A reverse-engineering analysis by researcher Buchodi suggests OpenAI has built far more than a simple ad placement system inside ChatGPT. The report describes ad units inserted directly into the conversation stream, backed by four Fernet-encrypted tokens, an advertiser-side SDK, and an in-app WebView that can continue observing user activity after a click. The tracking cookie mentioned in the analysis can remain active for 720 hours, or 30 days.
Ad units are delivered inside the chat stream
According to the research, ChatGPT responses are streamed through the /conversation endpoint using SSE, with content sent to the browser as the model generates it. The ad payload is said to travel inside that same stream as a single_advertiser_ad_unit object containing advertiser identifiers, carousel creative assets, and images hosted on OpenAI’s ad CDN.
When a user clicks an ad, the link reportedly opens inside ChatGPT’s built-in WebView instead of an external browser. That detail matters because it gives OpenAI visibility into how a user moves through the landing page after the initial click, not just whether the click happened.
Contextual targeting appears tied to live conversation topics
The researcher tested 6 conversation themes and found that ad delivery changed with the topic under discussion. Flight-related queries surfaced an Axel promotion, while NBA conversations showed a Gametime ticket ad. In this setup, targeting is not limited to isolated keywords. It is based on the context of the exchange and the user’s apparent decision stage.
That is the central claim in the analysis. Search platforms know what a user typed, and social platforms know what a user liked, but a conversational system can infer what the user is actively considering, whether that is travel planning, job switching, or a purchase decision.
Four tokens map clicks and attribution
Each ad unit reportedly carries four Fernet-encrypted tokens with separate functions. ads_spam_integrity_payload is used for server-side validation and filtering of invalid clicks. oppref serves as a forward-attribution token stored in a browser cookie for 720 hours. olref is paired with oppref for OpenAI’s internal logging. ad_data_token is a Base64-wrapped JSON object that contains another encrypted layer.
The report adds that even without decryption keys, Fernet’s public header fields can reveal token creation timestamps. That means the precise time of ad exposure may be inferred without unlocking the payload itself.
OAIQ SDK links ad exposure to merchant-site actions
The analysis also says advertiser websites automatically load OAIQ SDK v0.1.3. After reading the oppref parameter, the SDK creates a local cookie and sends user behavior events back to OpenAI’s reporting server. The result is a full attribution loop connecting ad exposure inside the chat to activity on the merchant’s own site.
The source article also cites an earlier Wall Street Journal report saying OpenAI missed user and revenue targets, with the CFO concerned about data-center bills ahead of a potential IPO. In that context, the analysis frames advertising as a revenue path that does not depend on waiting for the next GPT release.