ChatGPT tracks users across the web via ad pixel cookie
Original: ChatGPT now knows what you do on other websites via ad collector
Why This Matters
OpenAI's ad tracking infrastructure, now confirmed active, connects AI assistant usage to real-world browsing behavior at scale.
OpenAI's ad platform sets a cookie called __obi on .openai.com that ties a user's ChatGPT account to browsing activity on third-party advertiser sites. Any site running OpenAI's ad pixel sends this cookie back, exposing search, purchase, and page-reading behavior across 936 distinct advertiser pixels on 1,029 hostnames.
A detailed technical investigation published September 20, 2026 reveals that OpenAI's advertising platform — internally called 'Bazaar' — operates a cross-site tracking mechanism functionally identical to Meta's and Google's pixel systems.
When a user visits ChatGPT, the site calls an internal endpoint to generate a signed RS256 JWT linking the user's account ID to a 22-character identifier called 'obi.' That JWT is then posted to bzr.openai.com, which sets a __obi cookie scoped to .openai.com with SameSite=none — the specific configuration required for a cookie to travel on cross-site requests — and a one-year expiry.
Any advertiser that installs OpenAI's pixel SDK on their site inadvertently sends that __obi cookie back to OpenAI's servers, even via the bare script-load request before OpenAI's code runs. The SDK also scrapes identity signals from forms, rendered page text, and the Google Tag Manager data layer — replacing window.dataLayer.push with its own function. In observed traffic, scraped identity events (685) outnumbered advertiser-supplied ones (255). Email and phone are SHA-256 hashed before transmission; location data down to postal code is sent in the clear. Version 0.1.31, active until August 27, also collected names and geographic data before its scope was narrowed.
The researcher independently verified the mechanism on a personal device using two capture methods and cross-checked months of traffic data.