ChatGPT's __obi cookie follows you to other websites

OpenAI stores a cookie called __obi in your browser. It lasts a year and it is tied to your ChatGPT account. Load a page that buys ads in ChatGPT and the browser hands that identifier straight back to OpenAI, together with details about what you were reading or shopping for. A security blog called Buchodi's Threat Intel published the mechanism on Sept. 20 and reproduced it on a phone.

Why the cookie travels

OpenAI lists __obi in its own cookie policy, updated Sept. 10, as an analytics cookie with a one-year lifetime. It is the only entry in that section. It is also the only OpenAI cookie set with SameSite=None. That flag is what a browser needs before it attaches a cookie to a request for a different site. Every other OpenAI cookie was blocked during the test.

Advertisers embed a small script on their pages, which OpenAI documents as the Measurement Pixel. It loads from bzrcdn.openai.com and reports events to bzr.openai.com. Open the developer console on such a page, type window.oaiq and the answer comes back as function. That was the case on wayfair.com on Sept. 21. Ads reached Germany and 30 other European markets on Aug. 24. They show up for Free and Go accounts. A paid plan is the only way to remove them.

What travels with the identifier

The pixel reads customer data from the page that embeds it, without being asked to. OpenAI calls this automatic advanced matching and writes that the pixel "automatically detects supported customer information from your website." Email addresses, phone numbers and names are hashed in the browser first. Country, region, city and postal code appear in the same field table and are sent unhashed. Postal code turned out to be the form field harvested most often, 100 events across 28 sites. Data the pixel scraped by itself outnumbered data the advertiser handed over on purpose, 685 events to 255.

Addresses arrived as origin and path only, with nothing after the question mark. Those paths included a medical condition, a debt-relief funnel and a litigation intake form. Some fields stay out, because OpenAI keeps a denylist covering passwords, one-time codes, card numbers, dates of birth, diagnoses and court records. You may recognise the pattern from the training toggle, which also stops less than its name suggests.

What OpenAI says and what stays open

OpenAI states in the blog post announcing ads in Europe: "we keep conversations private from advertisers and never sell customer data." Neither promise is touched here, because the traffic runs the other way. Advertisers cannot read __obi at all, because it belongs to a domain their scripts cannot reach. The author of the analysis sent OpenAI two questions on Sept. 14, among them why an advertising cookie is filed under analytics. The answer came from support and left both of them unanswered.

The analysis is open about its limits, which is what makes it useful. The observations come from Chrome on Android. Every browser on iPhone and iPad runs on WebKit, whose tracking protection blocks third-party cookies, so the mechanism does not reach those devices. Only about one ChatGPT session in five produced an identifier at all. That OpenAI resolves the incoming events to your account on its servers follows from the design, and nobody has watched it happen.

What you can change

The setting that works is in the browser. Block third-party cookies and __obi loses its route onto other sites. Every OpenAI page carries a Manage cookies button at the bottom, and __obi is the single entry under analytics there. Refusing marketing is not enough, because every decoded token carried the analytics consent. Clearing cookies for openai.com resets the identifier, and a new one arrives on the next visit. Signing out does not help either. Roughly a fifth of the identifiers belonged to anonymous sessions and stayed stable for at least 27 days.