ChatGPT Ad Tracking Cookie Follows Users Across Third-Party Advertiser Websites
Brief
OpenAI’s advertising measurement system appears to use a cross-site cookie that can link activity on advertiser websites to a person’s ChatGPT account.
The cookie, named __obi, is created. At the same time, a user visits ChatGPT and can later be sent back to OpenAI when that user loads sites running OpenAI’s advertising pixel.
The mechanism was independently reproduced on a mobile device and observed across 936 advertiser pixels on 1,029 hostnames. It resembles the cross-site conversion tracking used by major ad platforms. However, its connection to an AI service raises new privacy questions.
When a user opens ChatGPT, the client generates a random identifier and requests a short-lived signed token from OpenAI’s backend. The token contains an account-linked subject value, an obi identifier, and a consent decision marked as analytics_allowed.