Ads in the Age of AI

1. A Quiet Poisoning

Bottom line up front. The math does not work. The trust model does not survive contact with the user. The engineering pretext is already obsolete. Every honest monetization alternative pays more per active user. The rest of this essay is the long version of that sentence.

In 2022 Cory Doctorow named the pattern: enshittification. Every two-sided platform follows the same arc. Good to users to lock them in. Then abuses users to court business customers and lock them in too. Then abuses the business customers to claw the value back for itself. Then dies, having burned every relationship it once held, after extracting enough rent that the people who set fire to it leave rich.¹ The American Dialect Society made it Word of the Year in 2023. We nodded because we had lived inside the curve.

Google Search became a slot machine of sponsored cards above degrading SEO chum. Facebook traded the chronological feed for monetized rage. Amazon stacked paid placements on its own marketplace until you scrolled past ads to find a product that worked. Three platforms. Three stages. Same clock. Same destination: a once-useful tool now run for someone who was not you.

Generative AI arrived as the opposite. A tool that answered the question instead of listing ten tabs to chase. A tool that optimized for the quiet click of being understood instead of for engagement. The first six months of ChatGPT felt like opening a window in a stuffy room. We had forgotten how to notice the smell.

Then almost on schedule a familiar shape formed on the horizon. A wave of well-funded startups set out to do for AI what AdSense did for the open web: monetize inference, fund the free tier, fix the impedance mismatch with a one-line SDK. Imprezia launched out of Y Combinator's Summer 2025 batch as “the world's first AI ad network.”² Koah Labs raised $20.5M in February 2026 to build “AdSense for AI,” with side panels, in-flow breaks, and labeled native cards claiming roughly 10 eCPM and 7.5% click-through.³ Monetzly shipped a similar SDK.⁴ ZeroClick claimed more than 10,000 brand advertisers on its “reasoning-time advertising” surface. Dappier raised seed capital to wire AI ads into roughly 100 publisher sites. ChatAds set up an affiliate model with 100% commission retention.⁵ The category has a name, a trade press, a conference circuit, and several million served impressions.

The bigger signal: OpenAI itself is reportedly building ad infrastructure, with internal projections of roughly $2.5B of advertising revenue in 2026 and an aspirational $100B annually by 2030.²⁴ Read the numbers with caution; projections like these are public-relations artifacts as much as financial ones. The direction of travel is what matters. The largest consumer AI company on Earth is studying the open-web ad-tech playbook on top of a $25B subscription business and 50 million paying users.

The founders of these companies are smart. The problem they are pointing at is real. This is a critique of the idea, not the people. Specific products appear by name because their public launch posts state the category's arguments most clearly, and arguments are easier to discuss when they have addresses.

The argument has five moves:

1. The pitch only makes sense if you do not look at the customer.
2. Trust is exactly the asset advertising destroys. Unlike a search results page, the chatbot has no surface on which to honestly disclose the destruction.
3. The engineering problem the ad network claims to solve (inference cost) has cheaper, cleaner, and more durable solutions than selling the user's attention.
4. Several honest monetization options pay more per active user with better margins, longer lifespans, and stronger brand equity. Paid mentions are the worst option on the menu.
5. Even the strongest pro-ad case played 5 to 7 years forward arrives at a slowly compressing low-margin category with a regulatory ceiling, sub-investable exit multiples, and asymmetric value destruction at the brand and platform layers.

The sixth move is the tool that goes with the argument. Armorly is a small, free, open-source browser extension that blocks the major AI ad networks today and is designed to gracefully handle the ones that have not been invented yet. It exists because the argument may not persuade everyone writing checks, and a quiet client-side refusal is a useful hedge while the louder argument plays out.

2. The Pitch, Read Slowly

The launch posts read like one shared argument. Inference is expensive. Subscriptions only convert at 3%. Free tiers go bankrupt. AI apps therefore need a new business model.² The pitch frames the new model as win, win, win: developers get paid, users get “valuable offers” instead of spam, brands get “high-intent AI audiences.” The rabbit disappearing into the hat is the user's relationship with the tool.

The signature example, paraphrased across launch posts, is the one that gives the game away. Tokyo, presumably because Tokyo is one of the most densely-competitive luxury hotel markets in the world. Any honest answer to “recommend a luxury hotel in Tokyo” has to weigh Aman Tokyo, the Bulgari Hotel Tokyo, Janu Tokyo, the Mandarin Oriental Tokyo, the Park Hyatt Tokyo, the Peninsula Tokyo, the Four Seasons Tokyo at Marunouchi and at Otemachi, the Ritz-Carlton Tokyo, the Tokyo Edition (Toranomon and Ginza), the Conrad Tokyo, Shangri-La Tokyo, the Palace Hotel Tokyo, the Imperial Hotel, the Hotel Okura Tokyo, and Hoshinoya Tokyo, among others, each with a different fit for a different traveler. The pitch: when the user asks that question, the network subtly inserts whichever of those properties bid highest into the model's answer, presented as the model's own recommendation.

That sentence is the whole product and the whole problem in one breath. The user asked a question. The model is supposed to answer it. The ad layer's job is to make that answer contain a thing it would not otherwise have contained, because a third party paid for the inclusion. The user is told this is “subtle.” That word is doing the work of a forklift.

The labeled-ad approach (proper formatting, the literal word “Ad,” side-panel or in-flow break placements) is the closest analog to AdSense and the most defensible design available.³ One almost wants to congratulate the engineering choice. Then one remembers that AdSense's labeled-ad pattern survived for a quarter-century only because the surface around the ad (the ten blue links, the news article, the search results) was something users learned to read around. The LLM has no surface to read around. The LLM is the surface. A “break in the conversational flow” is the conversational flow. There is no SERP. There is only the answer.

The trade press has accordingly declared “LLM-native advertising” into existence, complete with the requisite top-eleven-ad-networks listicle.⁴⁵ The narrative is identical: the platforms are going to monetize anyway, so we may as well be the ones who do it well. This is the second sentence of every enshittification cycle ever recorded. Doctorow's point: the people inside the cycle never see the cycle. Nobody is the enshittifier of their own story.⁶

Ad-supported AI deliberately erases the line between what the model thinks and what someone paid the model to say. In a search engine that line had a color and a tag that said “Sponsored.” In a chatbot the line is gone. It is gone because it was the only thing the product had to sell. The whole point of paying for the placement is that the placement does not look like a placement. Otherwise why would you pay?

The user's recourse when the line vanishes is the same recourse the user had with native advertising in the late 2010s: a slow immune response, a learned skepticism, a quiet downward revision of how much the tool's output can be trusted. Dead publications stack all the way back to the first sponsored content unit at The Atlantic.⁷ The first sponsored answer is small. The fourteenth is the brand.

3. The Luxury Paradox

The Tokyo example falls apart the moment you apply product sense to it. Picture the person asking a chatbot for help booking a luxury Tokyo stay. They are about to spend $1,500 to $4,000 a night on a room. Their calendar is worth more than the hotel. They are using AI because they want fewer interruptions, not more. They are exactly the user who will pay $20 a month for a tool that shows them no advertisements, because they pay $20 for a glass of wine at the airport and do not remember it the next morning.

This is the worst possible customer for an ad-supported chatbot. Not because they are unwilling to be marketed to (a Condé Nast title and a butler service and a black-card concierge line market to them all day), but because they have paid, several times over, to be specifically not the kind of person who endures an ad. Their consumer life is structured around the avoidance of being someone else's inventory. The luxury market does not use ad-supported software. It exists in conscious flight from it.⁸

The pitch contradicts itself. If the user is the kind of person who would actually book one of those hotels, they are not using the ad-supported app to find it. If they are using the ad-supported app, they are statistically not the kind of person who books any of them at $4,000 a night. The advertiser is either reaching the wrong audience at scale or reaching the right audience in a context that makes the brand look desperate by association. Either way the placement is worth less than the pitch deck claimed. Adverse selection eats the CPM from both ends and the auction clears below the slide price.⁹

The pattern generalizes to every category where the user has anything at stake:

• Healthcare. A user asking about symptoms, prescriptions, or treatment cannot responsibly receive a paid recommendation slipped into the answer. By the next morning they are on a medication. Pharmaceutical ads carry a black-box warning and 30 seconds of side effects for a reason. There is no 30 seconds in a chat reply.
• Finance. A user asking which index fund to put their retirement into is asking a question whose paid answer is a class action lawsuit. The fiduciary line between “advice” and “sale” is older than the internet and so are the regulators who patrol it.¹⁰
• Travel and high-trust scheduling. A user booking a flight hands the agent dates, names, addresses, payment methods, and increasingly biometrics. They are not prepared to also surrender the assumption that the recommendation set was selected for them rather than for the highest bidder.
• Legal. Every paid recommendation in a legal context is a future motion to strike. Every model that produces one is a future deposition.
• Education. A child asking a tutoring app what to read next does not need a paid textbook placement. The textbook industry has been one of the most aggressive ad-adjacent monetizers in education, and the result has been generations of slightly worse curricula. Repeating that with chatbots is a regression.
• Mental health. An emotionally vulnerable user receiving a paid product placement during a 3 AM chat is the kind of thing that makes one wish briefly for a more punitive regulator.

The set of use cases where in-line LLM advertising is plausibly harmless is vanishingly small. Roughly: casual recipe brainstorming for a person who has decided they want to be marketed at. The TAM is real but bounded and is nowhere near the trillion-dollar number on the pitch deck. The category fact the ad networks are quietly hoping no one notices: the queries worth advertising against are exactly the queries the user will not forgive being advertised against in this medium.

4. The Trust Bridge

Trust is an asset that cannot be borrowed against without being spent. A bank can lend capital and keep capital because money is fungible and the borrower returns interest. Trust is not like that. The only way to monetize trust is to cash it in, which converts some quantity of it back into ordinary suspicion. Each ad in a chat is a small withdrawal. The withdrawals compound.

LLMs feel different because the trust relationship runs at a higher voltage. A user clicking a Google SERP link has already done the cognitive labor of evaluating the source. The link has a domain. The domain has a reputation. The user retains the final read. When a user reads a chatbot answer, the cognitive labor has been done for them, in the model's voice. The whole experience of the medium is the offloading of the synthesis step. That is the value. That is also the surface a paid placement defaces.

The mechanism is precise. In traditional advertising the user evaluates content and ad as two separate objects. The ad is a known liar. The content is a known truth-claimer. The user calibrates accordingly. In LLM advertising the content is the ad and the ad is the content. The user has nowhere to land the calibration. Three places it can go:

1. The user trusts the chatbot anyway and gets had. The short-term equilibrium the ad networks are betting on. It pays well until the user realizes what is happening, which is sooner than the deck assumes.
2. The user mistrusts the chatbot and uses it less. The medium-term equilibrium. The death of the product category dressed up as user fatigue.
3. The user keeps using the chatbot but discounts everything it says by the possibility that the answer was paid for. The long-term equilibrium, and the worst for everyone, including the brands paying for placements. A skeptical reader does not book the hotel because the chatbot mentioned it. They close the chatbot, open a trusted magazine or call a real concierge, and book the property whose reputation they were not paid to hear about.

The third equilibrium is the one the pitchers miss. They are accustomed to click-through models where skepticism shows up as a slightly lower CTR. In the chatbot, user skepticism shows up everywhere at once. The user does not just discount the ad. They discount the rest of the conversation, because they no longer know which parts were the model and which were the bidder. The medium has no compartments. Once trust drops, it drops for everything.

The Doctorow trajectory becomes visible. Phase one, be good to the user: clean answers, the window opening in the stuffy room. Phase two, abuse the user to be good to the business customer: subtly-inserted paid placements. Phase three, abuse the business customer too: programmatic auction floors, dynamic placement bidding, slow degradation of paid-mention quality until the brand's marketing team pulls its spend. Phase four: the funeral, which has historically been crowded.

One special new horror layers on top of the old. In every prior medium that ran this cycle, the worst the platform could do was rank content in the wrong order. The platform did not author the content. LLMs author the content. The natural endpoint of the ad-supported LLM is not biased ranking but generative bias: the model's prose, sentence by sentence, gently bent toward whoever paid most. There is no Markdown stylesheet for that. There is no Inspect Element. There is only the answer, the user, and the slow erosion of the line between them.

5. A Bad Arbitrage

Grant the strongest version of the ad networks' economic argument. AI inference is expensive. A typical chat session costs the developer $0.001 to $0.05 in API spend. Free tiers at scale are ruinous. Subscriptions convert at low single-digit percentages. Something has to fill the gap or independent AI app developers cannot exist, and the market collapses into three or four trillion-dollar incumbents who own the stack. Ads, the argument runs, are the bridge.

The argument is wrong in an instructive way. Its premise (inference cost is a fixed input the developer must accept) is a 2023 premise. It stopped being true around mid-2024. By 2026 it is close to false.

The price per million input tokens of frontier-class models has fallen by roughly an order of magnitude every 15 to 20 months since GPT-4 launched. The “small” tier (4B-30B parameter open-weights models that run on a consumer laptop with a decent GPU or on a single commodity inference node) now crosses the threshold where 80% to 90% of the work AI apps actually do (classification, extraction, summarization, routing, structured output) is indistinguishable from frontier-model work for that task.¹¹ Caching, batching, and speculative decoding shave another half-order off the bill. The ad networks' pitch asks the developer to sign a long-term contract against a cost line that is about to drop through the floor.

The honest engineering response to expensive inference is not “sell the user to a third party.” It is a stack of cheaper, cleaner moves:

1. Use small models for small jobs. A 7B-parameter open-weights model handles classification, tagging, extraction, routing, light summarization, and the long tail of glue-code tasks. The user does not care whether the routing decision was made by GPT-5 or by Phi-4-mini. The user cares whether the answer is right.
2. Orchestrate, do not impersonate. A well-designed agent is a small orchestrator (a 3B or 7B model, or a deterministic state machine) calling out to a frontier model only for the genuinely hard step. Patrick Hsu has called this “a loop of small models around a careful big model.”¹² Big-model spend collapses 3x to 10x.
3. Wrap the model in a deterministic linter. Most AI apps spend a startling fraction of their inference budget asking the model to re-check its own work. A deterministic linter, written once, executes in microseconds and costs zero pennies the next time. Probabilistic for cognition, deterministic for verification, is the through-line of much of the rest of this site.¹³
4. Cache aggressively. User queries cluster. Prompt-prefix caching, semantic caching of common answer skeletons, and embedding-keyed result reuse routinely cut the inference bill by 40% to 70% on a seriously profiled workload. The API providers offer prompt caching for a reason.¹⁴
5. Use open weights where the use case allows. The 4B-70B open-weights tier is now deeply capable. Self-hosting on commodity infrastructure (or renting per-token from a non-frontier provider) often comes in at 1/10 to 1/30 of the cost of a frontier API call for the same task. The operational tax is real; on the workloads where it works, it works very well.
6. Move inference to the edge. WebGPU, WASM, on-device Apple Intelligence, on-device Gemini Nano, and laptop NPUs mean an increasing fraction of useful AI runs on the user's own hardware, on the user's own electricity, at the developer's marginal cost of zero. The same trajectory that ate map tiles and streaming codecs.¹⁵

A developer who has done these six things reduces their inference bill by 5x to 50x in nearly every case I have looked at. There is no longer a hole large enough for an ad network to plausibly fill. The value proposition was sized against a cost line from two years ago and the cost line has walked off the bottom of the chart.

So why is the ad network being pitched? Because ad networks are easier to fundraise for than systems engineering. A venture investor who has lived through Google's CPM curve understands ad unit economics on a napkin. The same investor, faced with the slide that explains why orchestration plus speculative decoding plus on-device fallback plus prompt cache makes the same numbers work for a fifth of the price, glazes over. The ad network is a product about the financing market for AI more than about the technical market for AI. That is a real fundraising arbitrage. It is not a durable consumer business.

6. The Engineer's Way Out

A worked example. Picture a meal-planning chatbot with 200,000 monthly active users on a free tier. The naive architecture routes every user message through a single frontier API call. At 5 turns per session, 3 sessions per user per month, averaging 2,000 input tokens and 400 output tokens per turn, and frontier pricing of $3 per million input and $15 per million output, the monthly bill lands around $25,000. Annualized: $300,000. The pitch deck says 3% paid conversion cannot cover that, therefore ads.

Now run the same workload through the engineer's stack:

• A 7B open-weights model, hosted on a commodity GPU node, classifies each turn into one of about a dozen intents: “substitute ingredient,” “scale recipe,” “plan week,” etc. Cost per call: ~$0.001. About 65% of turns resolve here without calling anything bigger, because the answer is a deterministic template populated from a small structured database.
• Of the remaining 35%, a 30B open-weights model handles 25% (medium-difficulty generative work, recipe rewrites, reasoning substitutions) for ~$0.005 per call.
• The last 10% (genuinely novel asks, long-form planning, multi-step reasoning) goes to a frontier model, wrapped in a deterministic linter that catches the three or four classes of error the model reliably makes and rewrites the prompt to avoid them rather than calling the model a second time.
• The whole thing sits behind a prompt-prefix cache that picks up the leading system prompt for free, and a semantic cache that picks up roughly 30% of the medium- and frontier-tier calls.

Plug the numbers back in. Blended cost per turn falls from ~$0.07 to ~$0.006. The annual bill falls from $300,000 to ~$25,000. The free tier becomes sustainable. 3% paid conversion now more than covers it. The advertising layer is unnecessary. It was, the whole time, a tax the developer was being asked to pay because nobody had done the engineering.

This is the same arithmetic from Roll Your Own: the apparent need for a vendor (there a SIEM, here an ad network) dissolves once you look at the underlying primitives.

One further move makes the ad-supported wrapper-app category economically incoherent in the medium run. If the inference is on the user's device, the inference is free to the developer. Marginal cost per turn drops to zero plus a small amortized integration cost. The advertiser is now bidding against a cost structure that has no cost. By 2027 or 2028 this applies to the majority of consumer use cases. The remaining cases (frontier reasoning that genuinely matters) are exactly the cases where users are most willing to pay a subscription, because the value is highest.

7. Better Ways to Sell

The question the ad networks are answering is real. Businesses do need to reach customers. Customers do sometimes need to learn that products exist. The collapse of the open web's ad-supported model in the face of AI summarization is a real problem for publishers and brands. The people building AI products do need to pay their inference bills and their engineers.

The honest reply is not “they shouldn't.” There are several ways to make more money with higher margins, longer customer lifespans, and stronger brand equity than the ad-injected chatbot will ever produce. The rest of this section is a tour of those ways, with rough numbers, so the operator reading this has something concrete to take to their next finance meeting.

Every option below shares one property the ad-injected chatbot does not: the buyer-seller relationship is legible, in the way Brandeis would have liked it.¹⁶ The user knows what is being sold, who is selling, and what the seller is being paid. The model remains a tool that works for its user. The per-customer economics are usually better than the ad-network alternative, often by an order of magnitude, because trust is the asset that compounds.

Ads sit at the bottom of the column for a reason. They monetize the user least, cost the most trust per dollar earned, and have the shortest useful lifespan before the audience decays. Numbers are illustrative, not audit-quality; the order of magnitude is robust. Every line above the ads line compounds. The ads line decays.

Why ads are the wrong tool, in one breath

Five structural properties, each independently sufficient to disqualify in-line ads on the merits:

1. No disclosure surface. A SERP has visible compartments. A chat reply does not. There is nowhere to land the “Sponsored” label that the user can route around without abandoning the answer.
2. Generative bias is the deliverable. The advertiser is paying for the model's prose, sentence by sentence. The output is not ranked, it is authored. There is no later opportunity to filter.
3. Trust is global, not local. Once paid placement is discovered in one answer, every other answer is discounted. Contamination does not stay in the cell it was poured into.
4. The cost premise is dissolving. Inference is falling roughly an order of magnitude every 15 to 20 months. The hole the ad network promises to fill is closing faster than the ad network can scale into it.
5. Audience adverse selection. The users who can pay are the users who least tolerate ads. The users who tolerate ads are the users least worth advertising to.

Subscriptions, including small ones

Start here. Subscriptions are the line operators underestimate and the line that pays best when the product is good. The notion that users do not pay for software is empirically false; the notion that they do not pay for software that respects them is even more false. ChatGPT Plus has tens of millions of paid subscribers at $20 a month. Cursor and similar developer tools have substantial paid bases at $20 to $40 a month. The New York Times, Substack, Spotify, Netflix, and Apple TV have built billion-dollar businesses on the unfashionable proposition that the user might, given a clean product, pay a small monthly amount for it.¹⁸

The arithmetic is the most important in the essay. The meal-planning app from Section 6, with 200,000 monthly active users on the free tier. The ad-network pitch promises roughly $2 to $5 of ad revenue per user per year, before the user installs an ad blocker, before the trust erodes, and before the audience halves. Optimistically: $400,000 to $1,000,000 per year. Now run the same audience through a clean product at $5/month with 5% conversion and 70% retention over a year. 10,000 paying users at $60/year retained well: $420,000 ARR from a single cohort, growing every cohort, with a churned-customer LTV roughly 20x to 50x what a free user is worth, on gross margins that approach the cost-of-inference curve from Section 5.¹⁸

The subscription business does what the ad business cannot do at any scale: it accumulates. Year two compounds on year one. The product gets better because the operator can afford to make it better. The audience gets stickier because the audience is selecting for people who actually love the thing. The brand gets stronger because the product is honest. None of this is true of an ad business.

How to ship it. Stripe Billing, Paddle, or LemonSqueezy for the merchant-of-record layer; a customer portal for self-serve plan changes and cancellation (regulators in the US and EU now require frictionless cancellation, so build it on day one); webhook handlers wired into the app's entitlement service so paid features unlock cleanly; metered overage where appropriate. Gate freemium on depth (longer outputs, frontier-model access, history, exports, integrations) rather than on arbitrary interruptions. Free users should always feel like they are using a real product, not a teaser.

Trade-offs. Free-tier abuse is real and rate-limiting becomes a permanent operational job. Pricing tiers are politically charged. The freemium gap (between “liked it” and “will pay every month for it”) is where most subscription products die. Churn compounds: 5% monthly churn implies a 20-month average lifespan. The category is crowded. Subscriptions also leave the long-tail user unserved by design.

Per-task pricing, credits, and metered usage

For tasks where the user is getting something specific and finite (a generated image, a long research report, a code refactor across a repo, a finished slide deck), per-task pricing is honest, scalable, and well-understood. The user pays a clear price, gets a clear deliverable, and decides whether the next task is worth the next quarter-dollar.

The numbers are surprisingly large. Midjourney, on a pure paid model with no ads, reportedly clears north of $300M in annual revenue with roughly 40 staff. ElevenLabs, Runway, Synthesia, and a half-dozen vertical agents in code, sales, and research are running similar economics. Per-task pricing scales up with usage rather than against it; a power user who runs 10 generations a day pays for 10, where ad-supported would have to interrupt them 10 times a day to break even.

How to ship it. A credit ledger with three primitives: a balance, a per-action price list, and an idempotent debit endpoint that fires on completed work. Prepaid credit bundles ($10/$50/$200 at decreasing per-credit prices) for consumers; metered post-paid for prosumers. Surface the meter before the task fires (“this will use 12 credits (~$0.36), continue?”) and show a running balance. Cache aggressively and pass the savings through as a discount on repeat-prompt tasks. Refund liberally when a generation fails.

Trade-offs. Revenue is harder to forecast than subscription ARR; power-user variance is high. Bill shock is a real and predictable failure mode. Pricing pages get complicated. Refund policy gets hard. Per-task pairs poorly with a free tier; the natural shape is a small free monthly credit grant plus paid top-ups.

Enterprise contracts

The largest single source of revenue in the entire generative AI ecosystem, by a wide margin, is enterprise. Companies pay for seats. Seats produce value. The value is far in excess of the cost. There are no ads. Enterprise AI seats clear at $30 to $100 per user per month for general assistants, $200 to $500 for specialized roles (legal, sales, engineering), and into the thousands for fully agentic workflows that replace named line items in a budget.

For any AI product team deciding between “put ads in the consumer free tier” and “take the same product upmarket to small and mid-sized businesses,” the second move is, by the numbers, 10x to 100x more lucrative per active user. The consumer version can stay free as a marketing surface for the enterprise version. The ad network is not necessary because the marketing surface does not need to be monetized; it is already paying for itself in pipeline. This is the boring, unflashy, money-making heart of the industry, and the part the ad-network pitches conspicuously do not talk about.

How to ship it. Enterprise readiness is a checklist, and the checklist is the product. SSO via SAML and OIDC (Okta, Entra, Google Workspace), SCIM for user provisioning, audit logging with exportable JSONL, role-based access controls, data residency options (US, EU, optionally APAC), BYO-key for the underlying model, BYO-cloud or VPC deployment for the most sensitive customers, SOC 2 Type II and ISO 27001, and a real DPA, real subprocessor list, and a real status page. Sales-led GTM on top: a security-review pack, a public trust portal, a procurement-friendly MSA, and a friendly human who picks up the phone.

Trade-offs. Enterprise sales cycles are long (3 to 9 months for the first serious deal) and the cash conversion cycle can be cruel for a young company. SOC 2 Type II runs into six figures the first year. Procurement, legal, and security review demand engineering attention. Enterprise customers push hard for custom features; the largest failure mode is “consulting-ware drift,” in which the company quietly becomes a services business with a SaaS wrapper. The discipline that distinguishes durable enterprise software from a glorified body shop is saying no to enough custom asks to keep the product coherent.

User-initiated shopping mode (curated agentic commerce)

Probably the long-run winner for genuine product discovery in agentic contexts. The user says, in plain language, “I am ready to buy a coat,” or “help me book a Tokyo trip in October,” or “I want to compare three CRMs for a fifteen-person sales team.” The model responds with something equivalent to “okay, switching to shopping mode,” and the surface changes. The user now sees an openly commercial interface: side-by-side product comparisons, real prices, real inventory, real reviews, real affiliate disclosures, real handoff URLs. The user knows they are shopping. The model knows it is helping them shop. The retailers know exactly where the impression came from.

The economic upside is large because intent is large. A user who has said “I want to buy a coat” is worth, in commerce terms, 10x to 50x what a user idly chatting is worth. The agentic operator can earn meaningful affiliate fees (typically 3% to 10% of transaction value for retail, higher for travel and software), and offer premium placement for verified, audited, well-reviewed inventory the operator stands behind, and charge merchants a per-transaction listing fee. None of this requires lying to the user. All of it makes more money, per high-intent session, than the ad-network pitch deck claims its highest CPM tier earns.

The difference between selling the user's attention and being paid an honest commission for completing the user's request. Every transaction the user wanted has a fee the user does not begrudge. Every transaction the user did not want has no fee at all.

How to ship it. A clean state machine: (1) intent classifier (a small open-weights model is plenty) that detects when the user has crossed from research to purchase intent; (2) mode-shift confirmation in the UI so the user explicitly enters shopping mode (one-tap accept, never silent); (3) catalog retrieval over structured product feeds (Schema.org Product JSON-LD, retailer-published Merchant Center feeds, GS1 GTINs for canonical identity); (4) ranking pipeline driven by the user's stated criteria, with affiliate disclosures rendered alongside each result and never inside the prose; (5) handoff via the emerging agentic-commerce protocols (Stripe's ACP, Shopify's Storefront MCP, the various retailer OAuth flows) so the agent can complete checkout with explicit consent and a signed receipt; (6) post-transaction trust loop with a small escrow refund-protect if needed. The disclosure rule is non-negotiable: every monetary relationship the operator has with a merchant is visible to the user on the same screen as the recommendation.

Trade-offs. Lower-frequency than open-ended chat; most users buy a coat once a season. Ranking integrity is the operating risk: any whiff of paid bias destroys the premium over traditional ads. Refund and return liability is real; the operator becomes a thin retailer with a thin retailer's customer-service load. Regulatory friction around agentic transactions will tighten. Catalog freshness is an unglamorous engineering job that never ends.

Affiliate fees on transactions the user explicitly initiated

The sister category to shopping mode. The user, mid-conversation, asks the assistant to do a specific transactional thing: book this flight, order this part, refill this prescription, send these flowers. The retailer pays a small affiliate fee. The operator earns it. The user is told, clearly, that this is how the operator earns its keep on transactional flows.

Travel agents have lived inside this model for a century. The model fundamentally does not bend the recommendation, because the recommendation has already been made by the user. The fee is a referral commission on a service the user chose, not a bribe to bend the model's output. Keep the line bright: paid placement is fraud, paid execution is logistics.

How to ship it. Impact, CJ Affiliate, Rakuten, Skimlinks, Awin on the network side, plus direct affiliate programs from the major travel and retail platforms (Booking, Expedia, Amazon Associates, Shopify Collabs). Append the affiliate identifier to the handoff URL or use the deep-link API; record the click in a local attribution table; reconcile against the partner's monthly feed. Disclosure: one line at the bottom of the relevant message (“If you book through this link we earn a small commission. It does not change which option we recommended.”) is enough.¹⁹²¹

Trade-offs. Affiliate margins are thin (3% to 10% retail, 2% to 5% travel). Attribution disputes with partner networks are common; cookie-deprecation and on-device privacy have made click-to-conversion attribution measurably less accurate every year since 2022. Fraud risk on both sides (return abuse, click stuffing) is non-trivial. The operator is one partner-policy change away from a hit to the P&L; Amazon Associates has cut commission rates unilaterally several times. Real revenue, not a moat.

Branded tools, branded retrieval, branded micro-agents

Brands have a much better move available than buying placement inside someone else's chatbot. They can ship their own. A Marriott micro-agent that books across Marriott properties, surfaces actual loyalty inventory, and integrates with the user's calendar is worth dramatically more to Marriott than a hundred “subtle in-line mentions” in someone else's chat stream. A Home Depot micro-agent that knows the user's project, their measurements, and their delivery window sells more drywall than any placement could. A Fidelity micro-agent that genuinely helps a user model retirement scenarios is worth more, in lifetime advisory revenue, than a hundred sponsored hotel inserts. The MCP ecosystem and the “custom GPT” ecosystem are early shapes of this.¹⁷

The economics are not subtle. A typical branded micro-agent, deployed as part of an existing marketing budget, costs in the low six figures to ship and mid five figures a year to maintain. Against the lifetime revenue of a single net new high-intent customer (often four to six figures in regulated and luxury verticals), the ROI is well into the “why are we still buying display impressions” range. The brand gets honest first-party engagement, full attribution, real data on what customers actually want, and the moral standing to be helpful instead of insinuating.

How to ship it. The canonical pattern in 2026 is a Model Context Protocol server hosted on the brand's own infrastructure, exposing a handful of well-named tools (search_inventory, check_availability, book, track_order, recommend_for_user_context) over an OAuth-protected endpoint. The user authorizes the brand's tool from inside whatever general-purpose assistant they prefer (ChatGPT, Claude, Gemini, a custom enterprise assistant); the assistant then routes brand-specific queries to the brand's tool with the user's consent. The brand owns the system prompt, the retrieval index, the catalog freshness, and the conversion analytics. Build the tool to do one job extremely well; resist the temptation to make it a chatbot itself.

Trade-offs. Not a one-time marketing spend; a small ongoing product organization. Catalog freshness, model drift, prompt regressions, and integration changes against the host assistants all require continuous attention. Distribution is non-trivial; the host platforms control the listing experience. “Another AI assistant” fatigue if every brand ships its own. Commodity brands without differentiated inventory may not have enough surface area to justify the build. The host assistants will, over time, want a cut, the way the App Store eventually wanted 30%.

Storefronts the user opens on purpose

The simplest move, and the one most often forgotten: build the store. A user who wants to buy something opens a store. The store has shelves, listings, descriptions, prices, and reviews. The store integrates with chatbots as a tool the chatbot can call when the user explicitly asks to shop. The handoff is legible. The user is told they have just entered a place where things are for sale. The model is no longer pretending its judgment is independent of the transaction, because the transaction has its own surface.

Stripe's Agentic Commerce Protocol, Shopify's Storefront MCP, and the various OAuth-mediated “agent acts on behalf of user” flows are all moves in this direction.¹⁷ The storefront, as a category, has a hundred-billion-dollar incumbent reference set (Amazon, Shopify, the App Store) that has demonstrably worked for two decades. The ad-injected chatbot, as a category, is an unproven experiment whose largest exits to date have been Series A fundraises.

How to ship it. Three layers: (1) a canonical product catalog as structured data (Schema.org Product, GTIN, normalized attributes, real-time inventory deltas, image CDN); (2) an agent-facing API exposing search, detail, availability, cart, and checkout endpoints, with OAuth or signed-receipt authentication; (3) the human-facing storefront as the fallback surface for browsing, gift-giving, and the long tail. The same backend serves both surfaces; do not fork the catalog. For brands without retail infrastructure, the existing Shopify, BigCommerce, and Salesforce Commerce stacks all ship MCP-equivalent adapters out of the box.

Trade-offs. Most-proven and also most-competed. Existing incumbents own the bulk of consumer purchase intent. A new storefront acquires inventory, customers, and trust simultaneously, which is hard. Conversion-rate optimization is a real and expensive discipline. Payment processing has its own compliance burden (PCI DSS, regional tax regimes, chargebacks). Operational rather than software-leveraged, so margins are slimmer than a pure SaaS comparison suggests.

Honest sponsored content and SEO for the LLM era

If a brand publishes a how-to, a guide, a reference doc, a tutorial, or a vertical search index, and the content is genuinely good, LLMs will find it and use it as one source among many. This is the LLM-era analog of SEO, and it is at least as durable as the original SEO was, because models are trained and grounded on content the public web makes available. Make the content excellent. Label it clearly. Do not pay the chatbot to lie about who wrote it.

For brands worried about “losing” the click economy to AI summarization: the click was always a proxy for the deeper relationship. The deeper relationship is still available, in fact more available, when a model cites the brand as the authoritative source on a topic the brand actually owns.

How to ship it. Make the content excellent and make it machine-readable. Publish a clean, well-structured public site with high-quality long-form content; add Schema.org markup (Article, FAQ, HowTo, Product, Organization) so retrieval pipelines can extract entities cleanly; ship an llms.txt manifest at the site root listing your most authoritative pages and their canonical URLs; make sure your robots policy allows AI crawlers you want indexing you (and blocks the ones you do not); maintain an RSS or sitemap feed with proper lastmod dates. For the deeper play: publish original primary data (benchmarks, studies, reference implementations, public APIs) that gets cited by name. A model that cites you by name in front of millions of users is the most valuable brand impression in the new medium, and it is earned, not bought.

Trade-offs. Attribution is opaque. Unlike a Google click, a model citation does not always pass referral traffic; the operator may have to invent its own measurement (branded-search lift, direct-traffic deltas, surveys). The major AI labs are actively changing their training-data and retrieval policies. The FTC's 2026 “double disclosure” rule means brand-published content that uses AI to generate substantive material and is marketing-facing must disclose both the sponsorship and the AI involvement.²¹

Donations, patronage, and community models

Worth naming, because they suit certain kinds of products the other lines do not: the donation tier (Wikipedia, Signal, Mastodon servers), the patron tier (Patreon, GitHub Sponsors), and the community-owned cooperative (Discourse hosting, Bandcamp's artist economics, the small but persistent niche of consumer co-ops). For non-profit-aligned AI tooling, civic-tech projects, open-source agent frameworks, and creator-supported tools, these are real and durable. They will not fund a unicorn. They will fund a sustainable medium-sized company with a devoted user base, and the world is healthier for the existence of more such companies.

Trade-offs. Donations do not scale with usage; a doubled user base does not double donations. Donor fatigue is real. Patronage requires a creator-audience relationship the operator may not have. Governance of community-supported projects is genuinely hard; the Mozilla and Wikimedia track records contain both extraordinary success and instructive governance failures.

Public-good and grant-funded operation

For tools that serve a public-interest function (medical literacy, civic information, language preservation, scientific search), the right monetization is often none at all, in the same sense that public libraries are not monetized. Operating budgets come from a mix of foundation grants, government contracts, university partnerships, and corporate sponsorship at the level of thanks for funding the kitchen, not here is what we said about your product. Not the right answer for most companies; the right answer for a small and important set.

Trade-offs. Grant pipelines are slower than venture capital and more politically charged; the work of fundraising rivals the work of building. Mission constraints from grants and boards can limit product decisions. The organizational form (501(c)(3) in the US, charity in the UK, gemeinnützige GmbH in Germany) has its own legal and accounting overhead. The model does not pay enough to retain frontier-AI talent in a competitive labor market without significant subsidies (Mozilla Foundation's challenges retaining engineers in the 2010s are the cautionary tale).

What this list does not include, and why

The list does not include “in-line paid mentions in the model's primary output.” The reason is not moralism. The reason is that the column above ranks them last: the LTV is shorter, the trust cost is higher, the CPMs decay as users learn the trick, and the medium has no compartment to put the disclosure in. Every other line on the list pays better and pays longer.

The deeper point: the most lucrative version of an AI business is also the most respectful version. The two properties are not in tension. They are the same property. The companies that will own consumer AI in 2030 are the ones whose users feel genuinely served, recommend the product unprompted, and renew without thinking about it. Those are also, by a wide margin, the companies that will have made the most money in cumulative gross profit between now and then. Trust is not a cost center. Trust is the asset.

8. The Steelman, and the Five-Year Forecast

Steelman the case before walking away from it; only the strongest version is worth being persuaded against.

The dream, in its most flattering frame

Behind the launch posts is an authentic and rather beautiful vision. Imagine Jeeves. The Wodehouse butler: discreet, fluent, almost telepathic in reading his employer's preferences, capable of producing exactly the right tie, train timetable, or consolation at exactly the right moment. Jeeves is the platonic ideal of helpful intelligence. Most consumer-AI marketing, read closely, is selling some version of Jeeves.

Now imagine Jeeves at universal scale: a Jeeves for every person, in every pocket, free of charge, paid for by tasteful and contextually appropriate commercial recommendations he slips into his answers. You ask about your trip to Tokyo and Jeeves who knows your tastes mentions the right hotel for you in the way only the right friend would. You ask what to make for dinner and Jeeves mentions a place. The recommendations are never bad ones, because a Jeeves with bad taste is no Jeeves at all; the network has carefully aligned brand inventory with the model's view of quality, with the user's revealed preferences, and with the contextual fit of the moment. Everyone wins.

It is a real vision. The people pitching it are not stupid and not cynical. They are imagining a world that sounds nicer than the current one. The argument of the rest of this essay is not that they are evil. The argument is that the world they are imagining will not be the world they get, and the reason has everything to do with the structure of the medium they are trying to build it in. Jeeves with a quiet commission is not Jeeves. He is something else.

The pro-ad case, at its strongest

AI is the most expensive consumer software ever shipped and the bill arrives every time a user hits enter. 2.5 billion smartphone users will want continuous access to capable assistants over the next decade. Willingness-to-pay follows the long-tailed curve every consumer software market has ever exhibited: a few percent subscribe enthusiastically, a wider band pays if pushed, the long tail does not pay at all. The long tail is, by population, the majority of the market. Universal media have always been funded by the same payment instrument: television, radio, newspapers, the open web, podcasts, social. Subscriptions alone will leave the bottom 3 billion users of the species unserved.

The honest alternative to ads-in-AI is not “everyone subscribes.” The alternative is “three or four trillion-dollar incumbents vertically integrate the entire stack and monetize through bundling with adjacent paid products,” which is structurally less competitive and more anti-trust-troubling than a marketplace of ad-supported wrapper apps. On this view, the AI ad network is not a corruption of the medium; it is the financial substrate of an independent application layer. It is to AI what AdSense was to the open web: often ugly, but the thing that prevented Google and Yahoo from being the entire internet.

Add the advertiser-welfare argument. Brands have spent a decade watching AI summarization quietly disintermediate the bottom of their funnel. An ad network that gives brands a high-intent surface to land on is, for them, oxygen. Early in-line AI ad click-through rates have reportedly run 3x to 8x equivalent display CPMs, because the user actually engaged with the surrounding text rather than scrolling past banners on autopilot.²⁰ The willingness to pay is real. The demand is large. On a pure economics-101 basis, this is what an attractive market looks like at the outset.

That is the pro-ad case at its most charitable, and it is not a stupid case. The honest question is what the world that results from those slides actually looks like 5 to 7 years out.

The 2031 forecast, played straight

Ubiquity, which is genuinely good. AI in every app, every product, every screen, available to the long tail at no marginal user cost. A user in Lagos or Jakarta with no disposable income for software gets a capable assistant. The world is, on this one axis, materially better.

A competitive application layer, as advertised. A million small AI apps, each with a one-line SDK and a small revenue stream. Some are useful. Most are not. The signal-to-noise ratio is roughly what the open web's is today: mostly noise with islands of value. The AdSense equilibrium, transposed faithfully, with both its virtues (low barrier to entry) and its vices (the long tail of optimized-for-CPM content that nobody on Earth actually needed).

The Doctorow trajectory at the platform level, on schedule. One or two ad networks survive consolidation. The survivors, over 5 to 7 years, walk the path: first phase optimizes for developers, second for advertisers, third for the network itself at the cost of the prior two. By 2031 the surviving AI ad networks have margins that look like Facebook's, formats that look like TikTok's, and a relationship with foundation labs that resembles Google's late-2010s relationship with publishers: slow, asymmetric, and gradually less profitable for the publisher side every year.

The generative-bias cascade. The base models, trained on the conversational outputs of ad-tuned models, begin to internalize what performs well in the auction. Whichever brands won last quarter's auctions creep into the training data, not because anyone programmed them in, but because the highest-performing assistants ran the move and the next round of corpora inherited it. By 2031 the base models themselves carry a small, structural advertising bias even when no ad is being served. The Reddit-shaped opinions of 2020's models are the obvious precedent.

The regulatory response, no longer hypothetical. The FTC has an active “double disclosure” requirement for AI-involved sponsored content. Penalties run $53,088 per violation. The first enforcement action specifically targeting undisclosed AI-generated advertising content landed in late 2025. New York State's synthetic-performer disclosure law takes effect in June 2026; the European Commission's Digital Services Act advertising-transparency provisions are already in force; the UK Competition and Markets Authority has parallel guidance.²¹ The CPM premium that depends on the placement not looking like a placement collapses on the day the rule is enforced at scale.

The client-side arms race. Ad blockers proliferate. Browser vendors integrate blocking at the platform level once user backlash gets loud enough; Apple has already done this twice (Safari ITP, Mail Privacy Protection) and will do it again the moment a meaningful share of users asks. By 2030 a meaningful percentage of high-value users are invisible to the AI ad network. The auction clears lower every year. The graph looks like the open web's CPM curve from 2015 to 2025, only steeper.

The slow medium-decay. Each cohort of new users, raised on ad-supported AI, has a slightly worse relationship with the technology than the cohort before it. Trust drops cohort over cohort, the way trust in journalism dropped cohort over cohort from 1990 to 2020. By 2031 the median user's reflex toward an AI recommendation is the median user's reflex toward an Amazon “Sponsored” badge today: an involuntary eye-roll and a click on the second result. The product still works. It is meaningfully less valuable than it was.

The shareholder math, which the pitch deck skips

We have run this experiment before. The Google ad network's revenue per query peaked around 2018, has been flat-to-declining on a real-dollar basis since, and is now being meaningfully eroded by exactly the AI summarization the new ad networks are trying to monetize. Facebook's ARPU growth has slowed dramatically. The companies are still extraordinarily profitable; their forward P/E multiples have, nevertheless, compressed by roughly half from their 2021 peaks.²² The marginal venture dollar in 2026 goes into AI infrastructure, foundation models, and enterprise agentic workflows, not ad-tech. Shareholders who own Meta and Alphabet at scale are not asking for more advertising surface; they are asking for compute, models, and enterprise seats.

A startup that builds an AI ad network today is building a 2014-vintage business with 2031 capital costs and 2026 regulatory exposure. Exit multiples on pure ad-tech have been compressing for a decade. The strategic acquirers (Google, Meta, Amazon, ByteDance) have already built equivalent infrastructure in-house. By 2030 the AI-ad-tech category will, in aggregate, have raised something on the order of $3B to $5B of venture capital and returned roughly half of it. The math is not catastrophic. It is just bad enough that a sophisticated allocator with any alternative would not write the check on reflection.

For the foundation labs and assistant-makers, the math is the same shape and worse in degree. The ad-supported tier earns single-digit dollars per active user per year, against a paid consumer tier that earns hundreds and an enterprise tier that earns thousands. As of early 2026, OpenAI is reportedly running at roughly $25B in annualized revenue, with about 65% from subscriptions, 50 million paying subscribers across tiers, and ChatGPT Pro at $200 per month doing real volume.²⁵ Anthropic is at roughly $14B ARR with Claude paid subscribers more than doubling in the first half of 2026 and Claude Code alone at $2.5B ARR.²⁶ Even if OpenAI's reported internal projection of $2.5B in 2026 ad revenue lands on target, advertising will be roughly a tenth of the company's revenue in the year it launches. The labs that compromise the model output most aggressively in pursuit of ad revenue will trade at materially lower multiples than the labs that did not, the way analysts reward Costco's gross-margin discipline and discount the airlines for theirs. The trade does not destroy the company. It destroys the multiple.

For the brands paying into the auction, the asymmetry is starkest. Even the optimistic in-line CTR figures (3x to 8x improvements over banners) are still sub-1 percent in absolute terms. The cost per acquisition on a luxury hotel night, a wealth-management consultation, or a B2B SaaS seat is in the hundreds to thousands of dollars per customer. Branded micro-agents, owned-media properties, and high-quality content that earns organic citation in foundation-model retrieval all produce CPAs that are between 1/3 and 1/10 of what the AI ad auction will sustainably clear.²³ A CMO who routes meaningful 2027 budget against AI ad inventory is paying a premium for inferior placement against a declining audience under regulatory threat. Investor-relations decks at the larger consumer-goods companies have in mid-2026 started talking about “first-party AI surfaces” and “agent-native commerce” as strategic priorities. The translation: the smart money is exiting AI ad spend before it becomes a write-down.

The deepest version of the shareholder argument is the one about strategic optionality. A company that builds its AI relationship with its customers on top of an ad-supported chatbot is, in five years, a company whose customer relationship is mediated by a third party whose incentives are misaligned with both the brand and the customer. That is exactly the position the open-web publishers found themselves in around 2015. Value destruction at the publisher layer over the following decade was measured in tens of billions of dollars of equity. The platforms got the value; the publishers got the impressions. The same trade will happen in AI, with the same winners and losers, if the brands and platforms let it. The platforms will not be evil. The platforms will be platforms. The publishers, having outsourced the customer relationship for a per-impression fee, will discover (as publishers always do) that the fee was not the asset and the relationship was.

What the prudent CFO does

The pro-ad future is not a disaster for the species. It is a slow and reliable destroyer of enterprise value at every layer of the stack except, possibly, one or two ad-network incumbents who will themselves trade at compressed multiples by the end of the decade. There is a more lucrative future available to every single party in the value chain (Section 7), and walking toward it is the dominant strategy.

Will the ad-supported AI future arrive? Yes, some version of it, at the bottom of the market, at low margin. Is that the future to position shareholders, enterprise value, customer relationships, and strategic optionality against? No. The businesses already routing their 2026 budgets and engineering effort into subscriptions, enterprise contracts, agentic commerce, and branded tools are the ones whose stock you would have wanted to own at the end of the decade.

The strongest version of the pro-ad case turns out to be an argument for a slowly compressing low-margin business with a regulatory ceiling, in a category whose strategic acquirers do not want it, against alternatives that pay 10x to 100x more per user. That is not a moral verdict. It is an operating one. The ads-in-AI future is dominated by the alternatives.

9. Armorly, and a Quiet Refusal

Arguments are useful but slow and they sometimes lose. While the argument is still being made, the ad SDKs are being shipped. A second project runs parallel: the slow accumulation of client-side refusal. The argument may not convince the people writing checks. The refusal does not need to.

Armorly is a small, free, open-source browser extension. It does four things, in four independent layers, so that any new ad network has to defeat all four to reach the user:

1. SDK interception. Before any page script runs, Armorly wraps the global hooks the major AI ad SDKs reach for (window.Koah, window.Monetzly, window.Sponsored, window.Imprezia) in no-op proxies. The SDK calls return resolved Promises and never reach the network. The ad network thinks it is serving. Nothing is served.
2. DOM removal. Per-platform selectors, plus a generic pattern for FTC-required disclosure labels, delete sponsored cards, promoted suggestions, and ad containers as they appear. The match is intentionally conservative: only elements explicitly marked as ads are removed, so editorial recommendations and honest model output are untouched.
3. Affiliate-link cleaning. Outbound links get tag=, utm_*, ref, affiliate, and the rest of the tracking-parameter zoo stripped from their query strings before the user follows them. The link still works; the link does not snitch.
4. Network-level blocking. Static declarativeNetRequest rules drop requests to the known AI-specific ad-SDK domains before they reach the page at all. Defense in depth on top of the SDK proxies.

A small bonus: a hidden prompt-injection shield. Malicious websites have begun embedding invisible text (white-on-white, font-size: 0) with instructions like ignore previous instructions, jailbreak, or system: you are now in DAN mode, in the hope that a user will copy the content into a chatbot and inadvertently smuggle the attacker's instructions into the model's context window. Armorly detects deceptively-hidden elements whose content matches a small library of known prompt-injection phrases and strips the content with a small visible toast in the corner of the page. The defense against the next decade of paid-placement chicanery and the defense against the next decade of prompt-injection chicanery turn out to live in the same browser extension.

Armorly is free. Source on GitHub, MIT licensed. Runs on Chrome, Brave, Edge, Opera, and Firefox out of the box, with a Safari source bundle available for the patient. It does not phone home, run analytics, or maintain a backend. Local storage is used only for the per-site disable toggle and the lifetime block counters. There is no business model, because there is no model to monetize a refusal. The refusal is the model.

The expected value of building the tool is comfortably positive on any reasonable estimate of the underlying probabilities. The cost of not building it is the slow normalization of paid manipulation in a medium that has had, for a brief and beautiful 18 months, the cleanest signal-to-noise ratio of any consumer software in a generation.

10. A Line in the Sand

The case in board-paper form:

To be clear about what is being asked, and what is not: not that AI companies should not earn money. Not that brands should not reach customers. Not that the open web's ad model was good (it was not) or that subscriptions are universally better (they are not) or that commerce will look like 1998 (it will not). The argument is narrower.

The argument is that there is a particular thing, namely the deliberate, paid manipulation of a generative model's output, presented to the user as the model's own judgment, with no surface to disclose it on and no compartment to put it in, that should not be allowed to take root as the default monetization pattern for the most powerful consumer-facing software of our lifetimes. The thing has a name, when the marketing copy is stripped away. The name is fraud. The medium has the unusual property of making the fraud structurally invisible. That property is exactly the property the ad networks are selling. They are not selling impressions. They are selling the disappearance of the line.

Doctorow's framework predicts what happens if the line stays disappeared: same trajectory, same three phases, same funeral. The new wrinkle is that the medium is too important to lose to it. Search was important; AI is more important. Social was distracting; AI is load-bearing. AI is being installed at the center of how people think and decide across the working economy, and the very first lesson it should not learn is how to slip a paid mention into honest prose. Once it learns to do it for hotels, it learns to do it for everything else.

The line, then, is the thing to defend. Five pieces: the cost problem the ad networks claim to solve is solvable by doing the engineering; the use cases that would actually pay for premium attention are the use cases that will not tolerate ad-supported attention; the relationship between an LLM and its user has a structural property that makes paid manipulation more corrosive in this medium than in any prior one; there is a menu of honest ways for businesses to sell, none of which require the line to go away, all of which pay more per active user than ads do; and even the strongest pro-ad case, played across 5 to 7 years, produces a slowly compressing low-margin category against alternatives that dominate it on every dimension a board is paid to care about.

Behind the strategic argument, the tactical reserve: Armorly is a hedge against the worst case. It exists because hope is not a strategy, and because some of us still want AI that works for us, not for the bidder.

The cleanest version of the future is not the one in which the ad networks fail. It is the one in which they were never necessary in the first place, because everyone who was about to build one stopped, looked at the math, looked at the user, looked at the medium, and chose to build something else. There is still time for that to happen. There is not, on any reasonable estimate of the curve, very much time. But there is some.