AnswersPublished18 sources
How OpenAI’s Reported __obi Cookie Could Track ChatGPT Users Across Merchant Sites
Independent researcher Buchodi reported that OpenAI’s one year obi cookie can be sent when a merchant site loads OpenAI’s ad pixel, potentially linking off site browsing and purchase events to an account linked or per... The reported dataset covered 936 advertiser pixels across 1,029 hostnames; 736 of 932 decoded sy...
Published byEdited with GPT-5.6 TerraImages generated with GPT Image 2
Research answer
Key takeaways
- Independent researcher Buchodi reported that OpenAI’s one year obi cookie can be sent when a merchant site loads OpenAI’s ad pixel, potentially linking off site browsing and purchase events to an account linked or per...
- The reported dataset covered 936 advertiser pixels across 1,029 hostnames; 736 of 932 decoded sync tokens were described as account user subjects, while 196 were anonymous.
- The findings concern a reported advertising measurement design and should not be treated as a regulatory finding or proof that every event was joined to a ChatGPT account.
AI Prompt
openai.comCreate a landscape editorial hero image for this Studio Global article: How does OpenAI’s year-long __obi cookie, classified as an analytics cookie, reportedly enable cross-site tracking of ChatGPT users and anon. Article summary: OpenAI’s `__obi` appears, based on Buchodi’s independent technical analysis, to be a one-year, cross-site identifier that can accompany requests from merchant pages running OpenAI’s advertising/measurement pixel. That co. Topic tags: general, general web. Style: premium digital editorial illustration, source-backed research mood, clean composition, high detail, modern web publication hero. Use reference image context only for broad subject, composition, and topical grounding; do not copy the exact image. Avoid: logos, brand marks, copyrighted characters, real person likenesses, fake screenshots, UI text, readable text, watermarks, charts with fake numbers, clic
Independent security researcher Buchodi reported a cross-site advertising-measurement mechanism centered on an OpenAI cookie called __obi. The reported design could allow OpenAI to receive activity from websites that run its advertising pixel alongside a persistent identifier created through ChatGPT. That is different from proving that OpenAI actually stores or uses every event against a named ChatGPT account—the most important unresolved point in the report. 15
21
How the reported tracking flow works
According to the reporting and Buchodi’s analysis, a ChatGPT visit can result in an identifier being exchanged with OpenAI’s advertising collector, bzr.openai.com, which sets __obi for the .openai.com domain. The cookie was reported to last one year and use SameSite=None; Secure. 15
21
That cookie setting matters because it can be included when a separate merchant website loads a resource from an OpenAI domain. If the merchant has installed OpenAI’s advertising or measurement pixel, the browser can send the __obi value to OpenAI as part of that cross-site request. The merchant cannot simply read a cookie scoped to .openai.com, but OpenAI’s collector can receive both the identifier and the merchant-site event. 15
21
In practical terms, the claimed chain is:
- A visitor uses ChatGPT, where an account-linked or anonymous subject may be represented in the reported synchronization flow.
- OpenAI issues the long-lived
__obicookie. - The visitor opens a participating merchant site.
- The site loads OpenAI measurement code, and the browser sends the OpenAI-domain cookie with the relevant request.
- OpenAI can receive the merchant-site activity together with that persistent identifier.
15
21
What data the pixel reportedly sends
The reported pixel is designed around conversion measurement. Reporting on the analysis says the transmitted activity can include pages or products viewed, searches, add-to-cart events, checkout starts, purchases, orders, product information, quantities, prices, currency, and custom conversion events. 7
15
The reporting also describes advertiser-supplied matching fields, including hashed email addresses, phone numbers, external IDs, and names, plus location fields such as country, city, region, and postal code. 7
Buchodi further alleged that the software development kit could collect identity-related information from form fields, page content, and tag-manager data layers. In the reported observations, email, phone, and name values were SHA-256 hashed, while country, region, city, and postal code could be transmitted in clear text. 1
15
Even when a full URL query string is removed, a page path can still be revealing. A path can indicate the type of item viewed or the nature of a form or service being accessed. That makes the scope of data collection more consequential than a simple ad-impression count. 1
The evidence reported across commercial sites
Buchodi said the investigation examined months of traffic involving 936 advertiser pixels across 1,029 hostnames. 15
16
Among the reported examples, one __obi value appeared in requests from 12 commercial websites using 13 pixel IDs, including Chewy, Wayfair, ThriftBooks, Eventbrite, HelloFresh, Coursera, and SeatGeek. The collector reportedly returned HTTP 202 responses to those event submissions. 1
The analysis also reported that 12 of 30 distinct __obi values appeared with more than one advertiser, with one observed across ten advertisers. That pattern is consistent with a reusable identifier being presented to OpenAI from multiple participating sites. 1
Of 932 decoded synchronization tokens cited in the research, 736 were reported as account_user subjects and 196 as anonymous subjects. The anonymous identifier was reported to remain stable per device for at least 27 days. 1
9
Why the “analytics” classification is central
Reporting on the findings says __obi was classified as an analytics cookie rather than a marketing cookie. Buchodi reported that the decoded tokens consistently included analytics_allowed, and that the identifier could be issued when analytics was allowed even after marketing or advertising cookies had been declined. 1
13
That is the basis for the privacy concern: a cookie labeled analytics may nonetheless facilitate cross-site advertising measurement when it is supplied to an ad collector from participating merchant sites. The evidence supplied here does not establish a legal violation or a regulator’s ruling. But it does raise a consent-design question—whether a user who declined advertising cookies would reasonably expect this kind of cross-site measurement to continue under an analytics choice. 1
23
Browser protections and blockers: what is known
The reported mechanism was directly observed on Chrome for Android. 1
Buchodi’s analysis stated that Safari’s Intelligent Tracking Prevention blocks third-party cookies and therefore concluded that this specific third-party-cookie flow would not operate on iOS browsers, which use WebKit. The research did not test desktop Chrome, so it cannot support a blanket conclusion about every desktop browser or browser configuration. 1
The supplied evidence also does not establish which particular privacy extensions block OpenAI’s pixel. As a technical matter, a network-level blocker that prevents the relevant OpenAI pixel, CDN, or collector request would prevent that specific request from being sent; however, that is an inference about the request path, not a published test result from Buchodi’s investigation.
The critical limitation: capability is not proof of account-level use
The most careful reading of the research is that it demonstrates a reported mechanism capable of carrying merchant-site events with an identifier whose synchronization flow can include an account-user subject. That creates the technical possibility of an account-level join. 1
15
But Buchodi did not observe OpenAI’s internal server-side processing. The research does not prove that OpenAI resolves each incoming event to a ChatGPT account, retains it there, or uses it for ad targeting, measurement, or any other purpose. The distinction between an identifier arriving at a collector and confirmed account-level processing remains essential. 1
21
Bottom line
The reported __obi design is notable because a one-year, cross-site cookie paired with a merchant-site measurement pixel can give OpenAI a way to receive detailed off-site activity under the same persistent identifier. The reported data includes browsing, conversion, purchase, and potentially identity-related fields. 7
15
The findings warrant scrutiny of consent choices, browser behavior, and the data sent by advertising pixels. They do not, on their own, prove that OpenAI attached every collected event to a ChatGPT account or used it for personalized advertising. 1
15
Studio Global AI
Continue your research
This page includes a source-backed answer you can continue inside Studio Global.
People also ask
What is the short answer to "How OpenAI’s Reported __obi Cookie Could Track ChatGPT Users Across Merchant Sites"?
Independent researcher Buchodi reported that OpenAI’s one year obi cookie can be sent when a merchant site loads OpenAI’s ad pixel, potentially linking off site browsing and purchase events to an account linked or per...
What are the key points to validate first?
Independent researcher Buchodi reported that OpenAI’s one year obi cookie can be sent when a merchant site loads OpenAI’s ad pixel, potentially linking off site browsing and purchase events to an account linked or per... The reported dataset covered 936 advertiser pixels across 1,029 hostnames; 736 of 932 decoded sync tokens were described as account user subjects, while 196 were anonymous.
What should I do next in practice?
The findings concern a reported advertising measurement design and should not be treated as a regulatory finding or proof that every event was joined to a ChatGPT account.
Sources
forklog.comResearcher Discovers Ad Tracker in ChatGPT for Third-Party Sites | ForkLog
pasqualepillitteri.itAnaliza ujawnia cookie __obi OpenAI, które śledzi użytkowników ChatGPT