Bill Gates' 23-year-old daughter Phoebe faces allegations that her shopping startup Phia ran a scheme to collect affiliate commissions on sales it played no part in generating, conduct one attorney says could carry up to 20 years in federal prison.
A Bloomberg investigation published this summer found that Phia's co-founders, Phoebe Gates and fellow Stanford alum Sophia Kianni, knowingly pushed for software features inside their browser extension that claimed credit for online purchases Phia did not actually drive. The practice, known in the digital advertising world as "cookie stuffing," works by secretly planting affiliate tracking codes on a shopper's browser so the company collects a referral commission even when the shopper found the retailer on her own.
No criminal charges have been filed. But the gap between what Phia's founders told Bloomberg and what Bloomberg says it found in internal records raises questions that go well beyond a startup stumble.
Slack messages point to months of awareness
Bloomberg reported obtaining Slack messages and information from people close to the company showing Gates and Kianni were aware of the cookie-stuffing features for at least seven months before the outlet exposed them. One message, dated December 18 and attributed to Phoebe Gates, reads like a directive, not a discovery. The Daily Caller reported the message's contents:
"worried this is an issue across the board...can u confirm auto pop for cookie drop is live on ALL sites w a coupon to confirm we are monetizing on all gmv."
Kianni, meanwhile, allegedly suggested that Phia drop a cookie each time a user closed one of the app's pop-up windows, a move that would plant a commission tracker even when the shopper dismissed the extension entirely.
When Bloomberg confronted the co-founders, both said they had only become aware of the matter "within the last 24 hours." Seven months of internal messages on one side. Twenty-four hours of awareness on the other. Bloomberg's reporting and the co-founders' response cannot both be true.
Phia's extension hijacked commissions across 50-plus retailers
Phia markets itself as a tool that helps online shoppers find discount codes and the lowest prices at checkout. It earns money through affiliate commissions, a standard arrangement in which a retailer pays a referral fee when a publisher genuinely sends a customer its way. The allegation is that Phia gamed this system by inserting its own tracking cookies without any real user interaction.
Breitbart reported that Bloomberg's testing found the deceptive behavior across more than 50 major retail websites, including Walmart, Nike, and Zara. Phia's extension secretly opened background tabs to insert its own referral codes, overriding legitimate referrals from other publishers. The scheme did not just cheat retailers, it siphoned commissions that belonged to competitors who had actually earned them.
Impact.com, one of the major affiliate networks involved, suspended Phia's account after identifying behavior inconsistent with its platform policies. Ben Edelman, an independent advertising researcher, put the standard plainly:
"The most fundamental requirement in affiliate marketing is that commission is only paid if a user clicks. The rules don't allow fake clicks, simulated clicks, imaginary clicks or hypothetical clicks. Only a real click will do."
Capital One Shopping, a competing publisher, emailed retailers directly about the losses. "Publishers like us are having material revenue taken," the company wrote. "And advertisers like you are losing money to fake clicks."
Retailers Bloomberg identified as allegedly affected include Nike, Nordstrom, and Gap. Phia generated $30 million in 2025, according to Bloomberg's reporting. How much of that figure rested on commissions the company did not earn remains an open question.
Revenue cratered once the features were disabled
After Bloomberg's investigation went public, Phia disabled the disputed features. A company spokesperson told the New York Post that the changes took effect on July 7. The financial impact was immediate and severe: Phia's daily revenue dropped from roughly $80,000 to between $10,000 and $28,000.
That collapse tells its own story. When a company loses more than half its daily revenue, and in some cases nearly 90 percent, by turning off a single set of features, those features were not incidental. They were the engine.
The spokesperson's full statement acknowledged the problem while framing it as an error already being corrected:
"Any features causing misattributions were immediately removed over a month ago on July 7. We are reviewing every transaction; we are fully committed to and have already begun issuing all transaction reversals to brand partners as a result of any misattribution, and we are hiring a head of compliance to make sure something like this never happens again."
The statement uses the word "misattributions", a term that describes the outcome without addressing whether it was intentional. Phia's spokesperson did not specify which of Bloomberg's allegations the company disputes, and the company has not detailed how much money it has returned to brand partners or which partners received reversals.
Wire fraud carries 20 years, but legal experts temper expectations
On August 11, attorney Ariel Givner, founder of Givner Law, posted a warning on X that drew national attention to the legal stakes:
"Again, this is called cookie stuffing! On a simple level, it's automatically injecting affiliate tracking cookies to claim commissions on sales you didn't drive. It's typically treated as federal wire fraud in US courts. There's a possibility of a max penalty of up to 20 years..."
Givner added that fines and restitution could accompany any prison sentence. Cookie stuffing, she noted, is not a gray area in federal courts, it is a recognized form of fraud.
Still, the New York Post reported that legal experts consider the maximum sentence unlikely for a first-time offender. Star Kashman, founding partner of Cyber Law Firm, told the Post that prosecutors pursuing wire fraud "would have to paint a picture of a knowing scheme that is organized to defraud these individuals, affiliates, businesses, etc., of their money." The more immediate threat, experts suggested, is civil lawsuits and financial penalties from the affiliates and merchants whose commissions were diverted.
No federal law enforcement agency has publicly announced a formal investigation into Phia, Gates, or Kianni. No charges have been filed. But the absence of charges today does not foreclose them tomorrow, and the Bloomberg reporting, if accurate, supplies exactly the kind of internal communications prosecutors in wire fraud cases look for.
Celebrity backers and a previous data controversy
Phia launched in April 2025 with the kind of backing most startups only dream about. Hailey Bieber and Kris Jenner are among the company's investors, according to Bloomberg's reporting. The Gates family name provided instant credibility. The startup was featured by Inc. Magazine and profiled across entertainment and business media.
And this is not the first time Phia's practices have drawn scrutiny. Breitbart noted that the company was previously caught logging users' sensitive browsing data, including bank statements, a separate controversy that raised its own privacy concerns before the cookie-stuffing allegations surfaced.
Edelman, the advertising researcher, told the Post that there is "no proper reason for an extension to invoke an affiliate link, and place an affiliate cookie, when the user hasn't meaningfully interacted with it." That assessment applies to the cookie-stuffing allegations specifically, but it also describes a broader pattern: a company that treated user trust and industry rules as obstacles rather than obligations.
Accountability should not depend on your last name
The facts Bloomberg laid out, internal messages, a revenue model built on disputed commissions, a timeline of alleged awareness stretching back months, would draw serious scrutiny for any startup founder. Gates and Kianni say they learned of the problem only at the last minute. Bloomberg says the records show otherwise. Phia says it fixed the issue. Its revenue collapse suggests the "issue" was most of the business.
Whether prosecutors eventually act or affected companies pursue civil claims, the core question is straightforward: Did Phia collect money it did not earn, and did its founders know? The Slack messages Bloomberg obtained point in one direction. The founders' denials point in the other. Somebody is not telling the truth.
A billionaire's last name should not buy anyone a pass on accountability, and it should not buy a prison sentence, either. What it should buy is exactly the same scrutiny any other founder would face when the numbers stop adding up.
