OpenAI's Invisible Eye: New Ad Tracker May Follow ChatGPT Users Across the Web

The Discovery of the "__obi" Cookie

In a startling revelation for privacy advocates, an independent researcher known as Buchodi has uncovered a sophisticated cross-site tracking system linked to OpenAI's burgeoning advertising ecosystem. The core of this system is a specific browser cookie dubbed "__obi." According to months of network traffic analysis involving over 900 OpenAI advertiser pixels across more than 1,000 hostnames, this cookie acts as a digital tether, potentially linking a user's activity on ChatGPT to their behavior on other websites.

While cookies are a standard part of the modern web, the configuration of the __obi cookie is particularly aggressive. It is designed to last for an entire year and utilizes the SameSite=None setting. This specific technical configuration allows the cookie to be transmitted even when requests originate from third-party websites, effectively enabling OpenAI to recognize the same browser across different domains.

How the Tracking Ecosystem Works

The mechanism operates similarly to the tracking pixels used by tech giants like Meta and Google. Businesses that utilize OpenAI's advertising tools can install a measurement pixel on their own retail or service websites. When a user who has previously visited ChatGPT lands on one of these participating sites, the __obi identifier is sent back to OpenAI.

This creates a feedback loop where OpenAI can potentially monitor a user's journey after they leave the chatbot. This is particularly significant given OpenAI's rapid financial pivot toward advertising; the company recently reported that ChatGPT Ads had reached a staggering $1 billion annualized revenue run rate, alongside the launch of "Sponsored Agents" and AI-powered ad tools.

What Exactly Is Being Tracked?

The implications for user privacy are profound. Buchodi's research suggests that OpenAI's advertising collector receives data beyond simple page visits. The analysis of nearly 24,000 URLs revealed that while specific query strings are stripped, the URL paths remain intact.

URL paths can be incredibly revealing. The researcher noted that observed paths included sensitive information regarding medical conditions, debt relief services, and litigation intake forms. Furthermore, OpenAI's own documentation mentions "conversion measurement," allowing advertisers to track what happens after a user interacts with an ad—including attribution across apps and even offline activities.

The Connection to User Accounts

One of the most contentious points of the research is whether this tracking is tied to a specific ChatGPT account. The data shows that identifiers are labeled as either account_user or anonymous. Out of 932 decoded tokens, 736 were associated with logged-in users, while 196 were anonymous. Interestingly, even anonymous identifiers remained stable on a single device for at least 27 days.

However, it is important to note a critical limitation: the researcher did not directly observe the final server-side step where OpenAI joins a website event to a specific user account. While the architecture makes this link possible, it has not been independently verified. Additionally, the tracking was primarily observed on Chrome for Android; Safari's stringent anti-tracking protections currently block the third-party cookie mechanism described.

The AI Privacy Dilemma

OpenAI has not provided a detailed public response to these specific findings, though they have acknowledged the inquiry. Their official documentation maintains that advertisers do not receive personal chat histories, memories, or individual conversations, and that the company does not sell user data.

Yet, the fundamental concern remains: the flow of information. Unlike a traditional search engine, users treat AI assistants as confidants, sharing deeply personal context about their health, finances, and careers. When this intimate context is paired with a system that can track a user's external web activity, the boundary between a private AI consultation and a commercial advertising profile becomes dangerously thin.