Who will count an AI assistant's influence: advertising attribution after the agent

Online advertising has changed what it charges for three times: for showing an ad, then for a click, then for a sale. Each change needed someone everyone would trust to count the new event — the website that served the ad, the search engine that logged the click, the shop whose checkout recorded the sale. The research calls that trusted counter the oracle. This article argues the fourth change has already begun: AI assistants now do the choosing, and the only company that could count what persuaded them is the AI company itself, which reports nothing.

1Three shifts, one shape

Advertising has changed what it bills for three times. A research pass I ran on whether a fourth is available found that the three had one shape: each one billed on a new event closer to the buyer's actual goal (displayed → clicked → converted). Each also moved the counting of that event to a new party, which moved non-performance risk from buyer to seller.Summary The research gives that new party a name worth keeping — the oracle, meaning the party whose record of the event everyone acceptsKey findings — and traces it through the three: the publisher's ad server, then the auction platform's click redirect, then the advertiser's own confirmation page.

Each shift also left a fingerprint. Every real shift produced its own signature fraud. Click fraud was CPC's; commission shaving and cookie stuffing were CPA's.Key findings If you want to know whether a new unit of value is real, look for the people cheating on it.

2How each of the three was paid for, and gamed

The first shift was from paying for time on a page to paying for each ad shown. The first banner sold on the web was a flat fee: AT&T paid $30,000 for a three-month placement, a flat fee rather than a per-impression price.Part A — The Historical Diagnostic Ad servers made counting possible: Industry histories credit ad-server tooling with the move from flat-fee sponsorships to CPM pricing.Part A — The Historical Diagnostic What the count proved was narrow: CPM made waste countable, not identifiable.Part A — The Historical Diagnostic The advertiser carried the risk: The publisher was paid for delivery regardless of outcome.Part A — The Historical Diagnostic

The second shift began with a search start-up. By the middle of 1998 advertisers were paying up to a dollar per clickPart A — The Historical Diagnostic, and its founder explained: "The whole point of Internet advertising, I thought, was accountability."Part A — The Historical Diagnostic Google switched to it in February 2002, under a generalized second-price auctionPart A — The Historical Diagnostic. The risk flipped: An ad nobody clicked now cost the advertiser nothing, and the platform or publisher absorbed the cost of unengaging inventory.Part A — The Historical Diagnostic So did the conflict: The seller now counted the billable event, which built a conflict of interest into the system.Part A — The Historical Diagnostic The click-fraud suit ended in a settlement capped at $90 millionPart A — The Historical Diagnostic, and the dispute was never truly settled on the merits.Part A — The Historical Diagnostic

The third shift handed the count to the advertiser. Paying for referrals is older than the banner: William Tobin's PC Flowers & Gifts paid referral commissions on Prodigy from 1989Part A — The Historical Diagnostic. The risk moved again: The publisher now does the persuading and gets paid only if the merchant's checkout converts, and the merchant's own pixel or postback reports it.Part A — The Historical Diagnostic The trust problem reversed with it: Under CPC, the buyer had to trust the seller's count. Under CPA, the seller has to trust the buyer's count (shaving and unreported conversions), and everyone has to trust a cookie linking two moments.Part A — The Historical Diagnostic That cookie is now failing. After Apple's tracking prompt arrived, one early measurement found only 4% of U.S. users allowed trackingPart A — The Historical Diagnostic.

3What a shift is not

Most of what has been called transformation since 2002 fails the test. Real-time bidding changed who prices an impression and when (per-impression auction instead of pre-negotiated rates). It did not change what gets verified.Key findings The end of the cookie produced patches, not a paradigm.Key findings And signing — the thing every current proposal reaches for — turns out to be old: Apple has signed install postbacks since 2018, and Signing tells you who made a claim, not whether it is true.Key findings

The research compresses the diagnostic to one question: "After this, what can the payer know that no one could know before, and who is now trusted to report it?" If the answer is "the same event, more reliably, securely or privately," it is a feature or a patch, however sophisticated.The diagnostic By that question, server-side conversion APIs, multi-touch models, blockchain ledgers and credential-signed receipts all land on the same side of the line.

Apple's signed records are the closest precedent, and they show the limit. An analytics firm warns that "a fraudulent media partner could just replay legitimate SKAdNetwork postbacks repeatedly,"Part A — The Historical Diagnostic and the research draws the lesson: a signature from the oracle raises integrity but does not change what is observed.Part A — The Historical Diagnostic Shared ledgers fared worse; the trade press concluded that blockchain "was first hyped as a kind of 'cure-all' solution for digital advertising's problems. But that was never realistic."Part A — The Historical Diagnostic Real-time bidding, the largest change of the period, is a different kind of thing: It made existing verification units more liquidPart A — The Historical Diagnostic. And for cryptographic proofs, the research found no production ZK-based attribution system in adtech or martechPart B — The 2026 Substrate Check.

4The persuaded party has changed

What is different now is not the pipe but the buyer. AI agents are becoming the party being persuaded, and the moment of persuasion now happens inside the agent's context window. That is a genuinely new unobserved event, which is the precondition for a real shift.Summary The research is careful about why an answer engine is not just another ranking: Search ranking produced a click the publisher could observe and bill. An answer engine consumes the publisher's persuasion and presents a conclusion, so the publisher's contribution becomes an input to someone else's output.Part B, Section 5 The credit question moves, in its words, from “who referred the human?” to “whose content shaped the machine's judgement?”

The size of what goes unseen has a first measurement. Partnerize's 2026 index puts publisher influence in AI Overviews at an average 3.84× what click-based affiliate tracking capturesPart B, Section 2, and concludes that last-click attribution "is capturing less than 30% of the publisher-influenced purchase activity."Part B, Section 2 The research flags it as a vendor's proprietary metric with a commercial interest in the conclusion. Even discounted heavily, it is the first number anyone has put on persuasion that no counter sees.

5The oracle exists and will not speak

So the new event meets condition one. It fails condition two, and the failure is specific: the only possible oracle is the agent platform, and no platform has publicly committed to reporting that event to third parties.Part B, Section 2 The schemas are drafted — the research walks through ACP's affiliate extension, UCP's attribution field, and the publishers' Content Telemetry standard — and the same pattern repeats in each. Content Telemetry's own documentation says retrieval events "flow today, with no cooperation from the AI agent,"Part B, Section 2 while the four events that matter — grounding, citation, presentation, engagement — need the agent to report them, and both of its sharing flags default to false. For ACP, the research found no OpenAI statement that ChatGPT populates affiliate_attributionPart B, Section 2.

The transaction protocols sign the wrong thing. AP2's mandates are verifiable credentials that prove the user authorised the purchase; a September 2026 paper titled, aptly, Signing the Transaction but Not the Decision shows that "ordinary product-description text can steer a shopping agent into forming a cart that passes every protocol check but no longer matches the user's request."Key findings The attacks succeeded 90%, 56% and 73.3% of the timeKey findings against the default sample agents. That is condition six arriving early: a signature fraud for a unit nobody has started billing yet.

Where influence is already paid for, it is paid inside one platform. Perplexity's programme gives publishers 80% of revenue from an initial $42.5 million pool, split by visits, citations and agent actionsPart B — The 2026 Substrate Check, and another start-up pays 50% by contribution sharePart B — The 2026 Substrate Check. The research's verdict: Neither is a cross-platform standard.Part B — The 2026 Substrate Check The open standard for reporting influence was founded by the BBC, FT, Guardian, Sky News and TelegraphPart B — The 2026 Substrate Check. So far: No AI agent platform has publicly adopted it.Part B — The 2026 Substrate Check Some intermediaries have announced plans, which the research calls intent, not adoptionPart B — The 2026 Substrate Check. Amazon uses neither ACP nor UCPPart B — The 2026 Substrate Check.

6The unit, named

The research names the shift that is forming, in the register of the three before it: CPA → CPAI (cost per attested influence): payment for a provable role in an agent's selection, rather than for a human click or a cookie-linked conversion.Part C What would become verifiable is not whether a human clicked or a sale occurred but "which sources did the agent ground on and cite in the session that produced this purchase?"Part C And the risk would move the way it moved in 2002 and 1996: Under CPAI, the platform becomes the oracle and takes on reporting liability. Merchants pay for demonstrated influence. Publishers stop subsidizing agents' judgement for free.Part C

What is missing is not research. Condition 1 is a business decision by roughly four companies, not a research problem.Part C The research's own weighing of the evidence — proprietary publisher-pay programmes, default-off sharing flags, no confirmed use of the one field built for this — points to closed, per-platform influence payment arriving before any open, portable one.Part C

7The shift starts when an AI company reports what persuaded its assistant

The research ends on a test that is unusual for this field: one clear public event, either it happens or it does not. The signal to watch is specific and binary: the first major agent platform that publicly populates signed, third-party-verifiable citation or grounding provenance on real purchases. That event, not any new module, would mark the start of the shift.Part C Until it happens, everything built downstream — signed offers, receipts as credentials, ledgers of one's own claims — is making the old unit harder to lie about, which is worth doing and is not a paradigm. The oracle is the only thing that cannot be built from outside. Everyone else in the chain is waiting to be told what the machine believed.