Is ChatGPT Following You? Inside OpenAI's Controversial New Cross-Site Ad Tracker

The Hidden Eye: OpenAI's Foray into Cross-Site Tracking

For millions of users, ChatGPT has become a trusted digital confidant—a place to brainstorm career moves, discuss health concerns, and manage personal finances. However, a recent discovery by an independent security researcher suggests that the boundary between your private AI conversations and your broader web activity may be thinner than you think. An investigation has uncovered a sophisticated cross-site tracking system tied to OpenAI's rapidly expanding advertising ecosystem.

At the heart of the controversy is a specific browser cookie known as "__obi." While cookies are common tools used by websites to remember login sessions or user preferences, the configuration of the __obi cookie is designed for something far more expansive: tracking users across different domains.

How the "__obi" Tracker Works

According to research published by Buchodi, an independent analyst who scrutinized months of network traffic across over a thousand hostnames, the __obi cookie is placed in a user's browser during a visit to ChatGPT. Unlike standard first-party cookies, this identifier is configured with a SameSite=None setting. In plain English, this means the cookie can be transmitted back to OpenAI's servers even when the user is visiting a completely different website.

The system functions through the use of measurement pixels. Businesses that advertise through OpenAI's platform can install these pixels on their own sites. When a user who has previously visited ChatGPT lands on one of these participating retail or service websites, the browser sends the __obi identifier back to OpenAI. This effectively allows OpenAI to recognize the user and track their behavior after they have left the chatbot environment.

What Information is Being Collected?

The implications of this tracking extend beyond simple page views. The research indicates that OpenAI's advertising collector receives detailed information associated with the specific pages a user visits and "conversion events" (such as making a purchase or signing up for a service).

While query strings (the parts of a URL that often contain specific search terms) are stripped before being sent, the URL paths remain intact. This can be highly revealing. The dataset analyzed by the researcher included paths pointing to sensitive topics, including:

• Medical conditions and health resources
• Debt relief and financial services
• Legal litigation intake forms

This capability is part of OpenAI's "conversion measurement" tool, which allows advertisers to attribute real-world actions—like a sale or an app download—back to an interaction with a ChatGPT ad.

The Link to Your Personal Account

One of the most pressing questions is whether this tracking is tied to a specific ChatGPT account. The researcher found that the identifiers generated included tokens labeled as either account_user or anonymous. Roughly 79% of the decoded tokens were associated with logged-in users.

It is important to note a critical caveat: the researcher did not directly observe the final server-side step where an event from a third-party site is definitively joined to a user's personal profile. However, the architecture clearly makes such a connection possible. For anonymous users, the tracking identifier can remain stable on a single device for at least 27 days, ensuring a persistent shadow profile even without a login.

OpenAI's Stance and the Privacy Paradox

OpenAI has not yet provided a detailed public response to the specific technical findings regarding the __obi cookie. However, the company's official documentation maintains that it does not sell user data to advertisers and that advertisers only receive aggregated reports on clicks and conversions.

The real concern is not what the advertisers see, but what OpenAI sees. In a traditional search engine, you type a keyword. In an AI assistant, you provide "richer context"—detailed life stories, nuanced problems, and deep personal preferences. When this intimate context is paired with the ability to track your movements across the web, it creates a privacy profile of unprecedented depth.

How to Protect Your Privacy

If you are concerned about cross-site tracking, there are several steps you can take:

• Use Privacy-Focused Browsers: The research noted that Apple's Safari blocks the third-party cookie mechanism used by __obi, making it a safer choice for those wary of tracking.
• Manage Cookie Settings: Regularly clear your browser cookies and use "Incognito" or "Private" modes to limit the lifespan of tracking identifiers.
• Audit Your AI Settings: Review ChatGPT's privacy controls to limit how your data is used for training and advertising.