Phoebe Gates is unlikely to face the maximum 20 years behind bars for potential charges stemming from the “cookie stuffing” allegations engulfing her AI-powered shopping startup Phia — but she could get walloped with civil lawsuits and financial penalties if the claims are proven, experts told The Post.
Star Kashman, founding partner of Cyber Law Firm, said federal wire fraud carries a statutory maximum of two decades years in prison, along with potential financial penalties — but stressed that prosecutors would first have to prove that Gates knowingly participated in a scheme to defraud.
“This can’t be a careless or negligent error,” she told The Post.
“Wire fraud would have to paint a picture of a knowing scheme that is organized to defraud these individuals (affiliates, businesses etc.) of their money.”
The more immediate danger for Gates and Phia could hit their pocketbooks, according to Kashman.
“The more likely penalty here is financial penalties,” she said.
Kashman said parties that can demonstrate they lost money because of Phia’s alleged conduct could potentially pursue civil claims over commissions, contracts and business relationships, as well as privacy and consumer-protection issues.
Gates, the 23-year-old daughter of Microsoft co-founder Bill Gates, and fellow Stanford alum Sophia Kianni co-founded Phia, an AI-powered shopping platform that launched its consumer app and browser extension in April 2025.
Bloomberg reported this week that Phia’s browser extension could drop affiliate tracking cookies even when shoppers did not take the action normally required for the startup to claim credit for a sale, a practice known as “cookie stuffing.” The practice affected affiliates including Nike, Nordstrom and the Gap, according to Bloomberg. Those companies are yet to publicly comment on the scandal.
The report cited internal Slack communications and source code that it said showed the founders were aware of automatic cookie-placement features months before Phia publicly disclosed the attribution problem.
Phia has disputed aspects of Bloomberg’s findings and has not been charged with a crime.
“Even with intent, prosecution is never automatic,” Kashman said.
She added that it would be “very unlikely” for a young entrepreneur with an otherwise clean history to receive the maximum sentence on a first offense.
But lawsuits may loom.
“If proven to be true, I see it as a likely possibility that herself and/or her company will be taken to court over this alleged scheme,” Kashman said.
The controversy centers on the lucrative affiliate-marketing system underpinning Phia’s business.
When a shopper uses an affiliate’s link or coupon and makes a purchase, a tracking cookie can identify the affiliate as responsible for the sale, allowing it to collect a commission.
“Cookie stuffing” can manipulate that system by placing tracking cookies that allow an affiliate to take credit for sales it did not actually generate.
Ben Edelman, a longtime advertising researcher who reviewed Phia’s practices, told The Post that he prefers the term “forced clicks” when the conduct involves client-side software such as a browser extension, though he said the distinction from cookie stuffing “may be a thin difference.”
“There is no proper reason for an extension to invoke an affiliate link, and place an affiliate cookie, when the user hasn’t meaningfully interacted with it,” Edelman said in an email.
“But there is an obvious improper reason — to get paid more (a lot more).”
Edelman called forced clicks “the most fundamental breach of network and merchant rules,” saying they can rapidly boost an affiliate’s earnings while driving up costs for merchants.
Richard Newman, an attorney who has spent more than two decades representing companies in the performance-marketing industry, told The Post that cookie stuffing is generally barred by affiliate agreements.
“Cookie stuffing is … usually a method by which to invalidate commissions,” Newman said.
While Gates potentially faces a far more serious legal headache if prosecutors establish fraud, Newman said these disputes are “typically” contractual matters between private parties.
“They lose their commissions,” Newman said of affiliates found to have violated such provisions.
Bloomberg reported that Phia’s average daily revenue plunged from roughly $80,000 to between $10,000 and $28,000 after the disputed features were disabled — though Phia has said the decline was also caused by its decision to turn off most of its monetization efforts.
The Post has sought comment from Gates and Phia.