Bill Gates' 23-year-old daughter Phoebe now faces accusations that her shopping startup secretly claimed credit for online sales it never drove, a practice one attorney warns could carry up to 20 years in federal prison.

A Bloomberg investigation published in July 2026 alleged that Phoebe Gates and co-founder Sophia Kianni knowingly pushed for software features inside their digital shopping platform, Phia, that planted tracking cookies to collect affiliate commissions from retailers like Nike, Nordstrom, and Gap, even when Phia played no role in the customer's purchase. The practice, known in the industry as "cookie stuffing," amounts to taking a cut of someone else's sale by falsely claiming you sent the buyer there.

No criminal charges have been filed. But the allegations have drawn pointed legal commentary, a corporate damage-control campaign, and a revenue collapse that tells its own story about how much of Phia's income depended on the disputed features.

Phia's daily revenue cratered after the features were disabled

Phia, which the Daily Caller reported generated $30 million in 2025, operates as a browser extension that helps online shoppers find discount codes and the lowest available pricing during checkout. The extension drops a tracking cookie when a shopper completes a purchase, signaling to the retailer that Phia drove the sale and earning the company an affiliate commission.

That model is standard in affiliate marketing. What Bloomberg alleged was not standard at all.

Bloomberg's investigation claimed to have obtained Slack messages and information from sources close to the company showing that Gates and Kianni were aware of the cookie-stuffing for at least seven months before the story broke. One Slack message, attributed to Gates and dated December 18, read: "worried this is an issue across the board...can u confirm auto pop for cookie drop is live on ALL sites w a coupon to confirm we are monetizing on all gmv." Bloomberg also alleged that Kianni suggested a cookie be dropped each time a user closed a Phia pop-up, a move that would claim credit for a sale even when the shopper dismissed the app entirely.

After Bloomberg published its findings, Phia disabled the disputed features. The financial fallout was immediate. Daily revenue dropped from roughly $80,000 to somewhere between $10,000 and $28,000, the New York Post reported. That gap, as much as $70,000 a day, suggests the vast majority of Phia's affiliate income was flowing from the very features now under scrutiny.

When confronted by Bloomberg, Gates and Kianni said they had only become aware of the matter "within the last 24 hours" and asserted they would fix the issue. Bloomberg's Slack evidence, if accurate, contradicts that timeline by months.

An attorney warns cookie stuffing is typically charged as federal wire fraud

Ariel Givner, founder of Givner Law, posted a warning on X on August 11, 2026, spelling out the legal exposure in blunt terms. Givner has drawn attention for her analysis of the case:

"Again, this is called cookie stuffing! On a simple level, it's automatically injecting affiliate tracking cookies to claim commissions on sales you didn't drive. It's typically treated as federal wire fraud in US courts. There's a possibility of a max penalty of up to 20 years..."

Givner added that the penalty could include "fines/restitution" on top of prison time. It is worth noting that Givner is a private attorney offering legal commentary, not a federal prosecutor announcing an investigation. No law enforcement agency has publicly confirmed it is looking into Phia's practices.

Still, the legal framework she described is real. Federal wire fraud carries a statutory maximum of 20 years in prison. But as Star Kashman, founding partner of the Cyber Law Firm, told the New York Post, prosecutors would need to prove Gates knowingly participated in a scheme to defraud. Kashman said the more likely outcome is financial penalties, not prison, particularly for a first-time offender.

Phia's spokesperson says the company is issuing refunds to retailers

A Phia spokesperson denied Bloomberg's allegation, though no verbatim denial was provided beyond a statement given to the New York Post. That statement acknowledged the problem while framing it as resolved:

"Any features causing misattributions were immediately removed over a month ago on July 7. We are reviewing every transaction; we are fully committed to and have already begun issuing all transaction reversals to brand partners as a result of any misattribution, and we are hiring a head of compliance to make sure something like this never happens again."

The statement raises as many questions as it answers. If the features were removed on July 7, that was before Bloomberg published its investigation, suggesting the company may have known the exposure was coming. The spokesperson's language, "misattributions", is a softer word than what Bloomberg described and what Givner called by its industry name: cookie stuffing.

Phia also said it is hiring a head of compliance. Whether that position has been filled remains unclear.

Phia's browser extension did more than stuff cookies, prior reporting shows

The cookie-stuffing allegation is not Phia's first controversy. Breitbart reported that the company's browser extension was found to secretly open background tabs to insert its own referral codes, overriding legitimate referrals from other publishers across more than 50 major retail websites. Affiliate network Impact.com suspended Phia's account after identifying behavior it said was inconsistent with platform policies.

Phia also faced a separate data privacy scandal in which its extension was found to be logging users' sensitive web browsing history, including bank statements and private emails, and transmitting that data back to company servers.

Independent advertising researcher Ben Edelman put the affiliate fraud issue in plain terms: "The most fundamental requirement in affiliate marketing is that commission is only paid if a user clicks. The rules don't allow fake clicks, simulated clicks, imaginary clicks or hypothetical clicks. Only a real click will do."

Phia launched in April 2025 and attracted high-profile backers including Hailey Bieber and Kris Jenner. The company's celebrity investors have not publicly commented on the allegations.

Several critical questions remain unanswered

No federal prosecutor has announced an investigation. No charges have been filed. No civil lawsuit from a defrauded retailer has surfaced in the reporting. The total amount of commissions Phia allegedly collected for sales it did not drive has not been disclosed. And the identities of Bloomberg's sources, described only as "those close to the situation", remain unknown.

What is known is this: Phia's own revenue numbers, before and after the disputed features were removed, suggest the company's business model leaned heavily on the very mechanism now under legal scrutiny. A company that drops from $80,000 a day to as little as $10,000 after removing certain features was not earning most of its money the old-fashioned way.

Gates and Kianni may never see the inside of a courtroom. But the gap between what they told Bloomberg, that they learned of the problem only hours before, and the Slack messages Bloomberg says it obtained, dating back at least seven months, is the kind of contradiction that tends to attract the attention of regulators and plaintiffs' lawyers alike.

A famous last name can open doors in Silicon Valley. It does not, and should not, close the door on accountability when the money trail points somewhere it shouldn't.