.

How should you set yours?

In shortPick the number by how long your buyer takes, not by what the vendor pre-filled. Set it per campaign if your platform allows and your partners differ. Then treat the number as a policy for most browsers and a week for Safari. Put the sale on the invoice rather than the browser where you can. The number is the least important of the four questions on this page.

For example, imagine a Stripe SaaS with a 14-day trial and a review site as its main partner. A customer reads the review, starts a trial the same week and buys on day 14. A 30-day window covers that on Chrome. On Safari the cookie is gone by day eight. The sale is credited only if the platform matched the trial to the click on the server. Now imagine a newsletter partner whose readers buy the same afternoon. Every window on the table covers that, on every browser. Now imagine a partner whose audience buys three months later. Only a 90-day window covers it, and only off Safari.

A word on this site's own product, with its trade-offs. AffiliateRail's window is 60 days by default. It is one setting for the account rather than per campaign, and first click rather than last, with no printed switch. It sets a first-party cookie by script on your domain and offers a tracker domain of your own. It passes the click to Stripe or Paddle on the server so the sale is matched on the invoice. It prints no maximum. It takes 0% of every payout and pays from your own PayPal or Wise on a schedule from the $59 plan.

Every cell on this page was read off the vendor's own pages on 7 September 2026, and the Safari figures off WebKit's release notes. "Not printed" means the pages read did not say. Settings change. Read the help centre before you rely on a row.

Common questions