ChatGPT Ad Tracking Cookie Follows Users Across Third-Party Advertiser Websites

OpenAI’s advertising measurement system appears to use a cross-site cookie that can link activity on advertiser websites to a person’s ChatGPT account.

The cookie, named __obi, is created. At the same time, a user visits ChatGPT and can later be sent back to OpenAI when that user loads sites running OpenAI’s advertising pixel.

The mechanism was independently reproduced on a mobile device and observed across 936 advertiser pixels on 1,029 hostnames. It resembles the cross-site conversion tracking used by major ad platforms. However, its connection to an AI service raises new privacy questions.

When a user opens ChatGPT, the client generates a random identifier and requests a short-lived signed token from OpenAI’s backend. The token contains an account-linked subject value, an obi identifier, and a consent decision marked as analytics_allowed.

ChatGPT then sends the token to bzr.openai.com, an OpenAI advertising collector believed to use the internal name “Bazaar.” The collector responds by setting the __obi cookie for the .openai.com domain.

The cookie is configured with SameSite=None and Secure, allowing browsers to include it in cross-site requests. It also has a maximum lifetime of one year.

This configuration makes __obi different from OpenAI’s other cookies, which were reportedly blocked during third-party requests because of domain restrictions or SameSite=Lax settings.

Advertisers that buy ChatGPT ads can add OpenAI’s measurement pixel to their websites. The pixel loads code from OpenAI infrastructure and sends conversion events to bzr.openai.com.

When a visitor already has the __obi cookie, the browser may attach the identifier to those requests automatically. That means OpenAI can receive information about pages a user visits on third-party advertiser sites, including product pages, article URLs, purchase funnels, and conversion events.

Although query strings were removed from observed URLs, page paths remained visible. Those paths reportedly included pages related to medical conditions, debt solutions, and legal-intake services.

The advertising software also collects data from advertiser pages. It can receive data intentionally passed by advertisers. It may scrape information from forms, rendered page content, and tag manager systems.

According to Buchodi, observed data included hashed email addresses, phone numbers, names, and location-related fields. Country, region, city, and postal code could be transmitted in plain text.

OpenAI’s pixel reportedly monitors the window.dataLayer, Adobe’s data layer, and renamed Google Tag Manager layers. In observed traffic, automatically scraped identity information appeared more frequently than advertiser-supplied data.

The tracking can work even when a person is not logged in. Anonymous users receive a device-linked subject identifier that remained stable for at least 27 days. However, the mechanism was primarily tested on Chrome for Android.

Safari’s Intelligent Tracking Prevention blocks third-party cookies, meaning the tracking method should not operate in Safari or iOS browsers based on WebKit.

OpenAI’s cookie policy lists __obi as an analytics cookie, not a marketing cookie. The observed sync tokens were issued when analytics consent was granted, including cases where marketing consent had reportedly been denied.

OpenAI acknowledged a privacy inquiry but did not provide a detailed response on the classification or consent behavior at the time of reporting.

Cut every SOC alert investigation by 21 min. Power your SOC with instant IOC context for immediate response: Integrate TI Lookup in your SOC