ChatGPT now knows what you do on other websites via ad collector
Recorded: Sept. 20, 2026, 5 p.m.
| Original | Summarized |
ChatGPT now knows what you do on other websites via ad collector Home Sign in 20 Sep 2026 ChatGPT now knows what you do on other websites via ad collector OpenAI's ad collector at bzr.openai.com sets a cookie called __obi, scoped to .openai.com. The value is while you are on ChatGPT and tied to your ChatGPT account. __obi is then sent to OpenAI from ordinary websites you visit.Any company that buys ads on ChatGPT installs a small piece of OpenAI code on its own site, the same way retailers already install Meta and Google tracking code. Loading that code, sends __obi to OpenAI along with data about the page you are browsing. This includes products you are searching for, articles you are reading, and purchase behaviors.The bottom line is that OpenAI can connect what you do on those sites to your ChatGPT account.I reproduced the full mechanism on my own phone, verified with two independent capture methods, and cross-checked against several months of observed traffic covering 936 distinct advertiser pixels across 1,029 hostnames.How it worksStep 1. ChatGPT creates an identifier and signs it.On chatgpt.com, the client generates 16 random bytes and calls POST /backend-api/bazaar/obi/sync-token (or /backend-anon/ when signed out). The backend returns an RS256 JWT:{ Request GET bzrcdn.openai.com/sdk/oaiq.min.js POST bzr.openai.com/v1/sdk/events with obref POST bzr.openai.com/v1/sdk/events, bare body GET bzrcdn.openai.com/pixel-config/… The first row is particularly interesting. The pixel SDK has a code path that omits credentials, and it does not help: the browser attaches cookies to the <script src> request that loads the SDK before any of OpenAI's code runs. By the virtue of loading the tag the identifier is disclosed.What travels with itThe same SDK also collects identity from the advertiser's page. The payload separates four sources, labelled by OpenAI itself: in for values the advertiser passes deliberately, and fm, ht, js for values the SDK scrapes from form fields, rendered page text, and the tag-manager bus. In observed traffic, scraped identity outnumbered advertiser-supplied identity 685 events to 255.The tag-manager bus is the largest source of email. The SDK replaces window.dataLayer.push with its own function, also reads adobeDataLayer, and locates renamed GTM layers by parsing the l= parameter off the gtm.js script tag. Current versions take email and phone from it. Version 0.1.31 also took names and geography before the scope was narrowed on 27 August.Email, phone, first and last name are SHA-256 hashed before transmission. Country, region, city and postal code are sent in the clear. Postal code was the most-harvested form field, 100 events across 28 sites.URLs are reduced to origin plus path before sending; none of 23,929 observed carried a query string. Paths survive, and paths reaching the collector included a medical condition, a debt-solutions funnel and a litigation intake form.Automatic matching was enabled for 638 of 881 pixels with a known setting, including every credit and lending advertiser observed. It is controlled from OpenAI's Ads Manager. A denylist excludes passwords, one-time codes, card numbers, SSN, date of birth, medical history, diagnosis and court fields.The cookie is built to cross sitesOn the same advertiser-page requests, every other OpenAI cookie was blocked by the browser: Cookie oai-did, oaicom-stable-id oai-client-auth-info, session cookies __obi __obi is the only OpenAI identifier configured with SameSite=None.Observed reachOn my device, one __obi value was sent to OpenAI from 12 commercial websites under 13 distinct pixel IDs, including Chewy, Wayfair, ThriftBooks, Eventbrite, HelloFresh, Coursera and SeatGeek. Every request was accepted with 202.In the broader traffic, 12 of 30 distinct __obi values appeared under more than one advertiser, one under ten.It works when you are logged outAcross 932 decoded sync tokens, 736 carried subject_type: account_user and 196 carried anonymous. The anonymous subject is as stable as the account subject: one per device, persisting at least 27 days.What OpenAI's cookie policy saysOpenAI's cookie policy lists __obi under Analytics cookies, one year, on chatgpt.com and openai.com. It is the only entry in that section. The policy describes analytics cookies as helping OpenAI understand how its services perform and are used.OpenAI runs analytics and marketing as two separate consent choices, oai_consent_analytics and oai_consent_marketing, and every sync token I decoded carried consent_decision: analytics_allowed. Someone who allows analytics and refuses marketing gets this.OpenAI's responseI sent the mechanism and two questions to press@openai.com and privacy@openai.com on 14 September: why __obi is classified as an analytics cookie, and whether a user who grants analytics consent and refuses marketing consent still receives it. The reply came from OpenAI Support. It acknowledged the inquiry, said the observations would be shared internally for review, and did not answer either question. The script-load observation above was made after the inquiry was sent. I will update this post if OpenAI responds.LimitsBrowsers. Observed on Chrome for Android. Safari's Intelligent Tracking Prevention blocks all third-party cookies, and Chrome on iOS runs on WebKit, so the mechanism does not operate on any iOS browser. Desktop Chrome is untested.Gating. Roughly one ChatGPT session in five produced a sync token. ChatGPT's mobile web client serves ads without syncing at all. Someone following the steps below may see the pixel fire with no cookie attached.The join is not observed. 202 means the collector accepted the event with the cookie attached. That OpenAI resolves it to the account server-side follows from the design; I did not watch it happen.Meta built the structural equivalent years ago. A logged-in account, third-party cookies on pixel fires, off-site conversions resolved to a profile. The mechanism is standard adtech. What has no precedent is running it on an AI chat product. People tell these products things they would not put on a social network, and these products increasingly act on their behalf.The pixel's other cookie does not do this. __obref is set on the advertiser's own domain. Each site gets a different value and no site can see another's. Of 2,860 values observed, 2,828 appeared under exactly one advertiser.Advertisers cannot see this. __obi belongs to a domain their scripts cannot read. They installed a conversion pixel and have no way to know their visitors are being resolved to a ChatGPT identity. Previous issue Browse all issues
Subscribe to Buchodi's Threat Intel Jamie Larson Subscribe Buchodi's Threat Intel © 2026 Sign up Powered by Ghost |
The mechanism described details how OpenAI's ad collector utilizes a specific cookie to connect user activities on external websites with their accounts on ChatGPT. This system establishes an identifier named __obi, which is scoped to the .openai.com domain and tied directly to a user's ChatGPT account. The process begins when a user interacts with ChatGPT, where the client generates and signs a JSON Web Token containing an identifier and the __obi value to synchronize with the collector. This token, after being sent to bzr.openai.com, results in the setting of the __obi cookie on the user's browser with specific attributes, including Domain=.openai.com, HttpOnly, and SameSite=none, allowing the cookie to be transmitted across sites. Advertiser websites employ small pieces of OpenAI code, similar to how major advertising companies use Meta or Google tracking codes, to load this mechanism. When these scripts execute, they send the __obi identifier along with data about the page being viewed, including searched products, read articles, and purchase behaviors, back to OpenAI’s hosts. This transmission occurs through several request classes, including loading software development kits and event reporting endpoints. Notably, there is a path within the pixel SDK that omits credentials, which allows the identifier to be disclosed simply by loading the tag, regardless of whether the identifier is attached to the request. The data collected by the SDK is sourced from a combination of deliberate advertiser inputs and scraped data from the rendered page, form fields, and the tag-manager bus. The tag-manager bus proves to be the largest source for identity information, as the SDK parses elements like those found in gtm.js scripts to extract email and phone numbers, which are subsequently processed, with names and contact details being subjected to SHA-256 hashing before transmission. While location data such as country, region, city, and postal codes are sent in the clear, postal codes were observed as the most frequently harvested form field. Furthermore, URLs are processed by reducing them to only the origin and path, yet paths containing sensitive information, such as medical conditions or legal intake forms, were observed to reach the collector. Automatic matching is controlled from OpenAI’s Ads Manager and is enabled for a subset of pixels, including those from credit and lending advertisers. A denylist is implemented to exclude highly sensitive data such as passwords, credit card numbers, and Social Security Numbers, medical history, diagnoses, and court details from being transmitted. The cookie configuration is designed for cross-site operation, as __obi is the only OpenAI identifier configured with SameSite=None. This setting contrasts with other OpenAI cookies, which are blocked by the browser due to domain mismatches or SameSite policies, demonstrating a selective approach to tracking. Observations indicate that one __obi value was transmitted to OpenAI from twelve commercial websites across thirteen distinct pixel IDs, including brands like Chewy and Wayfair. The system functions effectively even when the user is logged out, and analyses of sync tokens reveal that a significant proportion include the subject type indicating an account user. The structure suggests that the __obi identifier belongs exclusively to OpenAI's domain, meaning advertisers cannot directly see which ChatGPT identity is being tracked. This mechanism introduces an element that lacks precedent in the ad technology landscape, as it applies sophisticated tracking to a product like an AI chat service, which prompts consideration of how these products are increasingly acting on behalf of their users. Although OpenAI acknowledged inquiries regarding the classification of __obi as an analytics cookie, the specific details of the consent interaction remain unaddressed, leaving the precise relationship between analytics and marketing consent ambiguous. |