--- title: "Who will count an AI assistant's influence: advertising attribution after the agent" kind: "Article" topic: "Attribution & credit" date: "2026-10-02" url: "https://canopticon.com/articles/who-will-count-an-ai-assistants-influence" author: "Chris Telford" license: "CC BY 4.0" --- Online advertising has changed what it charges for three times: for showing an ad, then for a click, then for a sale. Each change needed someone everyone would trust to count the new event — the website that served the ad, the search engine that logged the click, the shop whose checkout recorded the sale. The research calls that trusted counter the oracle. This article argues the fourth change has already begun: AI assistants now do the choosing, and the only company that could count what persuaded them is the AI company itself, which reports nothing. ## Three shifts, one shape Advertising has changed what it bills for three times. A research pass I ran on whether a fourth is available found that the three had one shape: each one billed on a new event closer to the buyer's actual goal (displayed → clicked → converted). Each also moved the counting of that event to a new party, which moved non-performance risk from buyer to seller. The research gives that new party a name worth keeping — the oracle, meaning the party whose record of the event everyone accepts — and traces it through the three: the publisher's ad server, then the auction platform's click redirect, then the advertiser's own confirmation page. Each shift also left a fingerprint. Every real shift produced its own signature fraud. Click fraud was CPC's; commission shaving and cookie stuffing were CPA's. If you want to know whether a new unit of value is real, look for the people cheating on it.

“Condition 1 is a business decision by roughly four companies, not a research problem.” ## How each of the three was paid for, and gamed The first shift was from paying for time on a page to paying for each ad shown. The first banner sold on the web was a flat fee: AT&T paid $30,000 for a three-month placement, a flat fee rather than a per-impression price. Ad servers made counting possible: Industry histories credit ad-server tooling with the move from flat-fee sponsorships to CPM pricing. What the count proved was narrow: CPM made waste countable, not identifiable. The advertiser carried the risk: The publisher was paid for delivery regardless of outcome. The second shift began with a search start-up. By the middle of 1998 advertisers were paying up to a dollar per click, and its founder explained: "The whole point of Internet advertising, I thought, was accountability." Google switched to it in February 2002, under a generalized second-price auction. The risk flipped: An ad nobody clicked now cost the advertiser nothing, and the platform or publisher absorbed the cost of unengaging inventory. So did the conflict: The seller now counted the billable event, which built a conflict of interest into the system. The click-fraud suit ended in a settlement capped at $90 million, and the dispute was never truly settled on the merits. The third shift handed the count to the advertiser. Paying for referrals is older than the banner: William Tobin's PC Flowers & Gifts paid referral commissions on Prodigy from 1989. The risk moved again: The publisher now does the persuading and gets paid only if the merchant's checkout converts, and the merchant's own pixel or postback reports it. The trust problem reversed with it: Under CPC, the buyer had to trust the seller's count. Under CPA, the seller has to trust the buyer's count (shaving and unreported conversions), and everyone has to trust a cookie linking two moments. That cookie is now failing. After Apple's tracking prompt arrived, one early measurement found only 4% of U.S. users allowed tracking. ## What a shift is not Most of what has been called transformation since 2002 fails the test. Real-time bidding changed who prices an impression and when (per-impression auction instead of pre-negotiated rates). It did not change what gets verified. The end of the cookie produced patches, not a paradigm. And signing — the thing every current proposal reaches for — turns out to be old: Apple has signed install postbacks since 2018, and Signing tells you *who* made a claim, not whether it is true. The research compresses the diagnostic to one question: "After this, what can the payer know that no one could know before, and who is now trusted to report it?" If the answer is "the same event, more reliably, securely or privately," it is a feature or a patch, however sophisticated. By that question, server-side conversion APIs, multi-touch models, blockchain ledgers and credential-signed receipts all land on the same side of the line. > **Objection: The pattern was drawn from the same three cases it explains** > > True, and the research says as much: three shifts are a lens, not a law. What makes the lens worth using is that it predicts something checkable about the fourth — that it will start the day a new party agrees to count the new event. Section 6 names that day. Apple's signed records are the closest precedent, and they show the limit. An analytics firm warns that "a fraudulent media partner could just replay legitimate SKAdNetwork postbacks repeatedly," and the research draws the lesson: a signature from the oracle raises integrity but does not change what is observed. Shared ledgers fared worse; the trade press concluded that blockchain "was first hyped as a kind of 'cure-all' solution for digital advertising's problems. But that was never realistic." Real-time bidding, the largest change of the period, is a different kind of thing: It made existing verification units more liquid. And for cryptographic proofs, the research found no production ZK-based attribution system in adtech or martech. ## The persuaded party has changed What is different now is not the pipe but the buyer. AI agents are becoming the party being persuaded, and the moment of persuasion now happens inside the agent's context window. That is a genuinely new unobserved event, which is the precondition for a real shift. The research is careful about why an answer engine is not just another ranking: Search ranking produced a *click* the publisher could observe and bill. An answer engine *consumes* the publisher's persuasion and presents a conclusion, so the publisher's contribution becomes an input to someone else's output. The credit question moves, in its words, from “who referred the human?” to “whose content shaped the machine's judgement?” The size of what goes unseen has a first measurement. Partnerize's 2026 index puts publisher influence in AI Overviews at an average 3.84× what click-based affiliate tracking captures, and concludes that last-click attribution "is capturing less than 30% of the publisher-influenced purchase activity." The research flags it as a vendor's proprietary metric with a commercial interest in the conclusion. Even discounted heavily, it is the first number anyone has put on persuasion that no counter sees. > **Objection: The size of the gap rests on one vendor's number** > > It does — a company with an interest in the answer measured it, and figures like it vary by source. The argument should hold the 3.84× loosely and itself firmly: it needs the gap only to be larger than zero, and no one disputes that. ## The oracle exists and will not speak So the new event meets condition one. It fails condition two, and the failure is specific: the only possible oracle is the agent platform, and no platform has publicly committed to reporting that event to third parties. The schemas are drafted — the research walks through ACP's affiliate extension, UCP's attribution field, and the publishers' Content Telemetry standard — and the same pattern repeats in each. Content Telemetry's own documentation says retrieval events "flow today, with no cooperation from the AI agent," while the four events that matter — grounding, citation, presentation, engagement — need the agent to report them, and both of its sharing flags default to false. For ACP, the research found no OpenAI statement that ChatGPT populates affiliate_attribution. The transaction protocols sign the wrong thing. AP2's mandates are verifiable credentials that prove the user authorised the purchase; a September 2026 paper titled, aptly, *Signing the Transaction but Not the Decision* shows that "ordinary product-description text can steer a shopping agent into forming a cart that passes every protocol check but no longer matches the user's request." The attacks succeeded 90%, 56% and 73.3% of the time against the default sample agents. That is condition six arriving early: a signature fraud for a unit nobody has started billing yet. > **Objection: The AI companies may simply never report it** > > That is the strongest objection, and history backs it: Google has never shared organic-ranking "influence" with publishers as a payable unit. The history of search says the platform keeps the signal. But that does not undo the argument; it decides which version of the shift arrives. If AI companies never report, influence gets paid for privately, on each platform's own terms — the closed version the next section describes. Where influence is already paid for, it is paid inside one platform. Perplexity's programme gives publishers 80% of revenue from an initial $42.5 million pool, split by visits, citations and agent actions, and another start-up pays 50% by contribution share. The research's verdict: Neither is a cross-platform standard. The open standard for reporting influence was founded by the BBC, FT, Guardian, Sky News and Telegraph. So far: No AI agent platform has publicly adopted it. Some intermediaries have announced plans, which the research calls intent, not adoption. Amazon uses neither ACP nor UCP. ## The unit, named The research names the shift that is forming, in the register of the three before it: **CPA → CPAI (cost per attested influence):** payment for a provable role in an agent's selection, rather than for a human click or a cookie-linked conversion. What would become verifiable is not whether a human clicked or a sale occurred but "which sources did the agent ground on and cite in the session that produced this purchase?" And the risk would move the way it moved in 2002 and 1996: Under CPAI, the platform becomes the oracle and takes on reporting liability. Merchants pay for demonstrated influence. Publishers stop subsidizing agents' judgement for free. What is missing is not research. Condition 1 is a business decision by roughly four companies, not a research problem. The research's own weighing of the evidence — proprietary publisher-pay programmes, default-off sharing flags, no confirmed use of the one field built for this — points to *closed, per-platform* influence payment arriving before any *open, portable* one. ## The shift starts when an AI company reports what persuaded its assistant The research ends on a test that is unusual for this field: one clear public event, either it happens or it does not. The signal to watch is specific and binary: **the first major agent platform that publicly populates signed, third-party-verifiable citation or grounding provenance on real purchases.** That event, not any new module, would mark the start of the shift. Until it happens, everything built downstream — signed offers, receipts as credentials, ledgers of one's own claims — is making the old unit harder to lie about, which is worth doing and is not a paradigm. The oracle is the only thing that cannot be built from outside. Everyone else in the chain is waiting to be told what the machine believed.