Every deposit your traffic drives passes through one fragile checkpoint before it becomes commission: the attribution event. Get the plumbing wrong and the money still moves, it just moves to the wrong affiliate ID, or it never fires at all. On a program pushing real volume that leak is not a rounding error. A 5% attribution error on a program processing 500,000 GBP per month means 25,000 GBP every month routed to the wrong place, month after month, until someone audits the pixel. This is the tracking layer written for practitioners: from the postback fire to the sub-ID schema, for media buyers who treat attribution as a revenue system rather than an afterthought.
If you already have your commercial terms mapped out, the tracking stack is what turns those terms into paid revenue. It sits directly on top of the numbers you watch in your daily affiliate KPI dashboard (Key Performance Indicator), and it decides whether those numbers are real.
Why S2S postbacks replaced the cookie
Server-to-server (S2S) postback tracking is now the default for regulated affiliate programs, and the reason is structural, not fashionable. The browser is no longer a trustworthy witness. Cookie-based attribution asks the visitor’s browser to remember which affiliate sent them, then report that memory back at conversion. That memory keeps getting wiped.
Apple ITP (Intelligent Tracking Prevention) in Safari deletes third-party cookies within 24 hours, which makes cookie-based attribution unreliable the moment a session crosses from browser into a native app. In iGaming that crossing is the norm, not the edge case: a player clicks your creative in a mobile browser, then completes registration and deposits inside the operator’s downloaded app. The cookie that tied the click to the affiliate is already gone. The deposit lands unattributed, and your commission evaporates with it.
S2S removes the browser from the attribution decision entirely. Instead of trusting a cookie, the tracker stores the click server-side against a unique Click ID, and the operator fires a server call back to the tracker when the conversion happens. No browser storage, no ITP, no ad blocker in the path. That is why S2S postback tracking has become the industry standard for regulated programs: it is the only method that survives the modern privacy stack intact.
Anatomy of a postback: click storage, conversion, S2S fire
Strip away the jargon and a postback is a three-step handshake. Understanding each step tells you exactly where attribution breaks when it breaks.
| Stage | What happens | Where it lives |
|---|---|---|
| 1. Click storage | Visitor clicks your link. The tracker generates a unique Click ID and stores it server-side with your affiliate ID, sub-IDs, timestamp and device data. | Your tracker |
| 2. Handoff | The Click ID travels to the operator inside the redirect URL and is held by the operator against that user’s account. | Redirect to operator |
| 3. S2S fire | User registers or deposits. The operator’s server calls your postback URL, passing back the stored Click ID plus the event type and payout. | Operator server to your tracker |
The Click ID is the spine of the whole system. If it is not captured at step one, or not passed through at step two, the postback at step three has nothing to match against and the conversion floats free. Most attribution failures are not exotic. They are a Click ID that got dropped somewhere in that redirect chain, which is why a clean postback flow matters more than any single reporting feature you will ever compare.
First-click, last-click and multi-touch: pick your model on purpose
Attribution is not just plumbing, it is a choice about who gets paid for a conversion that had several touches. Last-click is the default model across most affiliate platforms and the de facto standard in iGaming, meaning the final affiliate before the deposit takes the credit. That default is not neutral. It quietly decides which of your channels looks profitable.
The mechanics are simple once you see the incentive baked in. Last-click favours retargeting and bottom-funnel placements, while first-click favours discovery such as organic content and search. If you run last-click and also run a content operation, your top-of-funnel work subsidises your retargeting numbers and looks weak on paper. Flip to first-click and the reverse happens. Neither number is a lie, they are answers to different questions.
Multi-touch attribution splits credit across the touches, which is honest but heavier to operate and only worth the effort when a single player genuinely meets several of your properties before converting. For most buyers the practical move is to know which model your operator runs, price your media against that model, and never compare a first-click campaign to a last-click one as if the reported cost per acquisition (CPA) were the same currency. This is the same distinction that decides whether your acquisition cost benchmarks by channel mean anything when you line them up side by side.
Lookback windows: matching the clock to the intent
The lookback window is how long a click stays eligible to earn a conversion. Set it too short and legitimate deposits fall outside the window and go unpaid. Set it too long and you claim credit for players who found the operator by other means, which is exactly the kind of over-attribution that gets an affiliate’s payouts audited and clawed back.
The window should track the buying intent of the traffic, not a single house number applied everywhere. Sensible lookback ranges run from 1 to 3 days for incentive and coupon traffic, 7 to 14 days for organic content, and up to 30 days for high-consideration decisions.
| Traffic type | Typical window | Why |
|---|---|---|
| Incentive, coupon | 1 to 3 days | Intent is immediate. A long window here mostly claims unrelated deposits. |
| Organic content, SEO | 7 to 14 days | Readers research, leave, and return. The decision takes days, not minutes. |
| High-consideration | up to 30 days | Larger commitment, longer path. A short window under-credits genuine influence. |
These are orientation ranges, not rules. The right window varies by GEO (geographic market), by operator terms, and by the traffic type you actually run, so treat the table as a starting point and negotiate the window into your deal rather than accepting whatever default the platform ships with. If you lean on search-driven discovery, the longer windows matter more, which is one reason the payback maths behind SEO as an iGaming acquisition channel only closes when attribution is set to capture a slower decision.
Sub-ID schemas: turning one postback into dimensional analysis
A postback that only tells you a conversion happened is worth very little. A postback that tells you which source, which creative, which placement and which device produced that conversion is a decision engine. Sub-IDs are how you carry those dimensions from click to conversion so they survive into your reporting.
Scaleo, for instance, supports SubID tracking across five parameters, sub1 through sub5, that persist through the conversion. Broader tracking stacks push further: platforms commonly handle up to 10 sub-IDs in the postback with automatic merging of parameters so the values you set at click time reassemble cleanly at conversion. A disciplined schema might map sub1 to traffic source, sub2 to campaign, sub3 to creative, sub4 to placement and sub5 to device, giving you a five-dimensional cut of every deposit without touching the operator’s reporting.
You do not fill those slots by hand. Voluum drives them with a token system, tags like {campaignid}, {traffic_source.name}, {lander.id}, {offer.id} and {cost} that populate the sub-IDs dynamically as each click flows through. Set the tokens once and every click self-labels. That is what lets you answer “which creative on which placement drove FTDs in this GEO” from your own dashboard instead of guessing. Feed those cuts back into your view of which traffic sources actually convert to depositing players and the schema stops being bookkeeping and starts being budget allocation.
FTD tracking versus registration-only: the optimisation clock
Registrations feel like progress. They are not revenue. The event that matters is the First Time Deposit (FTD), and whether your tracking fires on the FTD in real time decides how fast you can steer. Without a real-time FTD postback, a media buyer waits 24 hours or more to see which creatives are actually producing deposits. In a fast auction that lag is the difference between killing a losing creative before lunch and paying for it all day.
Real-time FTD tracking collapses the loop. When the deposit postback lands within seconds, you can pause the ad set that is buying registrations but no deposits, and scale the one quietly printing FTDs, inside the same session rather than the next morning. The registration count is a vanity metric that hides the only question that pays your invoice: did the player fund the account. Wiring optimisation to the FTD event, not the signup, is what separates buyers who feel busy from buyers who feel the compounding, and it is the input that makes your player lifetime value modelling trustworthy, because lifetime value starts at the first deposit, never at the signup.
Cross-device attribution without cookies
The player journey rarely stays on one screen. A very common path is a click on mobile followed by a deposit on desktop, and that click and that deposit have to resolve to the same affiliate or you have paid for traffic you will never be credited for. Cookies cannot do this. A cookie set in a mobile browser knows nothing about a desktop session hours later.
S2S with a server-stored Click ID is what makes cross-device attribution possible at all. Because the identity lives on the tracker rather than in a single browser, the operator can reconcile a deposit to the originating click across devices through the account the player creates. For any buyer running mobile discovery into desktop conversion, and that is most of the market, cross-device is not a nice-to-have, it is the difference between your reported and your real cost per acquisition.
Postback configuration and the Click ID flow
Configuration is where good theory dies quietly. The single most common failure is a Click ID that is generated but never passed into the operator’s redirect, so the postback comes back with nothing to match. Before you scale spend on any new operator, run a test conversion end to end and confirm the exact Click ID you generated appears in the postback the operator fires back. If it does not round-trip cleanly on one test, it will not round-trip on a thousand real deposits.
A working configuration checklist for a new integration looks like this:
- Confirm the tracker generates a unique Click ID on every click and stores your affiliate ID and sub-IDs against it.
- Confirm the Click ID is inserted into the redirect URL that hands off to the operator.
- Confirm the operator captures and holds that Click ID against the player account.
- Confirm the operator’s postback URL fires on the FTD event and passes back the same Click ID, event type and payout value.
- Run one live test deposit and verify the conversion appears in your tracker with the correct sub-IDs attached.
Only after that round-trip passes should real budget go behind the offer. Skipping this step is how buyers discover, three weeks and a large spend later, that their best campaign was never being tracked at all. The same discipline applies when you launch paid traffic, because running compliant paid ads for iGaming depends on measurement that survives ad-platform review as much as it depends on the creative.
Custom tracking domains and platform selection
One configuration detail pays for itself immediately. Routing your tracking through a custom branded tracking domain, set up with a CNAME (Canonical Name) record on a domain you control, improves approval rates on advertising platforms because your links no longer share a flagged, well-known tracker hostname that ad reviewers have learned to distrust. If you buy on platforms with strict review, a branded domain is one of the cheapest reliability upgrades available.
Platform choice is the last major decision, and it comes down to how your operation is shaped rather than a leaderboard. Voluum tends to fit single-network operations that lean on heavy A/B testing, while RedTrack fits multi-network operations that run aggressive sub-ID segmentation. Neither is universally better. If you push one network hard and iterate creatives constantly, Voluum’s testing depth earns its keep. If you run many operators at once and need granular sub-ID cuts across all of them, RedTrack’s segmentation is the better tool. Affise and Scaleo occupy adjacent ground for programs that want operator-side management alongside tracking.
Match the tool to the shape of your business, and match your commission structure to your tracking before you scale, because the value of any of this depends on whether you run CPA, RevShare or a hybrid deal. A RevShare program that cannot attribute cross-device is leaking recurring revenue on every mismatched session, and a CPA program with a sloppy FTD postback is paying, or failing to collect, on events it cannot verify.
Frequently asked questions
What is an S2S postback in iGaming affiliate tracking?
An S2S (server-to-server) postback is a server call the operator sends to your tracker when a tracked event happens, such as a registration or a First Time Deposit. It passes back the unique Click ID your tracker stored at click time, plus the event type and payout. Because it runs server to server, it does not depend on browser cookies, which is why it survives Apple ITP and works when a player moves from a mobile browser into a native app.
Why is cookie-based attribution failing for iGaming affiliates?
Cookies rely on the visitor’s browser to remember and report the referring affiliate, and that memory is increasingly wiped. Apple ITP in Safari removes third-party cookies within 24 hours, and cookies set in a browser cannot follow a player into a downloaded app or onto a second device. Since iGaming journeys routinely cross from browser to app and from mobile to desktop, cookie attribution drops a large share of genuine deposits.
How should I set my lookback window?
Match the window to the intent of the traffic rather than using one number everywhere. Incentive and coupon traffic usually sits at 1 to 3 days, organic content at 7 to 14 days, and high-consideration decisions can justify up to 30 days. These are orientation ranges that vary by GEO, operator and traffic type, so confirm the window in your deal terms rather than accepting the platform default.
Should I choose Voluum or RedTrack?
It depends on the shape of your operation, not on a single winner. Voluum suits single-network buyers who run heavy A/B testing and want deep testing tools. RedTrack suits multi-network buyers who need aggressive sub-ID segmentation across many operators at once. Whichever you pick, route tracking through a custom branded domain to lift approval rates on ad platforms, and always verify a live test conversion round-trips before scaling spend.
