OpenAI ties browsing on advertiser sites to a ChatGPT account through a cookie called __obi

A security researcher writing as Buchodi's Threat Intel published a technical account on 20 September of a cross-site tracking mechanism used by ChatGPT. The post reports that OpenAI sets a cookie called __obi on the openai.com domain, and that OpenAI's ad-conversion pixel installed on advertiser websites transmits that cookie back to OpenAI along with the page the visitor is on. Buchodi reproduced the full chain on a personal phone, cross-checked it against several months of observed traffic, and counted 936 distinct advertiser pixels across 1,029 hostnames.

How the chain works

The report traces three steps. On chatgpt.com, the client generates 16 random bytes and calls POST /backend-api/bazaar/obi/sync-token, which returns a signed JWT scoped to bzr.openai.com (OpenAI's internal name for the ads platform, according to the post). The client then POSTs that token cross-site to bzr.openai.com/v1/obi/sync, and the response sets __obi on the .openai.com domain with SameSite=None, Secure, HttpOnly and a one-year Max-Age. Any advertiser page that later loads OpenAI's conversion pixel sends __obi back to OpenAI. Buchodi observed three request classes going from advertiser pages to OpenAI, and every one carried the cookie when it was present.

What Buchodi observed on one device

On the researcher's own device, one __obi value was sent to OpenAI from twelve commercial websites under thirteen distinct pixel IDs, including Chewy, Wayfair, ThriftBooks, Eventbrite, HelloFresh, Coursera and SeatGeek. In the wider capture, twelve of thirty __obi values appeared under more than one advertiser, and one appeared under ten. The post says the mechanism also runs for logged-out users: of 932 decoded sync tokens, 196 carried subject_type: anonymous, and that anonymous identifier persisted at least 27 days on one device.

The consent question

Buchodi says OpenAI's cookie policy lists __obi under Analytics, with a one-year duration on chatgpt.com and openai.com, and no other entry in that section. OpenAI presents analytics and marketing as two separate consent choices, oai_consent_analytics and oai_consent_marketing. Every sync token Buchodi decoded carried consent_decision: analytics_allowed, so a user who accepted analytics and refused marketing still received the cookie. The researcher says they sent the mechanism and two direct questions to press@openai.com and privacy@openai.com on 14 September. OpenAI Support replied that the observations would be shared internally and did not answer either question.

The limits, in Buchodi's words

The post is careful to state what it did not measure. __obi was observed on Chrome for Android; Safari's Intelligent Tracking Prevention blocks the third-party cookie, so it does not operate on any iOS browser, and desktop Chrome was not tested. Only one in five ChatGPT sessions produced a sync token, in Buchodi's traffic, and the mobile web client serves ads without syncing at all. The 202 response from the collector confirms the cookie reached OpenAI with the event, but Buchodi did not watch OpenAI resolve it to an account server-side. The post notes that Meta and Google already run the structurally equivalent mechanism for their own logged-in accounts, so the mechanism itself is standard ad-tech. What is new, in the researcher's own framing, is that it runs on an AI chat product where people type things they would not put on a social network.

For a team responsible for a live commercial site that carries the OpenAI conversion pixel, the practical questions are three. Which pages on your domain load bzr.openai.com scripts today. Whether your published privacy notice, and the consent choice governing it, cover a third-party identifier that resolves to a ChatGPT account server-side. And whether that is the trade-off you want in return for the conversion data the pixel returns.

Source

• ChatGPT now knows what you do on other websites via ad collector, Buchodi's Threat Intel, 20 September 2026
• Hacker News discussion