AI content tracking: a new standard names five stages, and a site can observe one of them

What the specification defines, and what it refuses to

The document states the problem it is for in five numbered lines. There is no standard way to track which content was retrieved and loaded into an agent's context, to tell content that was explicitly cited apart from content that silently influenced a response, to measure influence from retrieval through to engagement, to provide data that could inform compensation, or to verify platform-reported usage independently. The last of those is the one a measurement tool should read twice: the specification exists in part because the party with the data is the party being measured.

What it defines is a schema, licensed Apache 2.0, with no vendor-specific dependencies. Its normative references include ordinary infrastructure: RFC 2119 and RFC 8174 for requirement words, RFC 9562 for identifiers, RFC 3339 for timestamps, and JSON Schema draft 2020-12 for validation. There are three actors, named by position in the value chain rather than by industry: the content owner on the supply side, the intermediary in the middle, and the agent on the demand side. The end user is explicitly not a participant, and the document says no actor reports the end user's identity.

The refusals matter as much as the definitions, and they are unusually clear. The specification does not define attribution algorithms, does not mandate privacy policies, and does not require a particular transport. It also places training outside its scope. A crawl whose purpose is training can be reported as a retrieval event, and the purpose field distinguishes it, but the document states that nothing in the specification reports that a model was trained on a work, and that a conforming implementation says nothing either way about it. Querying an index at answer time is inside scope; building that index is not.

This is a different layer from the files a site already serves. RSL writes a licence into robots.txt and changes no access. ai.txt carries 22 policy fields with the training default set to deny. Cloudflare's content signals are read by one of ten of its own endpoints, and the IETF's AI preferences work is still arguing about how a preference attaches to content at all. All of those state a preference before access. Telemetry is the other end: it reports what happened after, and the specification calls itself the reporting counterpart to the access protocols rather than a replacement for them.

Can AI content tracking run from your own server?

For one of the five stages, yes, and the specification is explicit about it. Retrieval events carry a source_role field with four values: origin for the content owner's web server, edge for a CDN or edge compute layer, index for a search index or repository that served the content, and agent for the AI agent reporting its own fetch. The document says the origin and edge roles let content owners report AI agent traffic using their existing infrastructure, with no cooperation from the AI agent required, and that the Retrieval conformance level can be implemented using CDN edge compute.

For three of the five, no, and not as a matter of adoption. The specification states that grounded, cited and presented events are reported by the agent or agent operator only, because they describe what happened inside the agent, during output construction, or on a recipient-facing surface, which is not observable from the content owner's infrastructure. It goes further and closes the obvious workaround: a third party that detects source content in a delivered output is corroborating or contradicting the emitter's claim rather than observing construction, and the document assigns such detection to verification tooling rather than to these event types. Engagement sits between the two cases. It is usually the agent's to report, and the specification says a destination site may report a corroborating engagement for a click-out using a context token in place of a session identifier.

The project states the same division in plainer words outside the specification. Its README annotates the retrieved stage with the note that a content owner can see this today, then says that whether the content entered a generation context, whether it was cited, whether anything was made perceivable, and whether anyone interacted with that presentation is not reported back to content owners. It adds that platforms self-report usage metrics if they report at all, and that content owners have no way to verify the numbers or compare across platforms.

Correlation between a site's own view and the agent's is meant to run through one request header. An agent fetching content should send Content-Telemetry-ID carrying a UUID, as defined in RFC 9562, and then put the same value on its own retrieval event, so a consumer can group the two reports of one fetch. The document notes the honest failure mode: HTTP clients typically do not forward custom headers through redirects, so a site whose paywall or short links redirect may never see the header at all, and it advises instrumenting the earliest handler in the chain rather than only the final origin.

The header also does something a blocking rule cannot. Its presence signals that the requesting agent participates in the protocol, and its absence indicates a fetcher that is unaware of it or has chosen not to take part, a distinction the specification says content owners can use without blocking any traffic. That is a cleaner version of a problem this blog keeps measuring. A user agent is a claim, not an identity, a crawler declares three things and proves one, and only two of nine AI crawler vendors publish a key directory to make verification possible. A UUID in a header is not proof of identity either, and the specification does not claim it is.

No corpus hostname served a telemetry manifest

The specification gives its discovery file one address. A manifest is served as JSON at https://<domain>/.well-known/content-telemetry.json, it declares a schema_version of 1.0, one or more roles from content_owner, agent and platform, and an operator object, and it may declare telemetry endpoints, signing keys and the domains the participant claims. Trust derives from TLS and DNS control of the domain, and manifests are unsigned in version 1. A fixed path and a published schema make this checkable from outside, which is the only reason this section can exist.

Lantad asked all 1,419 hostnames in this repository's two committed corpus seed files for that path on 24 October 2026, as LantadBot, following redirects and executing no JavaScript. Not one returned a document carrying a schema_version, roles or operator field. 928 answered HTTP 404 and 228 refused the request with 403. 43 answered 503, 30 timed out and 20 did not resolve. The rest were spread across 400 on 21, 202 on seven, 429 on six, 500 on five, 401 and 406 on three each, and single instances of eight further status codes and four further transport failures.

The interesting residue is the 113 that answered HTTP 200. 111 of them sent an HTML page, one sent text/plain, and exactly one sent a parseable JSON object: two fields reading gpc true and a lastUpdate of 2023-12-15, which is a privacy signalling document rather than a telemetry manifest. So a 200 on this path is not evidence that a manifest exists, and a checker that counted status codes would have reported 113 adopters on a day when there were none. We have measured that failure before from the other direction: 125 of 1,094 sites answered a URL that does not exist with HTTP 200.

A zero on a path defined fifty two days earlier is a baseline, not an indictment, and it would be dishonest to dress it up as one. It is worth recording for the same reason the earlier probe was: 1 of these 1,419 sites published an agent card, and that one is why the number is a measurement rather than an assumption. This corpus is a stratified sample of platforms and industries rather than a census of the web, the sampling frames are committed in this repository, and the per-crawler identity we fetch with is published at our own bot page. What this site will and will not publish from samples like it is set out under research.

Coverage is a declaration, not a guarantee

The part of this specification that a measurement tool should read closest is not the schema. It is section 5.7, where the document separates what an emitter can do from what it actually did. Conformance runs in three levels, each named for the event it adds. Retrieval proves the emitter produces retrieval events, Grounding adds grounding and turn events, and Citation adds explicit citation events. The levels are cumulative, and the authoritative declaration lives in the emitter's manifest rather than on individual documents.

Then comes the sentence that does the work. A conformance level does not assert that every qualifying occurrence was reported. Reporting coverage is a separate and explicit declaration, stated as one of four modes: complete, where every qualifying occurrence is emitted; sampled, under a stated sampling rule; aggregated, through a stated aggregation rule; and selected, where only occurrences meeting a further stated condition are emitted. The rule has to be objectively decidable at emission time and must not depend on the emitter's discretion in the moment. And the consequence is written in the requirement language of RFC 2119: a consumer must not treat the absence of an event as evidence that no occurrence happened, except where complete coverage applies.

The governance files keep that lever out of the standard itself. The repository states that the wire format carries no SPUR-specific normative content, and that accreditation and the conformance mark are defined in a separate SPUR Content Telemetry Profile, which the README says requires event-level delivery and does not permit aggregation. The standard therefore supplies the vocabulary for declaring coverage, and a profile is where a group of publishers can refuse the weaker modes. That is a workable way to keep one document neutral while letting a community demand more than the floor.

That is the same discipline this product applies to its own output, which is why we will not grade a page we could not measure. A missing row is not a zero. The specification extends it to ratios: retrieval to grounding, grounding to citation, citation to presentation and presentation to engagement are all computed over reported events, and the document says they are comparable across emitters only at known coverage. A dashboard that charts those ratios without the coverage declaration beside them is charting two different things on one axis.

The schema is also careful about what a count means. Grounding and citation are described as independent signals, and the document works an example: one article grounded with session scope, ten user questions, three citations, which produces one grounding event, ten completed turn events and three citation events. Whether that is one royalty event, three or ten is left to the commercial agreement. Three cases also break the funnel outright, and the specification says emitters should report what happened rather than force the order: a sources panel presented without any citation, a presentation of content that never entered a context, and a hallucinated citation with no grounding event behind it, which consumers should treat as a lower-confidence signal. That last case is measurable from the outside only as a contradiction, which is roughly where we landed when more citations did not mean more of the page in the answer, and it is the same gap an IETF compliance record makes falsifiable rather than true. What Lantad scores instead, and why, is written up in the methodology.

What a site owner can check today

Nothing in this specification is deployable against an agent that has not implemented it, and on 24 October 2026 no corpus site was publishing the manifest that would announce participation. The retrieval half, though, depends on infrastructure a site either has or does not, and that is checkable now.

Lantad requested the home page of all 1,419 corpus hostnames on 24 October 2026 as LantadBot and read the response headers. 1,373 answered with an HTTP status, 1,078 of those with a 200, and 46 did not answer at all, being 20 that did not resolve, 25 that timed out and one whose connection failed. 787 of the 1,373 carried at least one response header naming an edge platform, keyed on a vendor-specific header or a server header naming the vendor. Attributed that way, 436 named Cloudflare, 145 Amazon CloudFront, 121 Akamai, 69 Vercel, 28 Azure, 22 Netlify and 9 Fastly. 43 responses carried headers naming two or more platforms, which is why those counts sum past the total and why this is a grouping rather than a vendor census.

That figure is the ceiling on the easy path, not a readiness score. It says 787 of these sites already have a layer in the request path where the specification says retrieval reporting can run without the agent's agreement, and it says nothing about whether anyone would switch it on. The cheaper question first is whether a site can see AI agent requests at all, which is where the per-crawler verdicts from our robots.txt tester and the token list behind our AI crawlers page are the useful starting point, and where a CDN sitting in front of an origin is a double-edged thing: we have measured 103 of 1,089 sites serving an unknown bot while refusing GPTBot at exactly that layer.

Three checks follow from the document rather than from us. Whether your redirect chain drops custom request headers, because the specification warns that it usually does and that instrumentation belongs at the first handler. Whether your cache revalidation is in order, since the specification counts a 304 with no new representation as no new retrieval occurrence, and 391 of 1,101 home pages offered a crawler nothing to revalidate against. And whether anyone at your end would receive a report, which is an organisational question the schema cannot answer.

What Lantad does not measure, and will not claim to: none of grounding, citation, presentation or engagement. We receive telemetry from no agent, this site is not a telemetry consumer, and the three middle events are not observable from where we stand, which is the specification's position and not a limitation we discovered. What we can measure is the retrieval side of AI visibility, which is the half that was always ours to see.