Phoebe Gates’ startup Phia is accused of secretly inserting affiliate tracking cookies into customers’ checkout sessions, a practice Bloomberg says the founders knew about months earlier and that an attorney warns can be prosecuted as federal wire fraud.

Phoebe Gates, 23, and co-founder Sophia Kianni face allegations that their browser-extension startup Phia took credit for online sales it did not generate. Bloomberg reports internal Slack messages show the founders were aware of and managed the cookie drops, a tactic often called cookie stuffing.

The scheme allegedly let Phia claim commissions on purchases at major retailers including Nike, Gap, and Nordstrom even when customers never used a Phia coupon. That is the core of the accusation: affiliate tracking cookies were being injected into checkout sessions to attribute sales to Phia.

A December 18 Slack message from Gates is central to the reporting; it pressed engineers to confirm the feature was active across partner sites. The message appears aimed at maximizing what the company labeled as monetization tied to “GMV,” or gross merchandise value.

“worried this is an issue across the board…can u confirm auto pop for cookie drop is live on ALL sites w a coupon to confirm we are monetizing on all gmv.”

The internal note suggests deliberate action rather than an accidental bug, since it asked for confirmation that the cookie drop was live everywhere. The phrase “monetizing on all gmv” underlines the financial motive behind ensuring the mechanism ran across partner sites.

Kianni reportedly proposed expanding the tactic by dropping a cookie when a user tried to close a Phia pop-up, effectively hijacking the dismiss action to trigger affiliate attribution. A colleague warned that Google Chrome policy prohibits dropping cookies on dismiss events, and Kianni’s suggested response signaled an intent to work around complaints.

“I guess we could say that the user is trying to open us and roll it back if they complain.”

A Phia spokesperson told Bloomberg that the dismiss-event feature was never implemented, a claim that has not been independently verified. The report says the founders were aware of the cookie-drop functionality for at least seven months before the company publicly called it a “glitch.”

By June, the reporting says cookie stuffing accounted for roughly 51 percent of the merchandise value Phia claimed credit for selling. That level of alleged inflation would have a major impact on the startup’s reported performance and the commissions it collected.

When the issue became public in July, Phia initially said it had only learned of the problem “within the last 24 hours” and promised to fix a glitch. Internal Slack messages reviewed by Bloomberg, however, indicate awareness stretching back to December, which contradicts the public timeline.

What the company labeled a software bug appears in internal tools as a feature called “enable coupon auto drop” that could be switched on or off. The distinction matters because a toggle implies intentional control rather than accidental behavior.

Phia disabled the features on July 7, and the effect on revenue was immediate: average daily income reportedly fell from about $80,000 to between $10,000 and $28,000. A company spokesperson attributed part of the decline to disabling other monetization and said Bloomberg’s revenue analysis was overstated.

Impact.com, the affiliate network Phia used, suspended the startup’s account and reallocated commissions that had been reserved for Phia. Brands that relied on Phia to send real customers were left to untangle which sales were legitimate and which were misattributed.

Attorney Ariel Givner, founder of Givner Law, posted a warning on X about the potential legal exposure tied to cookie stuffing and the use of electronic channels to misattribute transactions.

“It’s typically treated as federal wire fraud in US courts. There’s a possibility of a max penalty of up to 20 years prison + fines/restitution.”

No criminal charges have been announced, and no public government investigation is known at this time. Still, federal wire fraud statutes cover schemes that employ electronic communications across state lines, which is why legal analysts see a clear risk in these allegations.

The case arrives against a backdrop of other high-profile fraud prosecutions that showed elite status does not guarantee immunity. That context feeds debate about whether well-connected founders face the same consequences as other defendants when allegations of deliberate deception arise.

Phia raised $30 million in 2025 from a list of celebrity investors that included Hailey Bieber, Kris Jenner, and Spanx founder Sara Blakely. Gates has said she wanted to succeed without her billionaire parents’ help and has expressed a desire to prove herself, while her father, Bill Gates, is listed with a net worth of $108.4 billion.

The internal messages cited in the reporting suggest the activity was not the result of a lone engineer acting on their own. Gates asked for confirmation that cookie drops were live, Kianni pushed to expand the mechanism, and a suggested workaround to complaints was discussed internally.

Phia issued a statement saying it removed features that caused misattributions and that it is reviewing transactions and issuing reversals to brand partners while hiring a head of compliance to prevent a recurrence.

“Any features causing misattributions were immediately removed over a month ago on July 7. We are reviewing every transaction, we are fully committed to and have already begun issuing all transaction reversals to brand partners as a result of any misattribution, and we are hiring a head of compliance to make sure something like this never happens again.”

The company adds it continues to connect users with thousands of brand partners and plans new features, but key questions remain unanswered. The total dollar value of commissions tied to the alleged cookie stuffing has not been disclosed, and the precise scope and duration of Impact.com’s suspension are unclear.

Whether federal prosecutors or regulators will open a formal inquiry hinges on whether they see enough evidence to proceed, and whether connections tied to the founders influence how quickly—or slowly—official action follows. The Slack messages and transaction records are now the central items authorities, if any, would want to examine.