OpenAI's ad pixel tracks ChatGPT users across 1,000 websites
A researcher spent months watching one cookie leave OpenAI's domain — and found it arriving on shopping, travel and lending sites that never asked for it.
OpenAI's ad measurement pixel carries a first-party identifier that follows ChatGPT users onto advertiser websites, and the company classifies it as an analytics cookie rather than an advertising one. The finding comes from Buchodi's Threat Intel, a mobile-privacy research blog, which says it reproduced the mechanism on its own phone, verified it with two independent capture methods, and cross-checked against several months of observed traffic covering 936 distinct advertiser pixels across 1,029 hostnames.
The mechanism is standard adtech dressed in an unusual place. While you are on ChatGPT, the client generates a random identifier and has OpenAI's backend sign it into a short-lived token bound to your account; the browser then posts that token cross-site to bzr.openai.com, which returns a cookie named __obi scoped to .openai.com with SameSite=None, Secure, and a one-year lifetime. SameSite=None is precisely the configuration a cookie needs in order to be attached to requests made from other people's websites — and it is the only OpenAI identifier configured that way. Every other OpenAI cookie observed on those same requests was blocked by the browser for domain mismatch or SameSite=Lax.
From there, any advertiser that buys ChatGPT ads does the rest by installing OpenAI's conversion snippet, the same way retailers already install Meta and Google tags. Loading the pixel script is itself enough: the browser attaches the cookie to the <script src> request before any of OpenAI's code runs, so the SDK's "no credentials" code path does not help. The same SDK also harvests identity from the page it sits on — the researcher's payload breakdown labels advertiser-supplied values separately from ones the SDK scrapes out of form fields, rendered page text, and the Google Tag Manager data layer, and found scraped identity outnumbered advertiser-supplied identity 685 events to 255. Email, phone and name are SHA-256 hashed before transmission; country, region, city and postal code go in the clear, with postal code the most-harvested form field at 100 events across 28 sites. URLs are stripped to origin plus path — none of 23,929 observed carried a query string — but the paths that survived included a medical condition, a debt-solutions funnel and a litigation intake form. Automatic matching was enabled on 638 of 881 pixels with a known setting, including every credit and lending advertiser observed, and is controlled from OpenAI's Ads Manager.
Two details make this more than a cookie write-up. The first is consent: OpenAI runs analytics and marketing as separate choices, and every sync token the researcher decoded carried analytics_allowed — so a user who allows analytics and refuses marketing still receives the identifier. OpenAI's cookie policy does list __obi in its Analytics section, one year, on chatgpt.com and openai.com. The researcher sent OpenAI two questions on 14 September — why the cookie is classified as analytics, and whether someone who refuses marketing consent still gets it. Support acknowledged the inquiry, said it would be shared internally, and answered neither.
The second is that it works logged out. Across 932 decoded sync tokens, 736 were bound to an account and 196 carried an anonymous subject — but the anonymous identifier is just as stable, one per device, persisting at least 27 days. Signing out does not break the trail.
The limits are real and the researcher states them: observations were made on Chrome for Android, and Safari's tracking prevention blocks third-party cookies entirely, so the mechanism does not operate on any iOS browser. Roughly one ChatGPT session in five produced a sync token at all, and the mobile web client serves ads without syncing. Crucially, the server-side join — OpenAI resolving that cookie to your account — is inferred from the design, not observed; the collector answered 202 to every request, which means the event was accepted with the cookie attached, nothing more. Advertisers cannot see any of it either: __obi lives on a domain their scripts cannot read, so they installed a conversion pixel and have no way to know their visitors are being resolved to a ChatGPT identity. In practice one identifier was sent to OpenAI from 12 commercial websites under 13 distinct pixel IDs, among them Chewy, Wayfair, ThriftBooks, Eventbrite, HelloFresh, Coursera and SeatGeek.
Our take: the structural comparison is Meta, which built this years ago — a logged-in account, third-party cookies on pixel fires, off-site conversions resolved to a profile. What has no precedent is running it on an AI chat product, where people type things they would not put on a social network, and where the product increasingly acts on their behalf. The classification is the part worth pressing on. "Analytics" is doing a lot of work for a cookie whose entire purpose is to make a person on one site recognizable on another, and the fact that the consent gate for marketing does not stop it means the control users are shown is not the control that governs this path.
We have watched the advertiser plumbing arrive fast — Amazon hands its advertisers to ChatGPT covered the retail side of it, and the EU putting ChatGPT under the Digital Services Act's strictest tier is where the regulatory exposure already sits. A measurement pixel that quietly resolves browsing to accounts in a chat product is exactly the kind of thing that turns a classification argument into an enforcement one.
What to watch: whether OpenAI reclassifies __obi or narrows its scope, and whether European regulators treat the analytics label as a consent problem rather than a naming one.
Would you accept this if the cookie were labelled marketing and gated behind an explicit opt-in, or is the join itself the problem? Tell us in the comments.
Sources: Buchodi's Threat Intel · OpenAI cookie policy · OpenAI — Measurement Pixel docs · Hacker News discussion · Kukie.io — ChatGPT Ads and Cookies
