- Detection produces a signal, not a finding — a record-keeping step sits between the two.
- Usable evidence is paired: two requests at the same moment differing by one variable, and what each returned.
- Rule out ordinary causes — geo-targeting, caching, an in-flight deploy — before calling it a finding.
- Write the enforcement ladder and the contract clauses in advance; rules invented after the fact rarely hold.
Detection is where most programs stop
A monitoring tool flags a divergence, someone opens the link, confirms it does look different, and then — usually nothing. The observation gets logged in a spreadsheet, the partnership keeps running, because nobody is confident the material is enough to trigger a process. That is not a discipline problem; it is a problem with the shape of the evidence. A page someone opened by hand proves neither what the request conditions were at that moment, nor that different conditions would have returned something else. Affiliate de-cloaking detection covers how divergences get found; this article picks up at the step after, turning a signal into a record you can act on.
What counts as evidence
A single observation carries almost no weight, because there are too many innocent reasons a page looks the way it does: geo-targeting, an A/B test, CDN caching, a deploy in progress, a difference in login state. Ruling those out requires paired evidence — two requests inside the same time window, matched on everything except the one variable you are testing (usually source, region, or client type), with a record of what each one returned. One side returning a compliance-friendly page while the other returns the real promotional page is a meaningful observation. Which variable produced the split also tells you what the routing rule keys on.
Beyond pairing, evidence needs repetition. One split can be coincidence; a split that reproduces across several sessions, several times of day, and at least two vantage points is stable behavior. The frequency is itself part of the material: an occasional difference and a page that switches every single time an ad source is present are different problems and warrant different responses.
Capturing a record that survives a dispute
A complete record contains at minimum: a precise timestamp, the full request URL including every parameter, the conditions the request was made under (source, region, client type), the complete redirect chain, the response content of the final destination, and the same set of fields for the control request made at the same moment. Screenshots can be attached, but they are illustration rather than the substance — what carries the conclusion is the correspondence between request conditions and response content. The redirect chain deserves separate preservation, because branching frequently happens at an intermediate hop rather than the final page; redirect chain analysis covers how to take the whole chain apart.
Records have to be frozen at the moment of discovery, not reconstructed when they are needed. Pages change constantly, and a partner who senses scrutiny typically reverts to normal behavior immediately — at which point a fresh check returns a clean page that now works against you. Continuous retention also lets you answer how long the behavior has been running, which is the question that determines how far back a clawback reaches. Running checks as a standing job rather than an ad-hoc reaction is covered in partner page compliance monitoring.
The method itself should be written down. If a case reaches the point where someone asks how you tested, a procedure a third party can reproduce is worth more than any number of screenshots. How to check whether a page is branching traffic sets out steps that can be adopted directly.
Structuring an enforcement ladder
Enforcement should not be a binary between carrying on and terminating, because a binary usually resolves to doing nothing. A workable ladder runs roughly: a written query presenting the observation and asking for an explanation, then a payment hold with the partnership intact and reinstatement if the behavior stops, then traffic restriction or a lower commission tier, then a clawback of the affected commissions, and finally termination. Which rung a case lands on should be pinned to evidence strength and behavior frequency in advance, rather than argued case by case.
Starting with a query rather than a shutdown has a practical justification: unintentional cases exist. A default setting in a third-party landing page tool, a misconfigured plugin, or an agency acting on its own can all produce branching that the partner genuinely does not know about. A query separates those cases cheaply — a partner who cooperates with the investigation and fixes it the same day is a different counterparty from one who denies it outright or quietly reverts and says nothing.
When the partner pushes back
The three most common defenses are that it was geo-targeting rather than branching, that you saw a cached older version, and that a deploy happened to be in flight. All three can be true, and all three are directly testable against paired evidence — if your control and test requests differed only in a source parameter, came from the same region, and were seconds apart, the geo and cache explanations do not survive. If the same split reproduces across three days, neither does the deploy explanation. This is precisely why pairing and repetition matter: they are not formalities, they are what these three sentences run into.
Take seriously the possibility that you are wrong. A partner's page may run compliant personalization that your detection is reading as branching. Traffic routing vs compliant personalization covers where the line sits — broadly, one URL with the same substantive content and differences confined to presentation is usually personalization, whereas the substantive offer itself changing based on who appears to be asking is the problem. Building a way to withdraw a case into the process costs less over time than defending every one of them.
Program terms that make enforcement possible
Discovering after the fact that the contract does not cover it is the most common way an enforcement case dies. Three clause types are worth putting into the agreement in advance. First, make explicit that the landing experience is part of what is being approved, not just the creative. Second, reserve the right to check destination pages from any source, region, or client type, and state that checks may carry no identifying marker. Third, spell out the consequences when the page does not match what was declared, including how far back a commission clawback reaches. With all three present, enforcement is contract execution; with any one missing, it becomes a negotiation.
The value of these clauses is not confined to the enforcement stage. An agreement stating plainly that pages will be checked at unannounced intervals changes some partners' behavior by itself — this kind of branching is generally done on the assumption that nobody will look, and removing that assumption changes the arithmetic. The underlying incentive structure has fuller background in affiliate link cloaking and affiliate click fraud detection.