Phoebe Gates was 21 when she and a Stanford classmate began pitching an AI shopping app that promised to find the cheapest deal on anything from sneakers to airline tickets. Two years later, the app, Phia, carries the attention that comes with being the daughter of Microsoft co-founder Bill Gates. It also carries a legal problem that, if prosecutors decide to pursue it, could bring a prison term measured in decades.
Gates, now 23, and her co-founder, Sofia Chiani, built Phia around a simple premise: tell the assistant what you want, and it searches the web for a verified seller, taking a cut of each purchase it routes to a merchant. The business runs on affiliate commissions, the payments retailers make to websites that send them buyers. Those payments are now the subject of the allegations.
The accusation is a practice known as cookie stuffing. People familiar with the matter said Phia is accused of planting tracking cookies in the browsers of shoppers who never clicked through the app, then claiming commissions on orders it never influenced. Legal experts who reviewed the accounts said the conduct, if proved, could be prosecuted as federal wire fraud, a charge that carries a maximum sentence of 20 years in prison along with fines and restitution.
Cookie stuffing exploits the way affiliate programs assign credit. When a shopper clicks an affiliate link, the merchant’s site drops a small data file, a cookie, into the browser. That cookie is the receipt that identifies who should be paid. Cookie stuffing places that file without a click, sometimes through hidden scripts on a webpage or inside an ad, so the merchant records the order as though the affiliate had referred it. The affiliate collects the commission; the site that actually drove the sale gets nothing.
The technique is old, but the defenses are getting harder. Modern browsers and ad-blockers now flag many of the scripts used to plant cookies without a click, and the big affiliate networks have built fraud-detection teams that look for warning signs such as conversion rates that spike without a matching rise in traffic. The people familiar with the matter said the claims against Phia center on the period when the app was expanding its network of merchants. Whether the stuffing was done by the company’s own software or by outside partners is one of the questions investigators would have to resolve.
Retailers and affiliate networks have policed the practice for years, and courts have repeatedly upheld fraud claims against operators caught stuffing cookies. Federal prosecutors have also charged cookie-stuffing schemes as wire fraud when the amounts justify the effort, legal experts said. The strategy for the accused is usually the same in both forums: argue that the cookies were placed by outside actors, that the attribution was a technical accident, or that the software did not work as alleged.
The family connection has turned what might have been a niche affiliate dispute into a global news story. Gates has built a public profile around health advocacy and climate work, appearing alongside her father at foundation events and on podcasts. The allegation puts that carefully managed image in front of prosecutors, regulators, and a public that follows every wrinkle of the Gates name.
For Phia, the stakes are existential. The app’s pitch is trust: it claims to find better deals by watching prices and routing buyers to vetted sellers. A commission-integrity question cuts at the core of that promise. Merchants who suspect their payouts are being diverted may stop paying altogether, and users may stop trusting the recommendations.
No charges have been filed, and the allegations have not been tested in court. Legal experts said any prosecution would hinge on intent: prosecutors would have to show that the founders knew cookies were being planted without shoppers’ consent and profited from the deception. Affiliate disputes more often end in civil settlements, with merchants and networks suing over breach of contract or fraud rather than referring the matter to criminal authorities.
The case also lands at an awkward moment for the affiliate industry, which is being reshaped by AI agents that shop on behalf of users. When a chatbot books a flight or orders groceries, attribution becomes murkier: the merchant must decide which of several systems deserves the commission. The industry is drafting rules for agent-driven commerce even as the underlying attribution machinery remains easy to game.
For the younger Gates, the episode is a test of a public identity built around philanthropy. For the broader AI shopping category, it is an early look at how the law treats the commission machinery underneath a new generation of commerce. Investors and founders are watching the case closely, analysts said, because the outcome could shape how aggressively agents can collect referral fees on purchases they merely observed rather than influenced.
Beyond criminal exposure, the episode invites civil scrutiny. The Federal Trade Commission has brought cases against operators who deceive consumers through online tracking, and state attorneys general have pursued affiliate fraud under consumer-protection laws. Merchants who paid commissions they believe were diverted can sue for damages under state fraud and contract law, and affiliate networks have clawed back payments when fraud was detected, according to people who work in the industry. The economics of AI shopping are still being settled: most assistants are free to users and earn through referral fees or licensing deals, and none of the major players has disclosed how much of its revenue comes from commissions. If regulators impose stricter attribution rules, the whole category may have to rework how it gets paid.
The case could take years to resolve, and the parties may never see a courtroom. Whatever the outcome, the episode has already forced a question that the industry would rather avoid: when an AI assistant claims credit for a sale, who verifies that the credit is earned?
