CodeWisdom

Affiliate Tracking Cookies: CJ Affiliate, Rakuten, and Last-Click Attribution

•2 min read•Web Development

Affiliate networks (CJ Affiliate, Rakuten/Impact) track purchases using URL parameters and cookies. When you click an affiliate link, the merchant stores a cjevent or ranSiteID cookie tied to the publisher's ID. At checkout, the merchant reads that cookie and credits the commission. Last-click attribution means the most recent affiliate link click wins — later clicks overwrite earlier cookies.

cookieshttpaffiliate-tracking

How affiliate tracking works

When you click an affiliate link (from a cashback portal like Rakuten or a travel rewards portal like Aeroplan), the merchant's page receives tracking parameters in the URL. The merchant's JavaScript reads those parameters and stores them as cookies. When you complete a purchase, the checkout process reads those cookies to identify which affiliate referred you — and the affiliate network credits the commission accordingly.

1. User on Aeroplan shopping portal clicks "Shop Dell"
   → Link includes: cjevent=95b7ea5f...&publisherid=2387317&aff_user_id=xid-fr...

2. Dell page loads, merchant JavaScript reads URL params:
   → Stores cjevent_dc=95b7ea5f... as a cookie on dell.com

3. User browses and adds items to cart

4. User checks out:
   → Dell's order system reads cjevent_dc cookie
   → Reports sale to CJ Affiliate with the cjevent ID

5. CJ looks up cjevent 95b7ea5f... → publisher 2387317 (Aeroplan)
   → Credits commission to Aeroplan's account

6. Aeroplan credits points to the user's account

CJ Affiliate URL parameters

CJ Affiliate (Commission Junction) uses these parameters when a publisher sends a user to a merchant:

| Parameter | Example | Meaning | |---|---|---| | cjevent | 95b7ea5fad0f11ef824203d80a1cb828 | Unique click event ID — identifies this specific click | | cjdata | MXxOfDB8WXwxNzM1MzM4NzkxOTc0 | Base64-encoded consent data (version, consent type, timestamp) | | publisherid | 2387317 | Publisher's CJ account ID (Aeroplan = 2387317) | | affid | 2387317 | Same as publisherid — publisher's affiliate ID | | aff_webid | 3010858 | The specific website/property within the publisher's account | | aff_user_id | xid-fr1732746785298adg | Publisher-assigned user ID (opaque to the merchant) | | VEN1 | 15426217-3010858-xid-fr1732746785298adg | Composite: publisherSiteId-webId-userId | | dgc | CJ | Network identifier (CJ = Commission Junction) |

The cjdata value MXxOfDB8WXwxNzM1MzM4NzkxOTc0 decodes (base64) to 1|N|0|Y|1735338791974 — version, consent type, consent value, flag, and epoch timestamp in milliseconds.

The cookies stored on the merchant's domain after the click:

cjevent_dc: 95b7ea5fad0f11ef824203d80a1cb828  ← the click event ID
cjConsent:  MXxOfDB8WXwxNzM1MzM4NzkxOTc0      ← consent data from URL
cjUser:     b1d69e57-d89d-4fcf-83b0-f8932dda6cf8  ← anonymous CJ user ID
dellven:    15426217-3010858-xid-fr...          ← publisher attribution

Rakuten/Impact URL parameters

Rakuten uses the Impact network, which has different parameter names:

| Parameter | Example | Meaning | |---|---|---| | ranMID | 36311 | Merchant ID in the Rakuten/Impact network | | ranEAID | OXchfjbB*6A | Publisher/affiliate ID (encoded) | | ranSiteID | OXchfjbB.6A-L_V2gZ8hDXnjPyOtZ.cMZQ | Site-specific tracking ID (affiliate ID + click hash) | | siteID | same as ranSiteID | Duplicate for compatibility | | utm_source | Ebates+Canada | Identifies Rakuten's property (Ebates = Rakuten's cashback brand) |

Both Dell and Dyson use CJ or Impact as their affiliate network. When you shop through Aeroplan, the aff parameter shows Aeroplan+Inc. and publisherid=2387317. When you shop through Rakuten, it shows Ebates+Canada+Inc and publisherid=4361162.

Cookie mechanics

Affiliate cookies are scoped to the merchant's domain (e.g., dell.com), not the affiliate network's domain. The merchant drops them using JavaScript when the page loads with tracking parameters:

// Pseudocode — what the merchant's tracking script does
const params = new URLSearchParams(window.location.search);
const cjevent = params.get('cjevent');
if (cjevent) {
    // Typically 30-day expiry — the attribution window
    document.cookie = `cjevent_dc=${cjevent}; domain=.dell.com; max-age=2592000; SameSite=Lax`;
}

The merchant controls cookie expiry — 30 days is standard for CJ. Rakuten's ranSiteID cookies typically last 30–45 days. If no purchase happens within the attribution window, the cookie expires and the affiliate gets no credit.

Last-click attribution: the most recent affiliate click overwrites earlier cookies and wins the commission

ConceptAffiliate Marketing / Web Tracking

If a user clicks an Aeroplan link to Dell (sets cjevent_A), then later clicks a Rakuten link to Dell (sets cjevent_B on the same dell.com domain), the second click overwrites cjevent_A. When the user buys, Dell reads cjevent_B and credits Rakuten. Aeroplan gets nothing despite the earlier referral. This is last-click attribution — standard in affiliate marketing but contested. Multi-touch attribution models exist but are rare outside large advertisers with custom setups.

Prerequisites

  • HTTP cookies
  • cookie scoping
  • attribution windows

Key Points

  • Each affiliate click overwrites the previous tracking cookie on the merchant's domain.
  • 30-day attribution window: if no purchase within 30 days of click, cookie expires and affiliate gets nothing.
  • aff_user_id is the affiliate's internal ID for the user — Aeroplan uses it to credit points to the right member.
  • Cookie is on the merchant domain (dell.com), not the affiliate network — the merchant decides whether to honor it.

A user clicks an Aeroplan link to Dell at 9am (stores cjevent_A). At 2pm they click a Rakuten link to Dell (stores cjevent_B). At 5pm they buy a laptop on Dell. Which affiliate gets the commission?

easy

Affiliate cookies on the same domain overwrite each other. Standard last-click attribution.

  • AAeroplan — they referred the user first
    Incorrect.First-click attribution would credit Aeroplan, but most affiliate networks use last-click attribution. The 9am cjevent_A cookie was overwritten by the 2pm Rakuten click.
  • BRakuten — the 2pm click overwrites the 9am cookie, and last-click attribution credits whoever set the most recent cookie
    Correct!Both clicks store cookies in the same dell.com domain under the same cookie name (cjevent_dc). The second write overwrites the first. Dell's checkout reads cjevent_B, which maps to Rakuten's publisher ID. Rakuten is credited. Aeroplan's click is not recorded in the purchase event.
  • CBoth — the commission is split proportionally
    Incorrect.Commission splitting requires multi-touch attribution, which must be configured explicitly by the merchant. The default in affiliate networks is last-click: one winner.
  • DNeither — the user used two different affiliate portals so the sale is flagged as unattributed
    Incorrect.Multiple affiliate clicks don't cancel each other. The most recent click wins under last-click attribution.

Hint:What happens to a cookie when a second write uses the same name on the same domain?