Adult CPA Affiliate Networks For ADULT Traffic: The Business Nobody Explains Correctly

That was a Tuesday in March. I'd been running a diabetes-supplement offer on Taboola, US desktop traffic, $9 payout on a lead form, and I'd pushed spend to roughly $2,800 a day because the numbers held for eleven straight days. Then the affiliate manager — a guy in Tel Aviv who answered Telegram messages at 2 a.m. and genuinely knew his advertisers — sent me a message that started with "hey so." The advertiser had flagged lead quality. Payment was on hold pending review. My credit card, meanwhile, had already settled with the traffic source.

I got paid. Sixty-one days later, at 72% of what the dashboard had shown. On my dating and Camsites Offers running through Adult AD Networks (I explained this on STCK) that are honestly already shady enough on their own too lol.

That experience taught me the thing this entire industry is bad at explaining, and it's the thing I want to spend the next several thousand words on. CPA affiliate networks are not marketplaces. They look like marketplaces. They have offer listings, search filters, EPC columns, and a signup form that asks what your traffic sources are. But structurally, functionally, and in terms of where their risk actually sits, they are specialty finance companies that happen to sell advertising. Once you see that, almost everything confusing about how they behave stops being confusing.

The balance sheet is the product

Here is the mechanic that gets skipped in every beginner guide.

An advertiser — call it a telehealth brand running a GLP-1 consultation funnel — agrees to pay $140 for a qualified consult. The network signs that deal on Net-45 terms, sometimes Net-60. Meanwhile the network offers that same event to its publishers at $105 and pays them weekly, or on Net-15, or in some cases within 24 hours if the publisher has history.

Read that timing again. Money goes out the door long before it comes in.

The network is fronting working capital against an unsecured receivable from an advertiser it does not control, on volume produced by publishers it also does not control, in a vertical where the advertiser can dispute the quality of the goods after delivery. That is a factoring business with an ad-tech interface bolted on. The gross spread — commonly 15% to 30% on lead-gen and nutra, thinner on high-ticket iGaming and app installs where advertisers negotiate harder — isn't a "commission." It's a risk premium.

Everything downstream follows from this.

Why does a network hold your first payment for 30 to 60 days? Because it has no loss history on you and it is extending you credit. Why do offers vanish mid-campaign with no warning? Because the advertiser stopped paying, or hit an internal budget wall, and the network's exposure just became a collections problem. Why does the good affiliate manager suddenly care very much about which sub-source your traffic came from? Because a chargeback wave from one placement can wipe out the margin from forty others.

Why do some networks scrub?

Two reasons, and honest operators will tell you both. One is legitimate: fraud and refund reversal has to land somewhere, and the terms say it lands on the publisher. The other is that "quality adjustment" is the single easiest margin lever in the business, requires no negotiation, and is nearly impossible for the publisher to audit. A network under cash pressure discovers a quality problem. This is not a conspiracy theory. It's an incentive structure, and I've watched it play out at three networks that were, at the time, well-regarded.

The good ones solve it structurally. They publish approval triggers. They show the funnel event by event — click, lander view, form start, form submit, validation, approved — so a scrub has a visible cause. They give you reason codes. A network that reverses conversions and cannot tell you which ones and why is not running fraud control. It's running a spreadsheet.

What the 2026 measurement environment actually looks like

For six years the industry organized itself around a prediction that turned out to be wrong.

Chrome was going to kill third-party cookies. Everyone said so. Consultancies sold "cookieless readiness" audits. Then in July 2024 Google backed off the deadline. In April 2025 it dropped the planned user-choice prompt entirely. And on 17 October 2025, Anthony Chavez, Google's VP of Privacy Sandbox, announced the retirement of the ten remaining Sandbox APIs — Topics, Protected Audience, Attribution Reporting on both Chrome and Android, Private Aggregation, Shared Storage, IP Protection, Related Website Sets, SelectURL, On-Device Personalization, SDK Runtime. The stated reason was low adoption. Adweek confirmed with a Google spokesperson that the whole initiative was being retired, branding included.

Three things survived: CHIPS (partitioned cookies), FedCM (federated login), and Private State Tokens (anti-fraud signals). The UK's Competition and Markets Authority, which had spent roughly four years negotiating commitments to stop Privacy Sandbox from entrenching Google's position, released Google from those commitments and closed the case. Chrome began deprecating the APIs in version 144 in January 2026, with full removal targeted for Chrome 150 in July 2026.

So third-party cookies stay in Chrome. Indefinitely, by default, with no new deprecation date.

Here's why that headline is a trap. Safari has blocked third-party cookies by default since 2020. Firefox partitions them via Total Cookie Protection. Brave blocks them. That's somewhere in the range of 17% to 20% of global traffic that has been cookieless the entire time, independent of anything Chrome does. Add ad blockers, ITP's seven-day cap on script-written first-party cookies, and consent-mode denials in the EEA, and browser-side measurement in most Western markets captures roughly 60% to 70% of conversions. ClickDealer put that range in print in a July 2026 Blue Book piece and it matches what I've seen in reconciliation.

The genuinely interesting part: performance networks were mostly insulated from all of this, and it was an accident of history.

Retail affiliate programs — the Awin, CJ, Rakuten, Impact side of the world — grew up on cookie-based last-click attribution because they were tracking browser sessions on merchant sites. Performance networks grew up on server-to-server postbacks, because they were tracking PIN submits on Kazakh carrier billing and CPI events on Android where there was no browser session to cookie in the first place. The click generates a transaction ID. The advertiser's backend fires that ID back to the network's endpoint when the event completes. No cookie is involved anywhere in the chain.

That architecture, built for grubby reasons, turned out to be the durable one. Server-side setups recover a meaningful share of the signal browser tracking loses — AM Navigator's 2026 program survey pegged programs running server-side at 18% to 24% higher attributed conversions than cookie-only equivalents, and that gap is roughly the size of the loss described above, which is a decent sanity check.

The practical instruction is boring and unglamorous: if a network cannot give you a postback URL with sub-ID passthrough, at least five slots, and preferably a redirectless click implementation, it is running a 2016 stack. A4D built its whole positioning on redirectless tracking and GDPR-compatible attribution for exactly this reason, and it's a real differentiator, not marketing language.

Mobile is a separate discipline pretending to be the same one

If your traffic terminates in an app install, none of the above applies and you need a different mental model.

Apple's App Tracking Transparency prompt shipped in iOS 14.5 in April 2021. Industry consensus puts global opt-in somewhere around 25% to 30%, meaning for most users the IDFA simply isn't there and device-matched last-click attribution doesn't function. SKAdNetwork is the substitute: the ad network registers the campaign with Apple, the app calls updateConversionValue() with a six-bit integer, and a delayed, aggregated, randomized postback arrives with no user-level identifier attached.

Six bits. Sixty-four possible values to express everything you want to know about a user's post-install behavior, and the postback arrives too late to bid on.

SKAN 4 shipped in late 2022 with hierarchical source IDs, three postback windows, and coarse-plus-fine conversion values. As of 2026, adoption across the major platforms is still incomplete — TikTok has moved furthest, while Meta, Google, and Snap largely remain on SKAN 3 behavior, which means several of SKAN 4's improvements exist on paper more than in campaign reality.

AdAttributionKit, introduced at WWDC 2024 and expanded at WWDC 2025 with features landing in iOS 18.4, is the designated successor. It keeps crowd anonymity and the postback model but adds configurable attribution windows, overlapping re-engagement windows with conversion tags, and country codes delivered natively — which matters more than it sounds, because previously you burned conversion-value bits encoding geo. For anyone distributing through alternative marketplaces under the EU Digital Markets Act, AAK isn't optional. Apple has published an interoperability model and has announced no deprecation date for SKAdNetwork.

For CPI and app-event campaigns this means your measurement of truth is your MMP — AppsFlyer, Adjust, Singular, Kochava, Branch — reconciled against SKAN postbacks and network-reported numbers, all three of which will disagree. TikTok added real-time iOS conversion reporting through Kochava in October 2025; Reddit launched dual attribution in May 2026 showing postback and partner data side by side. The direction of travel is toward openly showing you the modeled number next to the observed one instead of blending them into a single confident lie.

CPAlead has built its position on mobile app installs with a real-time bidding layer, Mobidea has run mobile smartlinks since 2011 and claims north of 130,000 affiliates, and both make sense as entry points. Just don't bring desktop lead-gen intuitions to iOS and expect them to survive contact.

Read the industry statistics like a hostile witness

I want to spend a section on this because it's where most content in this space quietly falls apart, and because knowing how to read these numbers is worth more than any offer recommendation I could give you.

Ask how big the channel is and you'll get five answers.

eMarketer's September 2025 forecast put US advertiser spend on affiliate at $13.81 billion for 2026, up 11.3% from $12.42 billion in 2025, against US retail ecommerce growth of 6.7%. A different eMarketer vintage, cited widely in 2026 roundups, says $13.20 billion for 2026 against $11.99 billion in 2025. Both are "eMarketer." They're different forecast runs, and outlets cite whichever one they found first. Grand View Research puts the affiliate platform market at $23.8 billion in 2026. Business Research Insights has the global industry just over $20 billion. Various roundups quote $27.78 billion by 2027 at a 15.2% CAGR while others quote 8%.

These are not contradictions. They're different jars.

Advertiser commission spend, platform software revenue, and total ecommerce sales credited to the channel are three unrelated quantities. eMarketer's same forecast attributes roughly $241 billion in US ecommerce sales to affiliate touchpoints in 2026 — a number seventeen times the spend figure, and if you've ever seen those two quoted in the same paragraph as though they measure the same thing, you've seen someone who didn't read the source.

Fraud statistics are worse.

TrafficGuard estimates 10% to 30% of affiliate conversions contain non-incremental or manipulated activity depending on vertical and geo. 24metrics says 15% to 25% of affiliate spend at CPA advertisers is invalid. Fraudlogix's 2026 State of Ad Fraud Report, drawn from 105.7 billion impressions, found a 20.64% global invalid traffic rate with roughly $37 billion in US spend at risk annually. Anura's own data showed about 45% of affiliate interactions lacking genuine engagement. Elsewhere you'll see a flat 17%. Cookie stuffing is variously described as affecting 5% to 10% of affiliate transactions.

Notice who publishes these. Every single one sells fraud detection.

That doesn't make them false. Fraud in this channel is real, it is large, and I've personally caught a partner running a residential-proxy lead farm that would have cost an advertiser six figures. But a vendor's incentive runs one direction, the detection methodology is rarely disclosed, and "invalid traffic" quietly folds together outright bots, non-incremental conversions, and policy violations that harmed nobody. A coupon extension firing a click on checkout is counted in some of these numbers and not others. Those are different problems with different fixes.

The number I'd actually trust more than any of them comes from a different angle. Programs running incrementality tests report that 18% to 24% of attributed conversions would have happened without the affiliate touchpoint at all. Not fraud. Not invalid. Just credit assigned to a partner who didn't cause the outcome. That's a measurement problem, it's larger than most fraud estimates, and almost nobody sells software to fix it — which is precisely why you rarely see it in a stats roundup.

Network-level AI screening does appear to be working on the crude stuff, at least at the big platforms: invalid traffic at Impact, CJ, and Awin reportedly fell from 11.2% of clicks in 2024 to 7.7% in 2026. Chargeback rates tied to fraudulent affiliate signups dropped from 1.4% to 0.7% over a similar period. The bots are getting filtered. Attribution theft is not, because attribution theft looks exactly like a successful partner right up until you test it.

The fraud that actually costs you money

Skip the bot-farm imagery. In 2026 the expensive attacks involve real users completing real purchases.

Attribution hijacking. A partner bids on your brand terms, runs a toolbar or extension, or drops a last-click cookie at checkout on a user who arrived organically. The conversion is genuine. The customer is happy. The advertiser pays a commission on a sale it already had. Google accounts for something like 76.6% of detected hijacking cases in adment.ai's Q1 2026 analysis, with Yahoo and Bing splitting most of the rest — which tells you the attack surface is paid search, not display.

Delayed chargeback fraud. The nastiest one I've seen operationally. A publisher joins, behaves impeccably for six to ten weeks, builds a clean history, then starts driving conversions funded by stolen cards. Everything validates. Commissions pay out. The disputes land sixty days later, after the money is gone. Standard filters never fire because the filters watch clicks and attribution patterns, and the signal was sitting in the billing data the whole time. The only real defense is an abnormal-chargeback-rate alert keyed to source, plus the hold period everyone complains about.

Synthetic lead generation. Scripts filling forms with AI-generated identities or breach-sourced consumer data, sometimes routed through offshore data-entry teams so the behavioral signature reads human. Concentrated in finance, insurance, education, and health — the verticals where a lead is worth $40 to $200 and validation is a phone call that happens days later.

Cloaking. Roughly 45% of affiliate fraud cases in mFilterIt's 2024 analysis involved cloaking to hide policy-violating funnels from compliance review. The advertiser sees a compliant lander. The user sees something else.

Against this, the honest defenses are unglamorous: hold periods matched to the actual reversal-risk window for the vertical, per-source chargeback and refund monitoring, and reason-coded reversals. Track360's framing on holds is the best I've read — 30 to 45 days on an iGaming first-time deposit is defensible because bonus abuse surfaces in that window; 14 to 30 days on a forex FTD or a prop-trading challenge purchase maps to refund policy; a 60-day hold on a crypto deposit that settles on-chain in minutes is a network financing itself with your capital and calling it risk management.

An affiliate whose refund rate sits at 25% against a program average of 5% is telling you something. So is a network that can't produce the reason codes.

Compliance in 2026: the ground moved and most people didn't notice

This section is the one I'd read twice if I were running paid traffic to anything with a recurring charge attached.

The Click-to-Cancel rule is dead. The obligations are not.

On 8 July 2025, the Eighth Circuit vacated the FTC's Rule Concerning Subscriptions and Other Negative Option Plans in its entirety, holding that the Commission failed to follow the procedural requirements of its Magnuson-Moss rulemaking authority. Gibson Dunn brought the case for industry petitioners and won on process, not substance. The vacatur reinstated the original 1973 Negative Option Rule, which only covers prenotification plans.

A lot of operators read that as the coast clearing. It did not.

The Restore Online Shoppers' Confidence Act still requires three things before you can charge anyone through an internet negative-option feature: clear and conspicuous disclosure of all material terms before billing information is collected, express informed consent, and a simple mechanism to stop recurring charges. Section 5 of the FTC Act still prohibits unfair and deceptive practices. The Commission has continued to secure substantial settlements against subscription sellers throughout the gap. FTC Bureau of Consumer Protection Director Christopher Mufarrige used a 5 March 2026 speech to reaffirm the agency's focus on deceptive negative-option subscriptions.

And the rulemaking restarted immediately. The FTC submitted a draft ANPRM to OIRA on 30 January 2026, approved unanimously by the two sitting Commissioners, and issued it publicly on 11 March 2026 with comments due 13 April. There's no draft regulatory text — instead the agency asks whether a new rule is needed at all, whether to modernize the narrow existing rule or write a comprehensive one, and requests extensive industry data on prevalence and cost-benefit, which is a direct response to the procedural defect the Eighth Circuit identified. Substantively the FTC signals the same four pillars: clear disclosure, affirmative express consent, simple cancellation, no misrepresentations in promotion. Kelley Drye noted the branding has quietly been dropped; it's the Negative Option Rule again, not Click-to-Cancel.

Meanwhile roughly thirty states have their own automatic renewal laws, several stricter than the vacated federal rule. California's is the one that matters most by volume, and California's Consumer Protection Division has flagged affiliate marketing in health, weight-loss, and financial verticals as a priority area.

The SCAM Act. On 4 February 2026, Senators Gallego (D-AZ) and Moreno (R-OH) introduced the Safeguarding Consumers from Advertising Misconduct Act. It would require online platforms to take reasonable steps to prevent fraudulent and deceptive advertising, impose advertiser verification requirements, strengthen FTC and state enforcement, and — the provision with teeth — potentially limit Section 230 protection for platforms running paid ads. Richard B. Newman of Hinch Newman, writing for Blue Book, is appropriately skeptical about whether it passes in its current form given that big tech will spend heavily against it. But advertiser verification requirements at the platform layer would reshape how aggressively media buyers can run whitelabel funnels, and that's worth tracking regardless of the bill's odds.

Disclosure liability flows upstream. The persistent misconception is that contracting with independent publishers moves compliance risk off the advertiser's books. It does not, the FTC has said so directly, and advertisers have been held liable for their affiliates' claims. If a partner writes copy implying an endorsement without disclosing material connection, or invents a testimonial, or runs a "doctors are furious" advertorial, the brand owns that exposure alongside the publisher.

The FTC's 2026 enforcement activity has also triggered follow-on private litigation — plaintiffs' firms filing class actions under state consumer protection statutes against publishers who didn't disclose affiliate relationships, arguing consumers made purchase decisions they otherwise wouldn't have.

Lead generation carries a second stack entirely. The Telemarketing Sales Rule's one-to-one consent requirements mean a single consumer consent no longer covers a chain of downstream buyers, and sharing consent across corporate affiliates is treated as a violation. The FTC's "consent farm" theory — deceptive sites that trick consumers into providing phone numbers and consenting to prerecorded calls — has produced actions including a $2.5 million civil penalty and orders requiring destruction of collected data. FCRA applies where lead data touches credit decisions. If you're running finance, insurance, or home-services lead gen, the TSR and TCPA exposure dwarfs anything on the advertising-claims side.

New York's AI disclosure law took effect and is worth a read if you're generating creatives or synthetic spokespeople at scale. The trajectory across jurisdictions is toward disclosure of synthetic media in advertising, and the affiliate channel — which adopted generative tooling faster than almost any other — is squarely in scope.

How I actually vet a network now

After the Tel Aviv incident I built a checklist. It has changed maybe twice in years.

Reputation, weighted properly. mThink's Blue Book has run its survey since 2003; the 2026 edition draws on 20,000-plus performance marketers across 400-plus networks, using an open-field first question specifically to avoid pick-list bias, then weighting against a Blue Ribbon Panel of industry figures. MaxBounty holds the top spot, followed by Perform[cb], ClickDealer, CrakRevenue, and The Affiliati Network. Below them: iMonetizeIt, MaxWeb, AdCombo, Advidi, A4D, Mobidea, Zeydoo, MyLead, CPAlead, RevenueAds, Convert2Media, AdWork Media, Gotzha, Creative Clicks, dr.cash. Blue Book scores reputation, service, and reliability rather than ad spend, and says so — but it also earns affiliate commission on some links and discloses that. Treat it as a well-constructed opinion, which is exactly how mThink frames it.

Then go read Affpaying, where the reviews are unmoderated and frequently furious. A single angry review means nothing; unhappy people are louder. A pattern of the same complaint — late payments, shaved conversions, an AM who went silent — is the signal. Cross-check on STM Forum and AffiliateFix, and search the network name alongside "payment proof" rather than "review," because review pages are gamed and payment threads mostly aren't.

The six numbers that matter, in order.

Effective CPA — total paid divided by total qualifying conversions, which is the only payout figure that reflects reality. Approval rate — what survives validation. Scrub rate with reason codes attached. Hold-to-pay latency, measured as median days from conversion to cleared funds, compared against stated policy. Dispute resolution time, median days from raising an underpayment to correction, which is the cleanest available proxy for network integrity. And cross-network conversion parity — your conversion rate here versus a control network on identical traffic.

That last one is the test almost nobody runs and it's the most informative. Split the same source, same creative, same geo across two networks carrying the same advertiser. If one shows materially lower conversion on identical input, you've found either a tracking defect or a thumb on the scale, and you don't have to prove which to act on it.

Cash flow before payout rate. Minimum thresholds run from $5 at Adsterra to $500 at ClickDealer. Payment frequency spans weekly, bi-weekly, Net-15, Net-30, Net-60 — FlexOffers is Net-60, Perform[cb] is Net-30 standard with Net-15 for top performers and a $500 minimum reflecting its enterprise positioning, MaxBounty pays weekly. New accounts commonly face a 30 to 60 day hold on the first payment regardless of stated terms. Networks advertising daily payouts typically apply a first-payment hold anyway and often run payouts 5% to 20% below Net-30 competitors on comparable offers, because they're financing the acceleration.

A high payout with a bad approval rate is fake. Fast payment with constant scrub is fake. A lower payout with clean weekly settlement is frequently the better business because your payback period is shorter and you can recycle capital.

Treat any network that can't define what triggers a quality hold as Net-45 by default no matter what the contract says. And don't scale until one complete payment cycle has cleared without incident. Send fifty to a hundred conversions, get paid on schedule, then push. That single rule would have saved me the entire March incident.

The stack, briefly

Networks run on a small set of platforms and the choice tells you something. Blue Book's own directory filters by tracking platform and the list is a decent census: TUNE (formerly HasOffers), CAKE, Everflow, Affise, Scaleo, Trackier, Offer18, Alanbase, IREV, Offerslook, AlterCPA, Ringba for pay-per-call, plus a meaningful number running fully in-house.

In-house isn't automatically a warning. ClickDealer, AdWork Media, and others built proprietary platforms specifically to control the publisher experience and the fraud layer, and it shows. It does mean you can't rely on platform-standard behavior for postbacks or reporting, so test more carefully.

On your side, run your own tracker. Voluum, Binom, RedTrack, Bemob — the specific choice matters less than the principle, which is that you need a system of record that isn't the counterparty's. Every serious network supports server-to-server postbacks and sub-ID passthrough. Ask how many sub-ID slots you get and whether they survive the redirect chain, because a network that gives you two is a network where you cannot optimize by placement.

Attribution windows are tightening across the board. The 2026 program survey data shows 38% of programs on 7-day or shorter windows, 41% at 14 to 30 days, and only 21% retaining 60 days or longer. If you're running consideration-heavy verticals where the purchase decision takes two weeks, a 7-day window is a structural pay cut and you should price it accordingly.

Where the money is, and what each vertical really demands

Nutra and COD. Still the volume engine, particularly in tier-2 and tier-3 geos. The model runs on call centers as much as on landers — TerraLeads operates its own centers with native speakers processing something like 50,000 leads daily, which is what makes cash-on-delivery upsell economics work in markets with low card penetration. dr.cash specializes here since 2018; AdCombo has focused on Eastern Europe, South Asia, and LatAm since 2014; MaxWeb runs health and beauty through social and content channels out of Ireland. Payouts land roughly $40 to $100. Compliance risk on claims is the highest in the business.

iGaming and betting. First-time-deposit CPA typically $100 to $500, hybrid and revshare deals standard, licensing requirements that vary by jurisdiction and will get you removed from a market with no notice. Advidi runs premium iGaming, health, and finance out of Amsterdam.

Forex, crypto, prop trading. FTD deals reaching $200 to $800. Heavily regulated in some geos, unregulated in others, and the difference between those two states is where most of the enforcement risk lives.

Finance and insurance lead gen. $50 to $200-plus per qualified lead and the deepest regulatory stack in the channel — TSR, TCPA, FCRA, state licensing, plus one-to-one consent. RPM: Real Performance Marketing focuses on legal, insurance, finance, and home services precisely because the barriers are real.

Sweepstakes, dating, content locking. Lower payouts, faster feedback loops, useful for learning a traffic source. CrakRevenue has run cam, dating, CBD, and gaming for fourteen-plus years. AdWork Media built its reputation on content locking and gateway monetization. iMonetizeIt runs smartlinks across dating, sweeps, and nutra.

Pay-per-call. Structurally the most fraud-resistant model available, because a duration-qualified inbound call is expensive to fake and the recording is the audit trail. Ringba dominates the tracking layer. If you're an advertiser who has been burned repeatedly on form-fill leads, this is the direction to look.

Telehealth. The growth story of the last two years. ClickDealer's CEO Taras Kiseliuk called it in mid-2025 and the volume followed. GLP-1 adjacent funnels, hair loss, ED, mental health — high AOV, recurring billing, and therefore squarely inside every negative-option obligation described above.

Traffic brokers versus audience owners

The most consequential shift in this channel has nothing to do with cookies, and ClickDealer articulated it well enough in July 2026 that I'll build on their frame rather than pretend I got there first.

Two business models sit under the word "affiliate."

Traffic brokers buy media — paid social, native, search arbitrage, push, pop — and route it to advertiser offers. The competitive edge is operational: buy for less than the commission generated, keep the spread. It's a real business, it has produced a lot of wealthy people, and it is structurally fragile, because the broker never owns the user relationship and depends entirely on signals and attribution provided by platforms that keep changing them.

Audience owners build direct relationships. Email lists, membership communities, SaaS tools with logged-in users, loyalty programs, content properties with accounts. The affiliate becomes a publisher with identifiable users.

As attribution moves server-side and first-party, the second group gains structurally. Email addresses, logins, CRM records, and loyalty accounts are identifiers that don't care what Safari does. They enable re-engagement across channels rather than a single monetizable click. Advertisers have noticed and are paying premiums for partners who can deliver deterministic signal instead of anonymous volume.

Arbitrage margins, meanwhile, compress every time a platform degrades targeting or attribution — which is to say, continuously.

I'd add a harder point on top. That 18% to 24% incrementality figure is going to end some partnerships. Programs are already using it to renegotiate commission structures, and the partners who fail an incrementality test are disproportionately the ones intercepting demand near the point of purchase rather than creating it. Coupon and discount publishers took 42.4% of US affiliate revenue in the first half of 2025 per Awin data; cashback and loyalty platforms took the largest share of US affiliate spend in 2024 at 35% per the Performance Marketing Association. Those categories are enormous, they are the most exposed to incrementality scrutiny, and the reckoning has been deferred mostly because nobody wanted to run the test.

Creator affiliates are moving the other direction. Impact's 2026 Partnership Benchmark Report has creators with 10,000 to 100,000 followers generating around $0.42 in attributable affiliate revenue per follower per month against $0.11 for traditional content and display affiliates on an audience-equivalent basis — a 3.7x gap that widens further in beauty, fashion, and gaming.

If you're the advertiser

Different seat, different failure modes. Four things I'd insist on.

Contract for reason-coded reversals in both directions. You want the right to reverse fraudulent conversions with evidence, and your partners want the same visibility. Programs that grant one side and not the other end up with adverse selection in their publisher base — the careful operators leave and the ones who don't read contracts stay.

Run an incrementality test before you renegotiate anything. Geo holdout or partner-level suppression, four to six weeks, and accept the answer even if it's unflattering to a partner you like.

Monitor claims, not just conversions. LashBack and PerformLine exist because the FTC will hold you responsible for what your partners wrote, and you cannot argue that you didn't know if you never looked. Warning letters have gone out to health-plan lead generators; the Consumer Review Rule produced another wave in December 2025.

Watch chargeback rate by partner source as a first-class metric alongside CPA. It is the earliest available signal for the delayed-fraud pattern, and by the time it shows up in your CPA it's already cost you.

A first ninety days that doesn't end in a Telegram apology

Pick two networks, not eight. One generalist with a long reputation — MaxBounty and Perform[cb] both hold up under scrutiny — and one specialist in whatever vertical you actually understand. Apply properly: real traffic sources, real volume estimates, real answers, because the approval interview is a fraud filter and evasive answers fail it.

Before you spend anything, get in writing: hold period for new accounts, what triggers a quality review, reversal reason codes, sub-ID count, and postback specification.

Run one offer to one traffic source until a full payment cycle clears. Not two offers. One. You are testing the network, not the campaign.

Reconcile your tracker against their dashboard daily for the first two weeks and log every discrepancy above 2%. Small consistent gaps are usually redirect loss. Large intermittent gaps are worth a conversation.

Then, and only then, scale — and keep a control campaign running on the second network permanently, because parity data is only useful if you're collecting it before you need it.

What I'd tell you if we were talking instead of reading

This channel rewards paranoia and punishes optimism, which is an unpleasant thing to say about an industry full of genuinely good operators. Most of the people I've worked with over the years were straight with me. The Tel Aviv AM stayed in touch after I stopped running that offer and later sent me a private deal that made back the difference several times over.

But the structure has a thumb on the scale, and the structure doesn't care how nice anyone is. Networks carry credit risk, and credit risk gets pushed downhill toward whoever has the least leverage and the worst information. Your job is to be neither of those things: keep your own system of record, test parity, hold cash for one full cycle before you believe anything, and read the reversal terms before the payout rate.

The measurement environment stopped changing in the direction everyone predicted. Third-party cookies survived in Chrome, the Privacy Sandbox didn't, and server-side postbacks — the ugly, unglamorous plumbing this channel has used since it was tracking PIN submits over carrier billing — turned out to be the thing that lasts. The regulation is tightening on subscription mechanics and consent, not loosening, whatever the Eighth Circuit did to one rule on procedural grounds.

And the partners who win the next decade will look less like arbitrage desks and more like media properties, because owning an audience is the only asset in this business that a platform update can't take away from you.

Sources current as of September 2026. Regulatory items — the FTC's Negative Option ANPRM, the SCAM Act, state automatic-renewal statutes — are moving; verify status before making compliance decisions, and talk to an actual advertising practices attorney rather than an article.