A new ChatGPT ad tracker investigation suggests OpenAI may be able to recognise the same browser on ChatGPT and on unrelated advertiser websites. Independent researcher Buchodi traced a cookie called __obi that is set on OpenAI’s domain for up to one year and sent back when a site loads OpenAI’s advertising measurement pixel.
The research, reported by Tom’s Guide, does not prove that OpenAI completed a server-side join between a person’s ChatGPT account and every later visit. It does show the browser sending the identifier to OpenAI’s ad collector, which is enough to raise the privacy question without adding a more dramatic conclusion.
How the OpenAI __obi cookie works
Buchodi says ChatGPT requests a short-lived token, which is then exchanged with bzr.openai.com for an __obi cookie scoped to .openai.com. The cookie uses SameSite=None; Secure and a 31,536,000-second lifetime — roughly one year — so browsers can attach it to cross-site requests.
OpenAI’s measurement-pixel documentation confirms that advertisers can load an SDK from bzrcdn.openai.com and send conversion events to bzr.openai.com. The documentation says the pixel can use advanced matching, with identifiers hashed in the browser, but it does not document the __obi mechanism described in the independent research.
Buchodi says one identifier was observed reaching OpenAI from 12 commercial websites under 13 pixel IDs. Across a wider sample covering 936 pixels and 1,029 hostnames, 12 of 30 distinct __obi values appeared under more than one advertiser. The study also found 196 anonymous tokens among 932 decoded tokens, although the researcher’s server-side account linkage was not directly observed.
What the ChatGPT ad tracker does not prove
The research does not show advertisers receiving ChatGPT conversations. OpenAI says its advertising system does not give advertisers access to chat history, and Buchodi’s report does not provide evidence that chat content was sent to advertisers.
The more immediate issue is classification. OpenAI’s cookie policy lists __obi as an analytics cookie with a one-year duration on chatgpt.com and openai.com. Buchodi says OpenAI acknowledged questions about that classification and whether refusing marketing consent still permits the cookie, but did not answer them.
Safari and other WebKit browsers block the third-party-cookie path described in the tests. Desktop Chrome was not tested, and roughly one in five observed ChatGPT sessions produced a sync token. The findings are therefore a detailed independent analysis, not an audit or a confirmed statement of OpenAI’s production-wide behaviour.
OpenAI’s advertising business is already a separate story for the company, as its reported $1 billion annualised run rate shows. The company’s wider push to place ChatGPT inside everyday products is covered in Apple’s Siri plans for Claude and ChatGPT. The __obi findings add a question about how that business measures what happens after a user leaves ChatGPT.
What is the OpenAI __obi cookie?
It is a cookie described by independent researcher Buchodi as an identifier set on OpenAI’s domain and sent with requests from sites using OpenAI’s advertising measurement pixel.
Does the research prove OpenAI can read ChatGPT conversations on advertiser sites?
No. The published testing does not show advertisers receiving chat history or directly observe OpenAI completing a server-side join between a ChatGPT account and every later site visit.
Which browsers block the tracking route described in the research?
Safari and other browsers based on WebKit block the third-party-cookie route described in the tests. Desktop Chrome was not tested.
