OpenAI Cookie Could Hyperlink ChatGPT Accounts to Advert Web site Data

A cookie referred to as __obi could also be connecting what you do on third-party advertiser web sites again to your ChatGPT identity. Independent technical reporting printed September 20–21, 2026, describes a cross-site monitoring mechanism that OpenAI classifies as “analytics” in its cookie coverage, up to date September 10, 2026. This sort of covert knowledge assortment echoes considerations raised when a secretly monitoring customers story revealed comparable cross-platform surveillance patterns.

That classification hole carries actual weight for customers and, doubtlessly, for regulators.

How the Mechanism Reportedly Works

Independent reporting describes a token change that locations a persistent, cross-site identifier in your browser by way of ChatGPT.

According to impartial investigator Buchodi, ChatGPT generates a short-lived token, sends it to OpenAI’s bzr.openai dot com area, and receives a signed token in return. That change units the __obicookie, which is scoped to openai.com and carries the SameSite=None, Secure, and HttpOnly attributes. Those settings permit the cookie to be included in cross-site requests, however solely when an internet site has loaded OpenAI’s measurement pixel and initiates a cross-origin request to OpenAI’s servers.

Advertiser websites utilizing that pixel reportedly load a script from bzrcdn.openai dot com/sdk/oaiq.min.js. Those websites then ship conversion occasions to bzr.openai dot com/v1/sdk/occasions, and people requests can carry the __obi cookie again to OpenAI together with web page knowledge, form-derived id alerts, and conversion exercise. This strategy resembles the mechanics described in reporting on a surveillance app constructed to covertly monitor targets throughout digital platforms.

Buchodi additionally noticed nameless tokens within the change, suggesting a logged-in ChatGPT account might not be required for the cookie to look. The habits was seen on Chrome for Android; iOS browsers face constraints from WebKit’s Intelligent Tracking Prevention that seem to restrict this mechanism.

One materials caveat applies to the total monitoring declare. Buchodi acknowledges the server-side be part of of identifiers was in a roundabout way noticed, so the whole chain connecting off-platform habits to a particular ChatGPT id stays an inference from the reported mechanics, not a confirmed reality.

The “Analytics” Label and What OpenAI Has Said

OpenAI classifies __obi as an analytics cookie, however impartial reporting describes habits that extra intently resembles ad-conversion measurement.

OpenAI’s cookie policy lists __obi as an analytics cookie with a one-year period on chatgpt dot comand openai.com. OpenAI describes the cookie as serving to the corporate perceive the effectiveness of its companies and advertising and marketing efforts.

Buchodi noticed that sync tokens carried a area studying consent_decision: analytics_allowed, which reportedly means analytics-only consent permits the cookie to be set. Users who accepted analytics cookies however declined advertising and marketing cookies could not notice that alternative reportedly enabled cross-site advert measurement.

“Analytics” and “ad conversion measurement” aren’t the identical class beneath most privateness frameworks. Purpose limitation is a core precept in rules like GDPR. It requires that knowledge collected beneath one acknowledged function not migrate to a different, and whether or not OpenAI’s classification survives that scrutiny is an open query.

OpenAI didn’t straight reply questions on why __obi carries an analytics label or whether or not analytics-only consent is meant to cowl this use. According to the reporting, the corporate acknowledged the inquiry and stated it might be reviewed internally.

What This Means for You Right Now

Until OpenAI clarifies its place, your cookie consent selections on ChatGPT could not imply what you count on.

You could have consented to analytics cookies on ChatGPT or openai.com with out consenting to advertising and marketing cookies. Whether that alternative covers the off-platform advert measurement the report describes is at the moment unclear.

To overview or change your alternatives, open ChatGPT settings, navigate to Data Controls, and overview your cookie consent choices. If these controls are unavailable in your area, OpenAI’s privateness request kind is the following out there path.

Whether “analytics” precisely describes a mechanism that reportedly hyperlinks advertiser website habits to a ChatGPT account is a disclosure query privateness authorities in Europe, and more and more within the United States, have proven clear curiosity in pursuing.