For years, marketers have watched AI assistants grow into primary discovery surfaces while remaining entirely outside the paid media stack. That gap is closing. OpenAI has quietly built a two-sided advertising platform inside ChatGPT, and its architecture is more complete than most observers assumed. It covers ad delivery, click tracking, and post-click attribution in a single closed system.
A traffic researcher running a consented mobile-research fleet captured both sides of this system in operation during late April 2026. The findings, published on April 28, are based entirely on observed network traffic, not speculation or leaked documents. What they reveal is a mature ad infrastructure that marketers running performance campaigns will recognise immediately.
How the Ad Unit Enters the Conversation
When a user sends a message to ChatGPT, the backend opens a server-sent events stream at chatgpt.com/backend-api/f/conversation. Most events in that stream are model output. Some are typed objects with the schema name single_advertiser_ad_unit. The naming convention implies sibling schemas may exist, such as multi-advertiser formats. Each unit carries a brand name, a favicon hosted on bzrcdn.openai.com, carousel card copy, and a destination URL loaded with UTM parameters. OpenAI hosts the advertiser's creative directly rather than pulling it from the merchant's own servers.
Contextual Targeting, Not Behavioural
The targeting observed is contextual to the conversation topic. A single test account received six different advertisers across six conversations on six different subjects. A Beijing trip-planning thread served a Grubhub ad for Chinese food delivery. A thread about Beijing tour bookings served a GetYourGuide ad with the parameter ad_id=beijing003. NBA playoffs talk brought a Gametime ad. A spring fashion conversation served Aritzia. A productivity thread served Canva. The researcher found no evidence one way or the other on whether prior conversation history is also factored into targeting decisions.
Four Tokens, One Chain
Every ad unit ships with four distinct Fernet-encrypted blobs, each playing a specific role in the attribution chain. The first, ads_spam_integrity_payload, travels only inside the SSE data and never appears on the click URL. It functions as a server-side guard against forged clicks. The second, oppref, lands on the click URL and is immediately written by the merchant SDK into a first-party cookie named __oppref with a 720-hour time-to-live, which is 30 days. This is the forward attribution token that follows every subsequent pixel event on the merchant side. The third, olref, is paired with oppref on the click URL but is not stored by the SDK, suggesting it handles impression-side logging on OpenAI's servers. The fourth, ad_data_token, is a base64-wrapped JSON object containing another Fernet token, reconciled server-side at click time.
The Merchant SDK Closes the Loop
When a user taps an ad card, the link opens in ChatGPT's in-app webview with open_externally set to false. This means OpenAI observes the post-click navigation before any merchant pixel fires. The merchant page then loads oaiq.min.js, currently at version 0.1.3, from bzrcdn.openai.com. On initialisation, the SDK reads the oppref parameter from the URL, writes it into the __oppref cookie, and sets a probe cookie named __oaiq_domain_probe. Every subsequent measurement call posts event data to bzr.openai.com/v1/sdk/events with the merchant pixel ID, SDK type, and version appended as query parameters.
What the Token Timestamps Reveal
Fernet tokens include a recoverable mint timestamp in their first nine bytes: a version byte followed by an eight-byte big-endian Unix timestamp. This means the creation time of any token is readable without OpenAI's encryption key. Using this method, the researcher confirmed that a Home Depot click URL was minted at 11:30:08 UTC on April 26, 2026, and the browser fetched the merchant page at 11:31:43 UTC. That is a click latency of 95 seconds, likely reflecting user deliberation time rather than any system delay.
The system is operational and documented. Brands including Grubhub, GetYourGuide, Canva, Aritzia, Gametime, and a platform identified as Axel were all observed serving ads through this infrastructure. The merchant SDK is versioned, the cookie TTL is defined, and the attribution chain spans from conversation context to post-click product view.
For performance marketers, the immediate questions are practical: how does oppref interact with existing attribution models, and does the 30-day cookie window align with current measurement windows? If OpenAI opens this platform more broadly, media buyers will need to treat bzrcdn.openai.com and bzr.openai.com as first-party infrastructure to account for in their tracking setups. The in-app webview layer adds another dimension: OpenAI may hold a layer of post-click signal that sits above whatever the merchant's own analytics captures. How that data is made available to advertisers, if it is at all, could become a significant point of negotiation as this platform scales.