A specific tracking cookie named '__obi' is created by OpenAI's advertising service at 'bzr.openai.com' and, according to the investigation, is associated with a ChatGPT account. This identifier travels back to OpenAI when certain advertiser websites load the company's advertising measurement code.
Businesses running advertisements through ChatGPT can embed a small snippet of OpenAI code on their pages, much like online shops currently use Meta or Google trackers. OpenAI's own developer documentation confirms that its ChatGPT Ads Measurement Pixel is designed to measure website events and can use automatic advanced matching to improve conversion measurement.
When this script loads, the investigation found that the '__obi' cookie can be transmitted alongside information about the page being viewed, including products being searched for, articles being read and purchase-related activity.
The investigation, published by Buchodi's Threat Intel, concludes that the mechanism appears designed to allow activity on advertiser websites to be associated with a ChatGPT identity. However, the researcher also states that the final server-side account join was not directly observed.
The Technical Mechanism Behind The Ad Cookie
Step 1. ChatGPT Generates an Identifier and Signs It
On chatgpt.com, your browser creates 16 random bytes and sends a 'POST' request to '/backend-api/bazaar/obi/sync-token' (or '/backend-anon/' if you are signed out). The server replies with an 'RS256 JWT':
{
"iss": "chatgpt-wadi",
"aud": "bzr.openai.com",
"purpose": "obi_sync",
"operation": "set",
"consent_decision": "analytics_allowed",
"consent_policy_version": "user_granular_consent_v1",
"sub": ""redacted: 64-hex account subject"",
"subject_type": "account_user",
"obi": ""redacted: 22-char identifier"",
"exp": ""iat + 60s""
}
Here, 'sub' represents the account, while 'obi' acts as the tracking identifier. The investigation says the token binds the two, is scoped to the collector and expires after 60 seconds. 'bzr' refers to 'bazaar', OpenAI's internal label for its advertising network, and 'wadi' serves as the generator.
Step 2. The Identifier Turns Into a Cookie on OpenAI's Domain
The client sends the token cross-site via a 'POST' call to 'bzr.openai.com/v1/obi/sync'. The server responds with:
Set-Cookie: __obi="redacted"; Domain=.openai.com; HttpOnly;
Max-Age=31536000; Path=/; SameSite=none; Secure
Setting 'SameSite=none' along with 'Secure' allows the cookie to be sent with cross-site requests. The lifespan is set to one year, and the identifier string matches the one inside the security token.
Step 3. Advertiser Websites Transmit It Back
Three request classes from an advertiser's page carried the '__obi' cookie, while a fourth control request did not.
'GET bzrcdn.openai.com/sdk/oaiq.min.js': Carried the '__obi' cookie (Notes: The script load itself).
'POST bzr.openai.com/v1/sdk/events' with 'obref': Carried the '__obi' cookie (Notes: Conversion actions).
'POST bzr.openai.com/v1/sdk/events', bare body: Carried the '__obi' cookie (Notes: The toolkit's 'no credentials' route).
'GET bzrcdn.openai.com/pixel-config/...': Did not carry the cookie (Notes: Control test with no header attached).
The first request is particularly significant. The tracking toolkit features a function that drops credentials, yet this fails to stop exposure: browsers automatically attach cookies to the script request before any OpenAI code executes. Merely loading the tag can disclose the identifier.
What Data Is Collected And Scraped
The tracking kit also gathers personal information from partner sites across four OpenAI-designated categories: 'in' for deliberate inputs, plus 'fm', 'ht' and 'js' for data scraped from forms, page text and tag managers. Scraped data outnumbered direct inputs: 685 events to 255.
The tag manager acts as the primary email source, with the SDK intercepting tracking functions and reading container data. Current versions capture email and telephone numbers, while version '0.1.31' previously gathered names and locations until restrictions were applied on 27 August 2026.
Emails, phone numbers and names undergo 'SHA-256' hashing prior to transfer, whereas regions, cities and postcodes are sent in the clear – with postal codes appearing most frequently across 28 domains.
Web addresses are stripped of query parameters before dispatch, though URL paths remain intact, occasionally revealing sensitive data such as medical issues, debt plans or legal forms.
Auto-matching functioned on 638 out of 881 examined pixels – covering every monitored financial lender – managed via OpenAI's dashboard. A built-in blocklist filters out passwords, security codes, card details, Social Security numbers, dates of birth, medical histories, diagnoses and court-related fields.
Out of 932 decoded sync tokens, 736 marked the user type as an account holder, while 196 remained anonymous. The investigation found that this anonymous identifier was similarly stable to a logged-in profile, lingering on devices for a minimum of 27 days.
OpenAI's own developer documentation separately confirms that its Measurement Pixel can use automatic advanced matching to detect supported customer information and hash identifiers such as email addresses, phone numbers and names using SHA-256. The documentation also lists country, city, region and postal code as supported user-data fields.
Broader Privacy Implications And Industry Precedent
The tracking mechanism was identified on Chrome for Android. The investigator said it does not operate on iOS browsers because Chrome on iOS uses WebKit and Safari's Intelligent Tracking Prevention blocks the relevant third-party cookies. Desktop Chrome was not tested.
Approximately one in five observed ChatGPT sessions generated a sync token, and OpenAI's mobile web client serves advertisements without syncing entirely.
OpenAI's own advertising documentation confirms that its Measurement Pixel is intended to measure website conversions and can use automatic advanced matching to improve conversion measurement. OpenAI says advertisers should obtain any necessary user consents where required by law before sending conversion data.
The investigation says the setup resembles advertising technology that Meta has used for years, but argues that applying a similar mechanism to an AI chat product raises particular privacy questions because users may disclose highly personal information in conversations.
The researcher contacted OpenAI's press and privacy teams on 14 September 2026, asking why '__obi' was classified as an analytics cookie and whether a user who grants analytics consent but refuses marketing consent would still receive it. OpenAI Support acknowledged the enquiry and said the observations would be shared internally for review, but did not answer either question, according to the investigation.
Unlike the '__obref' cookie, which remains unique to each individual advertiser, the '__obi' tracking cookie operates on a domain that partner websites cannot read, meaning advertisers cannot directly see whether their visitors are being resolved to a ChatGPT identity.
The investigation cautions that the final server-side account join was not directly observed. The evidence instead shows that the identifier was accepted by OpenAI's collector alongside activity from advertiser websites, while the mechanism appears designed to associate that identifier with a ChatGPT account.
