It’s just the cellular version of a wifi captive portal: https://en.wikipedia.org/wiki/Captive_portal

Simple version is the network router firewalls traffic to anything except the ad server, and the ad server will have a trigger to change the firewall. There are some technical nuances to how you handle DNS and also redirecting from other web pages (if desired) without breaking things. But that’s the gist of it.