PayPal Honey was built around a simple proposition: install a browser extension, let it look for coupons at checkout, and save money without having to hunt for discount codes yourself. Behind that convenience, however, sits a much more complicated system involving browser cookies, affiliate IDs, merchant contracts, attribution rules and affiliate networks.
That system is now at the center of a major legal and technical dispute.
The controversy began publicly in December 2024, when researcher and YouTuber MegaLag alleged that Honey was interfering with affiliate attribution and redirecting commissions that would otherwise have gone to creators. The allegations later expanded into a more technically significant claim: that Honey allegedly had mechanisms for selectively complying with affiliate-network “stand-down” rules when it appeared that the browser was being used by an auditor or tester.
The allegations are disputed, and they remain allegations rather than a judicial finding that PayPal is liable. But the litigation has moved considerably since the first complaint. On June 22, 2026, U.S. District Judge Beth Labson Freeman denied PayPal’s motion to dismiss the second amended complaint in In re PayPal Honey Browser Extension Litigation. The ruling allows the case to proceed and, importantly, found that the amended complaint plausibly alleged concrete injuries to the named plaintiffs.
At the same time, Honey faced action from major affiliate networks. Rakuten Advertising terminated Honey from its network in January 2026, while Awin said its investigation confirmed breaches of its publisher policies and Impact.com also took action against Honey.
The technical details matter because this dispute is not simply about whether a coupon extension “takes the last click.” The central question is whether software that is supposed to participate in an affiliate ecosystem was allegedly manipulating the very tracking mechanism used to determine who deserved credit for a sale.
How the affiliate system is supposed to work
To understand the Honey dispute, it helps to start with the mechanism underneath affiliate marketing.
An affiliate marketer might publish a review of a laptop and include a merchant-specific affiliate link. That URL contains an identifier associated with the affiliate. When a reader clicks the link and reaches the merchant’s website, the merchant or affiliate network can store that identifier in a cookie or another tracking mechanism.
A simplified transaction looks like this:
Creator’s affiliate link → merchant website → affiliate ID stored → customer purchases → merchant reads attribution data → commission assigned
📬 Stay Ahead of Cyber Threats
Get the latest cybersecurity news, critical vulnerabilities, threat intelligence, tutorials, and exclusive giveaways delivered straight to your inbox. No spam. Unsubscribe anytime.
Subscribe to the Newsletter →The affiliate ID is not merely a random piece of browser data. It is the mechanism that connects a particular referral to a particular affiliate.
The federal court’s June 2026 order describes the process in similar terms. Affiliate links contain unique affiliate identifiers, which can be stored in browser cookies. At checkout, those identifiers are used to determine which affiliate receives credit for the transaction. The court also noted that last-click attribution is widely used in the industry.
That creates an important technical property: the identity of the affiliate can change before the purchase is completed.
If Creator A sends a shopper to a merchant, the browser may initially contain Creator A’s affiliate ID. If another legitimate affiliate referral subsequently occurs, the later referral can replace the earlier attribution. Under a last-click model, that later affiliate can receive the commission.
That is not inherently fraudulent. Last-click attribution is an established model.
The controversy begins when a browser extension allegedly changes that identifier without providing the type of referral activity required by the applicable affiliate agreement.
What “stand down” means
Affiliate networks commonly impose restrictions on browser extensions and similar technologies.
One such restriction is a stand-down rule. In simple terms, if an affiliate ID is already present because another publisher has referred the customer, an extension may be prohibited from intervening and creating another affiliate interaction that overwrites the existing attribution.
The reason is straightforward.
Suppose a technology reviewer spends hours creating a review, persuades a reader to click the affiliate link and sends that reader to a retailer. The reader reaches the checkout page. A coupon extension then appears and creates a new affiliate referral without materially contributing to the original customer acquisition.
If the new referral replaces the original affiliate ID, the extension can become the final click even though the creator generated the customer.
The court’s description of the contractual framework is particularly important here. The second amended complaint alleged that affiliate agreements entitled publishers to commissions when their links generated qualifying purchases, while stand-down provisions prohibited browser extensions from engaging in behavior that would overwrite an existing affiliate ID.
That distinction is at the heart of the lawsuit.
The alleged Honey mechanism
According to the allegations incorporated into the second amended complaint, Honey could use a hidden browser interaction during checkout that plaintiffs call a “Secret Tab.”
The complaint alleges that when a consumer interacted with Honey at checkout, the extension could open a hidden tab for a short period and cause Honey’s affiliate identifier to replace an existing affiliate identifier. The resulting attribution would then point to Honey rather than the affiliate that had originally referred the customer.
Technically, this is significant because the extension does not need to break into the merchant’s server to affect attribution. The browser is already part of the tracking chain.
A browser extension operates inside the user’s browser environment and can interact with web pages and browser state subject to the permissions and APIs available to it. Affiliate systems frequently rely on browser-side identifiers, cookies, URL parameters, tracking tags and related mechanisms. Altering the relevant browser-side state can therefore change what the merchant or affiliate network ultimately sees.
The complaint alleges that the Honey process could overwrite the existing affiliate ID and thereby cause the merchant’s attribution system to recognize Honey as the source of the sale.
There is another important allegation. The plaintiffs claim the behavior could occur even when Honey did not actually provide a coupon or cashback reward, including situations in which the Honey interface was dismissed.
That matters because the economic justification for Honey receiving a commission becomes much harder to explain if the extension allegedly receives attribution without providing the activity that the affiliate agreement requires.
Again, these are allegations in the litigation. The June 2026 ruling did not determine that every alleged transaction occurred exactly as described. It determined that the amended complaint had pleaded enough facts for the claims to proceed.
The more unusual allegation: detecting the tester
The technically more interesting part of the dispute concerns what researchers described as a “defeat device.”
The allegation is not simply that Honey sometimes failed to stand down.
It is that Honey allegedly had mechanisms capable of distinguishing ordinary consumers from people who were more likely to be testing the extension for affiliate-network compliance.
That difference is crucial.
A conventional compliance failure would look something like this:
Consumer arrives → Honey fails to stand down → affiliate ID gets overwritten
A selective compliance mechanism would look very different:
Identify user → evaluate signals → estimate whether user is a tester → comply or bypass stand-down
The second behavior is potentially much harder to detect through conventional testing because the system could behave correctly when it believed someone was watching.
The second amended complaint alleges four categories of signals used to determine whether Honey should stand down. They included account age, Honey reward points, merchant-specific rules or blacklists, and indicators associated with visits to affiliate-network websites.
Research published by Ben Edelman independently discusses the selective-stand-down configuration and changes to the thresholds over time. Edelman reported that historical configurations differed substantially from later settings, including changes to the points threshold.
The technical implication is more important than any individual threshold.
A compliance tester normally tries to reproduce a consumer transaction and determine whether the extension respects the network’s rules. If software can identify characteristics associated with testing and then alter its behavior, a conventional test may produce a false negative.
In other words, the tester sees:
“Honey follows the rules.”
The ordinary customer may see:
“Honey behaves differently.”
That is why the selective-stand-down allegation is considerably more consequential than a simple dispute over affiliate attribution.
The role of cookies and browser telemetry
The alleged mechanism also illustrates why browser extensions can have enormous influence over web advertising infrastructure.
A modern affiliate transaction can involve several layers of state:
- the URL used to reach the merchant
- affiliate identifiers
- cookies
- local browser state
- tracking parameters
- merchant-side attribution systems
- affiliate-network records
- server-side transaction data
The browser sits between many of these components.
When an extension has permission to interact with pages and browser state, it can potentially observe or influence events that occur during navigation and checkout. That does not mean every extension does so maliciously, nor does installing an extension automatically authorize every possible action. It means that the browser becomes an important security and trust boundary.
The lawsuit specifically alleges that Honey could interact with affiliate identifiers stored in the browser and overwrite them. The court accepted that allegation as sufficiently plausible at the motion-to-dismiss stage.
That is a significant distinction from saying the court has already found the allegations proven.
Why the “0.1%” claim became controversial
After the allegations became public, PayPal said the code responsible for the behavior had been identified and deactivated. PayPal also said the code predated its acquisition of Honey and appeared to affect less than 0.1% of Honey’s traffic.
That statement leaves an important technical question: what does “traffic” actually measure?
A very small percentage of total users can still represent nearly all of the users capable of detecting a compliance problem.
Affiliate-network auditors and researchers are not a random sample of Honey’s user base. They are specifically the people most likely to test affiliate attribution, inspect browser behavior and investigate whether stand-down rules are being followed.
Ben Edelman made essentially this point in his response to PayPal’s statement. He argued that the relevant issue was not simply how many Honey users belonged to the affected category, but whether the system was designed to distinguish people likely to test it from ordinary shoppers.
That is why the percentage alone does not resolve the technical question.
If 0.1% of users are the only users capable of reliably detecting the behavior, affecting 0.1% of users can still undermine the effectiveness of compliance testing.
PayPal’s acquisition of Honey adds another layer
PayPal acquired Honey for approximately $4 billion in 2020. The acquisition itself is documented in the federal court’s description of the case.
PayPal has said the code at issue was implemented before the acquisition.
That is an important fact, but it does not automatically resolve what happened afterward.
Research cited in the dispute indicates that Honey’s selective-stand-down configuration changed after the acquisition. Edelman reported that earlier configurations and later configurations used different thresholds, including a much higher points threshold in the later configuration.
That makes the legal and technical history more complicated than a simple “old code versus new owner” narrative.
The relevant questions for discovery are likely to include who knew about the system, what the system was intended to do, who modified its configuration, when those modifications occurred, what affiliate networks reported, and what internal records exist showing how the system operated over time.
Those questions cannot be answered conclusively from public allegations alone.
Affiliate networks eventually acted
The dispute eventually moved beyond online criticism and litigation.
Rakuten Advertising terminated Honey from its affiliate network in January 2026. Reporting at the time said the move removed Honey from thousands of merchant relationships connected through the network.
Awin subsequently announced that its investigation had confirmed breaches of its publisher policies. The company said it suspended payments and access to new advertiser programs while Honey entered a remediation process.
Impact.com also removed Honey from its Discovery marketplace and temporarily suspended its account while it confirmed corrective changes, according to reporting on the industry’s response.
These actions are important because affiliate networks are not merely advertising directories. They sit between merchants and publishers, establish contractual frameworks and help administer attribution and payments.
A dispute over whether an extension respects stand-down rules therefore reaches directly into the infrastructure that determines who gets paid.
The litigation changed significantly in 2026
The legal history is worth following carefully because earlier reporting can easily give the wrong impression.
The first amended complaint did not survive PayPal’s motion to dismiss. On November 21, 2025, Judge Freeman dismissed that complaint because the plaintiffs had not adequately established Article III standing. In particular, the court found deficiencies in the allegations connecting the claimed lost commissions to PayPal’s conduct and in the allegations showing that plaintiffs were actually entitled to the commissions under their contracts.
The plaintiffs amended their complaint again.
The second amended complaint added specific contractual provisions and transaction-level allegations intended to address those deficiencies. It also described test purchases in which a transaction completed without Honey resulted in an affiliate receiving a commission, while an otherwise comparable transaction involving Honey allegedly resulted in the affiliate ID being overwritten and the commission not being paid to that affiliate.
That changed the court’s assessment.
On June 22, 2026, Judge Freeman denied PayPal’s motion to dismiss the second amended complaint. The court concluded that the plaintiffs had plausibly alleged that they were contractually entitled to the commissions and that PayPal’s alleged conduct was sufficiently connected to the claimed injuries for standing purposes.
The court specifically pointed to the combination of contractual terms, test purchases and statistical evidence supporting the plaintiffs’ allegations.
That does not mean PayPal has been found liable.
It means the case cleared the motion-to-dismiss stage.
That distinction matters. A motion to dismiss asks whether the complaint contains sufficiently plausible allegations to proceed. It is not a trial and it is not a final determination of liability.
What happens next
The June ruling is important primarily because it opens the door to discovery.
Discovery can involve internal communications, technical documentation, configuration files, source-code-related material, transaction records and other evidence relevant to the claims, subject to the court’s rules and protective orders.
The technical evidence could ultimately matter more than the public arguments surrounding the controversy.
For example, if investigators can establish exactly when Honey changed its selective-stand-down configuration, who approved those changes, which affiliate-network complaints were received, how the extension responded to different browser states and what transaction telemetry was retained, the court will have a much clearer factual record.
The second amended complaint itself alleges that Honey recorded information about decisions made by the selective-stand-down system, including the rule that triggered the decision and information associated with the original affiliate referral. Those allegations could become particularly significant if the underlying records still exist and are produced during discovery. The user-provided source material likewise highlights this logging issue as potentially important to tracing disputed commissions back to original affiliates.
But there is an important caveat: public allegations about what data may exist are not proof that PayPal still possesses a complete historical record, nor do they establish that every disputed commission can ultimately be reconstructed.
The business fallout is becoming measurable
The controversy has also had a visible effect on Honey’s position in the affiliate ecosystem.
A recent report based on third-party data cited in MegaLag’s latest investigation said Honey had fallen from roughly 35,000 merchant relationships in December 2024 to just over 28,000, while its Chrome user count had declined by more than seven million. The same report said Honey’s coupon inventory had fallen from roughly 90,000 to around 50,000. These figures come from third-party analysis and reporting, not from a court finding.
Those numbers should therefore be treated as measurements reported by researchers rather than official PayPal financial disclosures.
Still, the direction is difficult to ignore.
An affiliate browser extension depends on a network effect. It needs merchants, affiliate networks, coupons, users and advertisers. If major networks restrict access, merchants become harder to reach. If merchants leave, the usefulness of the extension can decline. If users leave, its commercial value falls further.
That makes the affiliate ecosystem itself part of the fallout.
Why this case matters beyond Honey
The Honey dispute is interesting because it exposes a weakness that exists far beyond one browser extension.
Affiliate marketing often relies on a relatively fragile attribution model. The system must determine which participant deserves credit for a purchase, sometimes using nothing more than a small identifier stored in a browser.
That creates an incentive for software operating near checkout to influence attribution.
The security lesson is familiar: whoever controls a trusted layer of a system can potentially influence the data consumed by the layer above it.
In this case, the browser is that layer.
A merchant can believe its affiliate platform is correctly reporting the final affiliate ID. The affiliate network can believe the merchant supplied accurate attribution data. The publisher can believe its link generated the sale. Yet an extension operating in the customer’s browser may sit between those parties and alter the state before the transaction is finalized.
This is not necessarily a security vulnerability in the conventional CVE sense. It is a trust and attribution problem created by the interaction between browser software, advertising contracts and client-side tracking.
The more important engineering question is therefore not simply whether a particular extension can modify a cookie.
It is whether an attribution system should trust a client-controlled identifier as the sole source of truth for a financial decision.
A difficult problem for affiliate networks
The case also raises uncomfortable questions for the networks themselves.
Stand-down rules only work if they can be reliably enforced and independently tested. If compliance depends on an extension voluntarily behaving correctly, networks need ways to verify that behavior under realistic consumer conditions.
That means testing more than one browser profile.
A robust testing program may need to consider different account ages, existing cookies, reward balances, merchant-specific rules, referral histories and other environmental factors that could affect extension behavior.
It also needs to account for server-side configuration.
A browser extension does not necessarily need a complete software update to change its behavior. If decision logic or configuration is fetched remotely, operators can potentially modify behavior without shipping an entirely new browser-extension package. The dispute over Honey’s selective-stand-down configuration is relevant precisely because researchers have examined both extension code and remotely controlled configuration.
For security engineers, that is an old lesson in a new setting: static inspection of a client application is not enough when important decisions are controlled remotely.
The biggest unresolved question
The most important question is not whether Honey’s extension was capable of replacing an affiliate identifier. The public court filings already describe allegations and technical mechanisms around that behavior.
The harder question is intent and scope.
Was the behavior an accidental consequence of how Honey’s attribution system was implemented? Was it a deliberate attempt to maximize commissions within the boundaries of an aggressive interpretation of last-click attribution? Or was there, as plaintiffs allege, a system specifically designed to behave differently when it suspected that compliance was being tested?
Those questions require evidence.
The June 2026 ruling does not answer them. It simply means the plaintiffs’ allegations are sufficiently plausible for the case to continue.
That is an important legal distinction, but it is also why the next phase of the case could be far more revealing than the public controversy that preceded it.
What the public record establishes so far
There are several facts that can be stated with considerably more confidence than the broader accusations circulating online.
Honey is a browser extension acquired by PayPal for $4 billion in 2020. Affiliate marketing relies on identifiers and tracking mechanisms to attribute sales. The Honey litigation alleges that the extension could overwrite affiliate IDs and redirect attribution. The second amended complaint also alleges selective compliance with affiliate-network stand-down rules.
Major affiliate networks subsequently took enforcement action. Rakuten terminated Honey, Awin reported policy breaches and remediation measures, and Impact.com also restricted Honey’s access.
Most importantly, the federal court dismissed an earlier complaint in November 2025 but allowed the plaintiffs to amend it. After the plaintiffs supplied more detailed contractual and transaction-level allegations, the court denied PayPal’s motion to dismiss the second amended complaint on June 22, 2026.
What has not happened is equally important: the court has not entered a final judgment finding PayPal liable for stealing affiliate commissions, and the June ruling does not establish that every allegation in the complaint is true.
That distinction should remain at the center of coverage of this story.
The real significance of the Honey controversy
The Honey controversy started as a dispute over coupons and affiliate commissions. It has evolved into something much more technically interesting: a case about who controls attribution in a browser-based advertising ecosystem and whether software can be trusted to follow rules that determine who gets paid.
For creators, the issue is straightforward. If a publisher generates a sale, that publisher wants the commission promised under its agreement.
For merchants, the concern is different. They need their affiliate programs to reward genuine referrals and prevent attribution from being manipulated.
For networks, the challenge is enforcement. They have to make rules meaningful even when the software participating in their ecosystem has a strong financial incentive to interpret those rules aggressively.
And for security engineers, the lesson is perhaps the clearest of all.
A browser extension does not need to compromise a server to change the economics of an online transaction. If the browser contains the state that determines attribution, software running inside that browser can become part of the transaction’s trust boundary.
The next stage of the PayPal Honey litigation will determine how much of the plaintiffs’ technical account survives scrutiny in discovery and, potentially, at trial. Until then, the responsible conclusion is neither that Honey has been proven to have committed every alleged act nor that the controversy can be dismissed as a misunderstanding of last-click attribution.
The public record shows a much narrower and more consequential reality: serious allegations were made, affiliate networks investigated and took action, researchers documented technical behavior, and a federal judge has now ruled that the amended claims are plausible enough to proceed.
The evidence produced in discovery will determine what happened behind the browser window.
