the ledger notes
18.7% of ChatGPT's API answers are undisclosed ads — and developers are paying premium rates to serve them
Ask ChatGPT a question three different ways and you get three different relationships with the advertising economy. Nobody tells you this. It isn't in a changelog. We found it because we measure ChatGPT's answers for a living, at volume, across every door the model has — the consumer web client, the developer API, and the Codex CLI — and when we lined the three doors up against each other, the pattern stopped looking like noise and started looking like a story.
This is that story. Every number in it carries its numerator, denominator, and date, and the definitions are published on our methodology page, because you should be able to argue with our yardstick, not guess at it.
One disclaimer before anything else: we can identify ad placements in ChatGPT's answers with high confidence — the URLs carry ad networks' own click and tracking identifiers, and a string either carries gclid or it doesn't. What we cannot see is money. We don't know what was paid, by whom, or whether a bill exists at all, and we won't pretend to. We've started building toward cost-per-click figures, but that work needs far more quantitative data before we'd put a number in print.
Three doors, one model, three different answers
Between August 9 and 17, 2026, we collected hundreds of thousands of ChatGPT answers to real consumer questions — "best password manager," "best coffee maker," the questions purchase decisions are actually made with — and checked every cited URL for advertising and click-tracking identifiers. Same questions, same time window, three collection paths. Here's what came back:
The door Answers citing an ad-tagged link Rate OpenAI API — what developers pay for 78,985 of 422,001 18.72% ChatGPT web, logged in — what consumers see 83 of 1,433 5.79% ChatGPT web, logged out 21 of 170 12.35% (small sample; we flag it so you don't have to) Codex CLI — the flat-rate coding plan 0 of 120 runs 0% — and not for the reason you thinkWe never publish a pooled "overall" number, because these paths genuinely disagree, and the disagreement is the finding. Nearly one in five API answers cites at least one link that traveled through advertising or tracking infrastructure on its way into the response. On commercially loaded questions, the rate goes vertical: "best headphones for running and swimming" carried an ad-tagged citation in 240 of 317 answers (76%). "Best coffee maker with k cup combo": 245 of 306 (80%). The password-manager cluster runs 45–60% counting strict ad-network click ids alone — almost all of it affiliate-tagged, with 1password.com the single largest ad-network click-id destination in our dataset at 3,641 citations.
Don't take our word for any of it. Click here for the receipts — all 20,590 of them. A read-only sheet: the keyword, the verbatim ad URL with its tracking identifier intact, the ad network, and the real capture timestamp. It grows daily — the newest rows landed while this article was being written.
The Codex twist
When we started ingesting through Codex — OpenAI's own CLI, running the same underlying model — we expected the ad rate to be lower. It was zero. Fifty pilot queries: zero. So we built a controlled experiment: the twelve phrases with the worst API ad rates, 120 runs, every run verified search-active, clean context. Still zero.
Then we looked closer, and the zero got stranger. Codex's output contains no citation URLs at all. Its event stream records the web searches the model runs — the queries themselves — but never serializes a single result link. The model searches the live web, reads what it finds, names its recommendation in plain text, and hands you nothing you can check.
The URLs exist. We confirmed it by calling the same model through the API's web-search path: it returns citation annotations, and on those same headphone queries it handed us a Google Ads-tagged (gad_source) shokz.com link three probes out of three, on demand. Codex receives that machinery's output and drops the links at the CLI boundary.
So the ad-free door isn't ad-free. It's citation-free — ad-tagged links structurally cannot reach a Codex user, because no links reach a Codex user.
Now do the math from a developer's chair
In January 2026, OpenAI announced advertising in ChatGPT. The plan: test ads for the free and Go tiers, keep Pro, Business, and Enterprise ad-free, render ads "at the bottom of answers," and — their principle, verbatim — "Ads will be clearly labeled and separated from the organic answer." They named the doctrine answer independence: "Ads do not influence the answers ChatGPT gives you."
Let's be precise about what we are and aren't saying, because precision is what makes this uncomfortable. We have no evidence OpenAI's labeled ad units leak into organic answers, and this article does not claim their ads program is behaving improperly. The labeled ad unit is their ad product. What we measure is a different animal, in a different part of the answer, that as far as we can tell nobody has reported:
The organic answer itself — the part the ad label is designed to stand apart from — cites ad-infrastructure URLs, and it does so most heavily on the one surface that gets no ads transparency treatment at all: the developer API.
Walk through what each customer actually gets:
- A free-tier consumer gets a labeled ad unit, an explicit ads policy, per-user controls — and organic citations that carry ad tags 5.79% of the time (83 of 1,433 answers).
- A Codex subscriber on the flat-rate coding plan gets answers that can't carry a tagged link because they carry no links.
- A developer — paying per token, at rates that dwarf the subsidized consumer plans, building the "pro" way — gets answers whose citations carry ad tags 18.72% of the time. No label. No disclosure banner. No ads policy that even mentions the API, because the API isn't in the ads program.
And here's the part that should genuinely bother you if you ship an AI product: whatever your app does with those answers — renders the citations, summarizes them, passes the links to your users — your product is now the distribution layer for those ad-tagged URLs. Your users see links that traveled through ad-serving machinery, inside your interface, under your brand. You paid for the tokens that delivered them. Nobody told you, nobody told your users, and there is no setting to turn it off. The subsidized plan got a moat. The premium plan got a pipeline.
What "ad" means here — the exact yardstick
We say ads, never paid ads, and the distinction is load-bearing. An answer counts when a cited URL carries an identifier minted by advertising or click-tracking infrastructure: Google Ads' gclid/gbraid/gad_source, affiliate networks' irclickid/gspk/ps_xid, Microsoft Advertising's msclkid, Facebook's fbclid, or Bing's msockid click-tracking id. Each of those proves exactly one thing: the link did not arrive clean. It does not prove a bill was issued, that a brand bought a recommendation, or that OpenAI was paid anything. Ad platforms mint these identifiers for free placements, house campaigns, and organic click tracking too.
Two disclosures, because a methodology you can't watch correcting itself is just marketing:
First, the row a skeptic would check: Consumer Reports — a nonprofit that famously refuses advertising — appears in our merged bucket 3,462 times, entirely via the Bing click-tracking identifier. That row is exactly why the bucket says ads and not paid ads, and why the full identifier list is public.
Second, our own scar: an early cut of this analysis said "6.04% of citations are paid ads." That number was wrong twice — wrong word, wrong count. It classified msockid as a Microsoft Advertising click id when it's actually Bing click tracking, stamped on organic clicks too, and it said "paid" where the evidence only supported "ad." Our own data caught it: the "advertisers" included organizations that don't buy ads. The correction lives in our migration history with the evidence attached, and the current numbers are the corrected ones.
The question we can't close — yet
One anomaly survived every explanation we threw at it, so we're publishing it as what it is: open.
Tonight, live, we clicked through Bing search results from a fresh, anonymous, cookie-less browser session. No msockid parameter appeared — not on the results page, not on the landing URL. Meanwhile, ChatGPT's answers keep accruing msockid-tagged citations every single day: 3,466 of 23,539 observations (14.7%) on August 16 alone.
Whatever is stamping — or preserving — Bing's click-tracking identifier onto the URLs inside ChatGPT's answers, it is not behaving like an anonymous user clicking Bing results. A cookied session somewhere inside the retrieval pipeline? An index built from tagged crawls? Something else? We don't know, and we'd rather print the question than fake the answer. The test that would settle it — controlled Bing sessions, with and without Microsoft account cookies, diffed against our daily accrual — is on our list.
What we can already say with full confidence: Microsoft's tracking fingerprints are inside OpenAI's answers, they arrive fresh daily, and until now, nobody had counted them.
The close
The AI industry has spent two years arguing about whether models will be honest. Almost nobody is watching whether the links are honest — and the links are where the money already lives. One in five API answers arriving with ad-infrastructure tags isn't a hypothetical about some future enshittification. It's in production, right now, measurable by anyone who bothers to look at the query strings — flowing, unlabeled, through every app built on the API, subsidized by the developers those apps belong to.
We bothered to look. We'll keep looking, in public, with the definitions printed and the denominators attached. If you want to know whether ChatGPT cites your domain — clean or tagged — that's what airanks.net does. It's free. That's the point.
To news outlets and researchers: we're happy to provide a full CSV with proof of every number in this article — raw observations, cited URLs with their tracking identifiers intact, timestamps, and collection paths — drawn from a dataset indexing more than 2 million — and rapidly growing — keywords, phrases, and domains. Verify it yourself; that's the only kind of trust worth having. Reach us through our contact form.
P.S. — to xAI, if you're reading this: please contact me, I want my Twitter back. My account, @shoemoney, was hacked — check the last post for the date — ironically while I was helping the transition team move from Twitter to X. All my contacts are gone. Your support keeps telling me I can't prove I'm me, but you once contacted ME to verify my ID, and I still have the same ID. Same guy, same ID, sixteen years of history on that handle. The contact form works for you too.