Can you track affiliate referrals across devices?
Sometimes, but not automatically. Cross-device affiliate tracking is possible when a permitted referral signal captured on one device can be associated with the same authenticated customer who later purchases on another. A browser cookie stored on a phone is not normally available to a separate laptop browser. Server-side events alone cannot recover an affiliate click that was never recorded or linked to an account.
For SaaS, the practical strategy is to associate an eligible referral with an authenticated signup, then reconcile that customer or subscription ID to a paid invoice. This approach is conditional on the visitor's consent, the program's attribution rules and the identifiers your systems legitimately hold.
Example: a phone click and a laptop purchase
- A prospective customer clicks a partner's link on their phone. The landing page records the affiliate token only when permitted.
- The visitor creates an account on the phone. Your backend associates the referral token with the newly created internal account ID.
- Two days later, the same person logs into that account on a laptop and starts a subscription checkout.
- Your backend associates the subscription with the account and, where eligible, the stored referral record.
- After the billing provider confirms a successful payment, your commission system calculates the eligible reward once.
If the visitor never creates or logs into the same account, there may be no defensible way to connect the journeys. Do not invent identity matches from an IP address, a similar device or an unconsented tracking technique.
Minimal attribution data model
| Field | Purpose |
|---|---|
| affiliate_id | Identifies the eligible promoter |
| referral_id | Tracks the original eligible referral event |
| account_id | Connects the referral to an authenticated SaaS account |
| attribution_expires_at | Enforces the written window |
| billing_customer_id | Connects the account to Stripe or Paddle |
| invoice_or_transaction_id | Deduplicates the qualifying payment |
| consent_record | Documents applicable tracking and storage permissions |
Keep internal account IDs separate from email addresses and other personal data. Store only what is needed, restrict access and apply retention periods. Your billing provider's customer ID is an accounting reference, not evidence that two anonymous browsers belong to the same person.
Why cookies, server-side tracking and User-ID differ
Cookies can remember a referral within one browser context, subject to expiration, blocking and consent. Server-side attribution records an eligible referral against a backend identity. An authenticated User-ID can help connect activity across devices in an analytics product, but that reporting capability does not by itself grant an affiliate commission or establish contractual attribution.
Google's Analytics User-ID documentation describes signed-in journey analysis across devices, while its policies require notice, appropriate consent and restrictions on personally identifying data. The affiliate ledger must independently follow your program terms. For the underlying comparison, see cookie versus server-side affiliate tracking.
Reconciling Stripe or Paddle subscriptions
For Stripe Billing, persist the relationship between your SaaS account and Stripe customer before relying on invoice payment events. Confirm eligible collected amounts, renewals, refunds and disputes using authenticated billing webhooks. For Paddle Billing, the vendor documents transaction custom_data and its propagation to new subscriptions; test whether your chosen affiliate platform actually reads that mapping.
Build idempotency into every payment-to-commission operation. A duplicate billing notification should not award a second commission. A subscription upgrade should follow the existing partner rule, not silently create a new referred customer. Review Stripe affiliate tracking, Paddle Billing integrations and recurring commissions.
Attribution windows and conflict resolution
Write down whether first-touch or last-eligible-touch attribution wins, when the referral expires and what happens when a second affiliate link or coupon is used. For example, if Alice's referral is captured at signup and Bob's code is entered at checkout, the outcome depends on your published priority rule. The tracking system should enforce that rule consistently across devices.
Do not extend a cookie lifetime or bypass consent merely to improve attribution coverage. Be transparent that some journeys cannot be attributed. A credible program reports unattributed paid conversions separately from partner-attributed revenue.
Cross-device test matrix
- Same account: phone referral, phone signup, laptop login, paid checkout; eligible attribution preserved.
- No login: phone click, unrelated laptop guest checkout; do not claim a reliable match.
- Expired window: account returns after attribution expiry; commission follows the written rule.
- Consent denied: no prohibited storage or tracking; document the expected outcome.
- Different account: referral captured on account A but payment made by account B; avoid automatic merging.
- Multiple partners: link and code conflict; enforce the documented priority.
- Refund and retry: adjust commission once, with event IDs and audit history.
Run tests in the exact signup and billing paths used by customers, including free trials and annual plans. Do not promise 100% cross-device recovery.
Frequently asked questions
Can first-party cookies track a customer on another device?
Not on their own. A first-party cookie is generally scoped to a browser context; an authenticated account relationship may allow a permitted referral to be carried into a later session.
Does Google Analytics User-ID automatically credit affiliates?
No. Analytics identity stitching and affiliate commission attribution are separate systems with different rules.
What if the visitor never signs in?
Without another legitimate, documented linking signal, cross-device attribution may be impossible. Report that limitation rather than manufacturing a match.
Official sources and editorial disclosure
Documentation checked 24 October 2026. This article describes a recommended architecture and illustrative test cases, not hands-on testing of a specific affiliate vendor. See our research method and affiliate disclosure.