ChatGPT Ads Attribution Revealed: Inside the Four-Token Tracking System That Changes How Brands Measure AI

Originally published on The Searchless Journal

Six weeks ago, ChatGPT had no ads. Today it has an advertising infrastructure with its own SDK, a four-token attribution chain using Fernet encryption, contextual targeting that adapts to each conversation, and a dedicated crawler that validates landing pages before they go live. The speed of construction is impressive. The maturity is what matters for brands.

A detailed technical breakdown published on April 28 by a security researcher at Buchodi.com reverse-engineered the entire ChatGPT ad serving and attribution pipeline. This is the first complete public documentation of how ChatGPT serves ads, tracks clicks, attributes conversions, and targets users contextually. It reveals both the sophistication of what OpenAI has built and the gaps that remain.

For brands spending on ChatGPT ads, this is essential infrastructure knowledge. For brands investing in organic AI visibility through GEO, it is a reminder that earned citations avoid the complexity entirely.

How ChatGPT Serves Ads: The SSE Injection Model

ChatGPT does not display ads the way a search engine does. Ads are not fixed positions on a page. They are injected into the Server-Sent Events (SSE) stream that powers each conversation.

When ChatGPT generates a response, the backend includes a JSON object called single_advertiser_ad_unit. This object contains the ad content, the destination URL, targeting metadata, and four encrypted tokens that handle attribution. The ad appears inline within the conversation flow, not as a sidebar or banner.

This is a fundamentally different ad model from Google's sponsored results or Meta's feed ads. ChatGPT ads are conversational. They appear as part of an answer, blending into the context of the exchange. The format has advantages: higher engagement intent, lower ad blindness, contextual relevance. It also has risks: users may not distinguish between organic recommendations and paid placements, which is exactly the trust tension that ChatGPT advertising creates.

The Four Fernet Tokens: Attribution Infrastructure

Every ChatGPT ad carries four Fernet-encrypted tokens. Fernet is a symmetric encryption scheme that guarantees data integrity and confidentiality. Each token serves a distinct purpose in the attribution chain.

Token 1: ads_spam_integrity_payload. This token carries integrity data that OpenAI uses to verify the ad has not been tampered with between serving and click. It is a spam-prevention mechanism.

Token 2: oppref (thirty-day attribution cookie). This is the core attribution token. When a user clicks a ChatGPT ad, the OAIQ SDK sets a cookie called __oppref on the merchant's site with a 720-hour (thirty-day) time-to-live. This cookie connects the click to subsequent conversion events on the advertiser's site.

Token 3: olref. This token handles referrer tracking. It identifies the specific conversation and ad placement that generated the click, enabling OpenAI to report which conversations drive the most conversions.

Token 4: ad_data_token. This token carries the ad metadata: campaign ID, creative ID, targeting parameters, and any A/B test variant information. It is the data payload that ties the click back to the specific ad buy.

Together, these four tokens form a complete attribution chain from ad serve to click to merchant page to conversion event. The architecture is well-designed. But it is version 0.1.3 of the OAIQ SDK. That version number tells you everything about where this infrastructure sits on the maturity curve.

The OAIQ SDK: Tracking on the Merchant Side

When a user clicks a ChatGPT ad, the destination page loads a JavaScript SDK called OAIQ (version 0.1.3 as of April 2026). This SDK is analogous to Google's gtag.js or Meta's Pixel. It runs on the merchant's site and tracks post-click behavior.

The SDK's primary function is tracking contents_viewed events. When a user lands on the merchant's page from a ChatGPT ad, the SDK fires this event, recording which products or content the user viewed. The SDK stores the __oppref cookie, maintaining the attribution link between the ChatGPT click and the merchant's site.

What the SDK does not yet do is notable. There is no documented conversion tracking pixel comparable to Google's conversion action. There is no cross-device identity resolution. There is no offline conversion import. The SDK tracks views and clicks but the path from view to purchase attribution appears incomplete in this early version.

For context, Google Ads went through roughly the same attribution evolution between 2005 and 2015. It took a decade for Google to build multi-touch attribution, cross-device tracking, and offline conversion imports. OpenAI is building the same stack in months, not years. The velocity is real. The completeness is not.

Contextual Targeting: The Conversation as Signal

One of the most revealing findings from the reverse-engineering is how ChatGPT handles ad targeting. The researcher created six conversations on six different topics using the same account. Each conversation received a different ad that matched its topic.

A conversation about Chinese food generated a Grubhub ad. A conversation about Beijing tourism generated a GetYourGuide ad. Other conversations produced ads from HelloFresh, Home Depot, Williams-Sonoma, and Kayak. Six conversations, six different brands, zero overlap.

This confirms that ChatGPT ad targeting is contextual, not behavioral. The targeting signal comes from the current conversation, not from the user's browsing history, demographic profile, or retargeting pool. This is the same fundamental approach Google used in its early AdWords days: match the ad to the query, not the user.

The implications are significant for advertisers. ChatGPT ad relevance depends on conversation content, which means ad performance will correlate with how naturally a brand fits into common AI conversation topics. Brands in high-volume conversational categories (food, travel, home improvement, shopping) will see more impressions. Brands in niche B2B categories may find limited inventory.

In-App Webview: OpenAI Watches Post-Click Navigation

The reverse-engineering also revealed that ChatGPT ad clicks open in an in-app webview by default. The target.open_externally parameter is set to false, meaning users stay inside ChatGPT's browser environment when they click an ad.

This gives OpenAI visibility into post-click navigation. The platform can track how long users stay on the merchant's page, whether they navigate to other pages, and when they leave. This is rich behavioral data that most ad platforms can only approximate through third-party cookies or SDK events.

It also raises the same privacy questions that Meta faced with its in-app browser. When a platform controls both the ad serving environment and the post-click browsing environment, it collects data at a granularity that independent browsers prevent. OpenAI will need to address this transparency gap before regulators ask about it.

Click Latency: The 95-Second Gap

The researcher observed a click latency of approximately ninety-five seconds from token mint to merchant page fetch in one test case (a Home Depot ad). This means there is a significant processing delay between when the ad token is created and when the user's browser actually requests the merchant's landing page.

The likely explanation is the OAI-AdsBot validation step. Before the ad is served, OpenAI's dedicated ad crawler (which we documented when it launched) must validate the landing page for safety, policy compliance, and relevance. This pre-click validation adds latency but ensures quality.

Ninety-five seconds is not user-facing latency; the user does not wait. It is back-end processing time between token generation and page validation. But it illustrates the computational overhead of running a safety-first ad system inside a conversational AI product.

Adthena AdBridge: The Conversion Path from Google to ChatGPT

On April 27, Adthena launched AdBridge, a tool that automatically converts Google Ads campaigns into ChatGPT ad format. This is infrastructure built specifically to help brands move budget from Google to OpenAI without rebuilding their campaigns from scratch.

AdBridge matters because it lowers the switching cost for Google advertisers. Brands that have spent years optimizing Google Ads campaigns can now port those campaigns into ChatGPT with a few clicks. If the attribution infrastructure works, this could accelerate the budget shift from search to AI that analysts have been projecting.

The risk is that ChatGPT ad performance and Google ad performance are not directly comparable. Different audience, different intent signal, different conversion path. Brands that treat AdBridge as a simple port rather than a starting point for ChatGPT-specific optimization will likely see disappointing returns.

What This Means for Brands

Three takeaways from the attribution infrastructure analysis.

First, ChatGPT ad measurement is real but immature. The four-token system, OAIQ SDK, and in-app webview tracking demonstrate serious infrastructure investment. But version 0.1.3 of the SDK, the absence of multi-touch attribution, and the lack of cross-device tracking mean brands should expect measurement gaps. Compare this with Google Ads' mature attribution and adjust expectations accordingly.

Second, contextual targeting rewards conversational relevance. Brands should map their products to the types of conversations ChatGPT users have about their category. If your brand naturally comes up in AI conversations about your topic, both organic citations and paid ads will perform better. This is the exact intersection where GEO and paid AI advertising meet.

Third, organic AI visibility avoids the attribution complexity entirely. When ChatGPT recommends your brand organically in an answer, there are no tokens, no SDKs, no cookies, no attribution chains to debug. The citation itself is the conversion path. Brands investing in GEO are building a visibility asset that does not depend on attribution infrastructure maturity. As we noted in our analysis of ChatGPT's $100 million ad pilot, organic citations in a platform that is rapidly becoming ad-supported may be more valuable than paid placements.

ChatGPT Attribution vs Google Ads Attribution: Where the Gaps Are

Feature	ChatGPT Ads (Apr 2026)	Google Ads (Apr 2026)
Click tracking	Four Fernet tokens, OAIQ SDK	gtag.js, Google Click ID
Attribution window	30 days (cookie-based)	30-90 days (multiple models)
Multi-touch attribution	Not documented	Data-driven, time-decay, position-based
Cross-device tracking	Not documented	Google Signals, logged-in users
Conversion tracking	View events only (v0.1.3)	Online, offline, phone, store visits
Audience targeting	Contextual (conversation topic)	Behavioral, demographic, remarketing
Post-click visibility	In-app webview tracking	GA4 integration, consent mode
Maturity	Version 0.1.3 (weeks old)	20+ years of iteration

The gap is not surprising. Google has had two decades to build its attribution infrastructure. OpenAI has had two months. The question is not whether OpenAI's attribution matches Google's today. It is how quickly the gap closes, and whether brands can afford to wait.

Sources

• Buchodi.com: "ChatGPT Ads: A Deep Dive into Technical Implementation, Attribution Mechanics & Privacy Considerations" (April 28, 2026)
• Adthena AdBridge launch announcement (April 27, 2026)
• Reuters: ChatGPT ad pilot surpasses $100 million annualized revenue (March 2026)
• The Information: OpenAI ad revenue projections (April 2026)
• Searchless: "OAI-AdsBot: OpenAI's Dedicated Ad Crawler" (April 28, 2026)
• Searchless: "ChatGPT Ads at $100M: The Brands Spending and What Early Data Reveals" (April 28, 2026)
• Searchless: "ChatGPT CPC Ads Pricing Breakdown 2026 Benchmarks" (April 27, 2026)
• Fast Company: AI chatbot ad manipulation concerns (April 28, 2026)

FAQ

Can I track ChatGPT ad conversions in Google Analytics?
ChatGPT ad clicks that open in an in-app webview may not pass standard UTM parameters or referrer data to Google Analytics. The OAIQ SDK handles attribution on the merchant side, but integration with GA4 is not documented. Brands should test their specific setup rather than assuming standard GA4 tracking works.

What is the OAIQ SDK?
OAIQ is OpenAI's JavaScript SDK that runs on advertiser landing pages. It tracks post-click behavior (primarily contents_viewed events) and sets the __oppref attribution cookie with a 30-day TTL. It is analogous to Google's gtag.js but currently limited to view tracking in its v0.1.3 release.

How does ChatGPT decide which ads to show?
ChatGPT uses contextual targeting based on the content of the current conversation. Different conversations on different topics receive different ads, even for the same user. This is confirmed by testing that showed six different ads across six conversation topics for one account.

Should I invest in ChatGPT ads or GEO first?
The answer depends on your budget and timeline. ChatGPT ads provide immediate, measurable visibility for a per-click cost. GEO builds organic citations that compound over time without per-click costs. Most brands benefit from doing both, but if you must choose one, GEO provides a more durable asset that does not depend on ad attribution maturity.

Ready to understand your brand's organic AI visibility before investing in paid ChatGPT ads? Run a free AI visibility audit to see where you appear across ChatGPT, Gemini, Perplexity, and Google AI Overviews.

Learn more about building AI visibility as a long-term strategic asset for your brand.