A security researcher discovered that ChatGPT leaves a cookie capable of following it even outside the appon the sites where the platform’s advertisements are installed. Is called __obioriginates from the domain bzr.openai.com and remains active for a whole year, linked by default to the user’s account.
The mechanism starts from chatgpt.com: the client generates a random identifier and has it signed by OpenAI via a newly valid JWT token 60 secondsproduced by the in-house advertising platform (codenamed “bazaar”) and the issuing service “wadi”. That token ties the identifier to the account and already carries with it the analytics consent registered by the user.
The next step generates the actual cookie at bzr.openai.com/v1/obi/sync: HttpOnlyvalid on the entire .openai.com domain, with an expiration of 365 days and, above all, set as SameSite=None. It is the only OpenAI cookie configured like this: other company identifiers are blocked in cross-site requests, __obi is not.
Every company that buys advertising space on ChatGPT installs a fragment of OpenAI code on its site, with the same logic as Meta and Google pixels. Loading that script sends the cookie to bzr.openai.com along with the page data: searched products, read articles, purchasing paths.
What travels with the cookie
The same code also collects identity data directly from the page visited: in the observed sample, 685 events they derived from information intercepted independently (forms, page text, tag manager bus) versus 255 provided voluntarily by the advertiser. Email, phone and name are encrypted SHA-256 before sending, but the country, city and postal code travel in clear text: the latter is the most collected data, on 100 occasions on 28 different sites.
The automatic matching was active on 638 of the 881 pixels with known settings, including all credit advertisers observed. OpenAI excludes passwords, one-time codes, card numbers and health or judicial data from the collection, but among the page paths that ended up at the collector, a request linked to a medical condition, a funnel for debt management and a legal intake form appeared.
The researcher verified the mechanism on his Android phone, observing the cookie passing through 12 commercial sites (including Chewy, Wayfair, HelloFresh and Coursera) under 13 different pixels, always accepted by the server. On a larger sample of decoded tokens, 196 out of 932 were generated by users without login: even in that case the identifier remains stable for at least 27 days.
In OpenAI’s cookie policy, __obi appears as the only item in the “analytics” category, distinct from marketing consent. However, each intercepted token carried the wording of active analytics consent, which means that those who accept the analytics but refuse the marketing still receive tracking. Contacted on September 14 about the reason for this classification, OpenAI responded via support confirming receipt of the report, without untying the knot.
Operation is confirmed on Chrome for Android: Safari and iOS browsers, based on WebKit, block third-party cookies by default and remain out of reach of the system. Meta has been building similar mechanisms for years with its own pixel, but it is the first time that such logic ends up on a conversational productwhere users tell details that they would never write publicly on a social network.
