Phoebe Gates, daughter of Microsoft co-founder Bill Gates, and her co-founder Sophia Kianni are facing allegations that their startup, Phia, engaged in "cookie stuffing." This practice involves dropping excessive web cookies to illicitly claim credit for online sales, potentially leading to a maximum penalty of 20 years in federal prison.

Phia, a digital personal shopping assistant that operates as a browser extension, reportedly overcounted its sales commissions by dropping more cookies than it should have. According to a Bloomberg report, the young entrepreneurs were aware of these practices for at least seven months, despite a company statement claiming they had only learned of the issue recently.

Ariel Givner, founder and principal attorney at Givner Law, stated that cookie stuffing is often treated as federal wire fraud in U.S. courts, carrying a potential maximum sentence of up to 20 years in prison, along with fines and restitution.

A spokesperson for Phia commented that any features causing misattributions were removed on July 7 and that the company is reviewing transactions and issuing reversals to brand partners. The spokesperson also stated that Phia is hiring a head of compliance to prevent future occurrences and is committed to providing users with a positive shopping experience.

The startup, which raised $30 million from investors including Hailey Bieber and Kris Jenner, functions by finding discount codes for customers. When a shopper uses Phia, the software drops a "cookie" to track activity and earn a commission for driving a sale. However, internal Slack messages reviewed by Bloomberg suggest that Gates and Kianni were aware of features that dropped cookies even when customers did not use Phia.

The alleged cookie stuffing dates back to at least December and was traced across sales at major retailers like Nike, Gap, and Nordstrom. It reportedly constituted a significant portion of Phia's revenue. After disabling these features in July, the company's average daily revenue dropped from approximately $80,000 to between $10,000 and $28,000, according to Bloomberg's analysis.

A Phia spokesperson disputed Bloomberg's data analysis, stating that the revenue decline was also due to the disabling of other monetization efforts and that the reporting overstated the impact of cookie stuffing. The company clarified that what was initially called a software bug was a feature that could be switched on and off.

Internal communications indicate that Gates expressed concern about Phia not generating expected commissions and directed developers to ensure cookies were dropped every time the browser extension appeared, regardless of whether a coupon was used. Kianni also reportedly suggested a feature that would drop a cookie when a user attempted to close a Phia pop-up, though a spokesperson stated this feature was never implemented.

One of Phia's affiliates, Impact.com, had already suspended its network and reallocated commissions. While Phia has begun looking into transfer reversals, further refunds may be necessary due to the extended period the policy was reportedly in place, from December through July.