OpenAI's __obi Cookie Links ChatGPT Accounts to Browsing Across 1,029 Hostnames

TL;DR

OpenAI now runs a cross-site identity cookie. A writeup published September 20 by Buchodi's Threat Intel reproduced the full chain on a single phone: ChatGPT mints a signed token bound to your account, that token installs a cookie called __obi on .openai.com with a one-year lifetime, and every advertiser page running OpenAI's measurement pixel ships that cookie back to OpenAI along with whatever the pixel scraped off the page. The broader capture covered 936 distinct advertiser pixels across 1,029 hostnames. The detail that matters for anyone running the pixel: OpenAI's cookie notice files __obi under analytics, not marketing, so refusing marketing consent does not stop it.

The three-step chain

None of this is inferred from network noise. The author documented each hop and says it was verified with two independent capture methods.

Step one happens inside ChatGPT. The client generates 16 random bytes and calls POST /backend-api/bazaar/obi/sync-token. It gets back an RS256 JWT whose sub claim is the account identifier, carrying a 22-character obi value and a 60-second expiry.

Step two installs the cookie. That JWT is posted to bzr.openai.com/v1/obi/sync, which responds with Set-Cookie: __obi=...; Domain=.openai.com; HttpOnly; Max-Age=31536000; Path=/; SameSite=none; Secure. The SameSite=none flag is the whole trick: it is what lets the cookie ride along on requests fired from somebody else's website.

Step three is collection. Advertiser pages load bzrcdn.openai.com/sdk/oaiq.min.js and post to bzr.openai.com/v1/sdk/events. Both requests are to an openai.com host, so the browser attaches __obi, and OpenAI can join the page you are looking at to the account you chat with.

If the cookie mechanics are hard to picture, try this. __obi is a hotel key card that only the hotel front desk can read. The shops in town cannot decode it, but each one has a scanner wired back to that desk. The shops learn nothing about you. The front desk learns everywhere you went.

What the sample actually covered

Two different numbers are doing two different jobs here, and it is worth keeping them apart.

The narrow one is a single device. On the author's phone, one __obi value was sent to OpenAI from 12 commercial websites under 13 distinct pixel IDs, naming Chewy, Wayfair, ThriftBooks, Eventbrite, HelloFresh, Coursera and SeatGeek.

The wide one is the pixel population: 936 distinct advertiser pixels across 1,029 hostnames. Separately, 932 sync tokens were decoded, of which 736 were bound to an account and 196 were anonymous. The anonymous identifier is not a throwaway either: the writeup reports one per device, persisting at least 27 days.

Most of the identity was scraped, not supplied

The SDK pulls identity from four places, tagged in the payload as in (handed over by the advertiser), fm (form fields), ht (page text) and js (tag managers). The split is the part worth staring at.

Scraped identity outnumbered advertiser-supplied identity 685 events to 255. In other words, the majority of the personal data flowing to OpenAI was lifted off the page by OpenAI's own script rather than deliberately passed by the merchant who installed it.

Automatic matching is the feature behind that ratio, and it is on by default more often than not. Where the capture could see the setting, 638 of 881 pixels had automatic data matching enabled. The independent AI/TLDR writeup of the same research reports the identical figures.

The word "analytics" is doing a lot of work

This is the finding with actual legal teeth. OpenAI's cookie notice lists __obi under analytics cookies. The author reports that every decoded sync token carried consent_decision: analytics_allowed, which means a user who declined marketing cookies and accepted analytics still gets the cross-site identifier.

A cookie whose entire job is to attach a shopping session to an ad account is not an analytics cookie in any sense a regulator would recognize. It is the only analytics cookie in the world that knows you bought dog food.

Consent guidance for the pixel points the same direction. Setup guides such as this Google Tag Manager walkthrough and Kukie's cookie breakdown note that the pixel initializes with consent set to true unless you call oaiq("consent", false) before init or block the script outright until a visitor opts in. Opt-out, not opt-in, is the shipped default.

If you run the OpenAI pixel, this is your problem

OpenAI does not collect consent on your behalf, the same as Meta and Google do not. You are the one with the banner, and you are the one the regulator writes to. Three concrete things follow:

• Add OpenAI to your disclosures. If your privacy policy names Meta, Google and TikTok as ad-data recipients, the recipient list is now stale. GDPR wants specificity about who receives the data, and OpenAI is a new name.
• Check whether automatic matching is on. In roughly seven of ten observed pixels it was. That setting decides whether OpenAI's script reads your forms and page text for emails, phone numbers and postal codes.
• Gate the script, do not trust the flag. Calling oaiq("consent", false) after init is too late. Either call it first or do not load oaiq.min.js until the visitor has said yes.

Note also that __obi is separate from the conversion cookies you may already know about: __oppref holds the ad click ID for 30 days and __obref is a one-year browser reference. Those measure whether an ad worked. __obi is the one that knows who you are.

What is not established

Hold the caveats straight, because the headline number and the device number are not the same evidence.

The 12-site figure is one researcher's phone, not a population estimate. The 936-pixel and 1,029-hostname counts describe the pixels observed in the capture, not the total deployed across the web. OpenAI was contacted on September 14 and, per both writeups, acknowledged the inquiry without answering questions about the analytics classification or consent handling. No regulator has opened anything public on it.

What is established is the mechanism, and the mechanism is not in dispute: the endpoints, the JWT, the cookie flags and the payload fields are all reproducible by anyone willing to proxy their own traffic. Somebody has already filed an issue against StevenBlack/hosts asking for bzr.openai.com to be blackholed, which is the internet's version of a strongly worded letter, and it is still open.

Why this is a bigger deal than one cookie

The thing that makes this different from a normal ad pixel is what sits on the other end of the join. Meta knows what you browsed. OpenAI can put what you browsed next to what you typed into a chat box at 2am, and people type things into chat boxes they would never type into a search bar.

OpenAI's standing promise is that advertisers cannot access private conversations, and nothing in this research contradicts that. The flow runs the other way. Advertisers are not reading your chats; your browsing is being delivered to the company that already has them.

Key Takeaways

• __obi is a real, reproducible cross-site identifier: a 60-second RS256 JWT from ChatGPT installs a one-year SameSite=none cookie on .openai.com that advertiser pixels return to OpenAI.
• The capture covered 936 distinct advertiser pixels across 1,029 hostnames, with 736 of 932 decoded sync tokens bound to a ChatGPT account.
• Most identity was scraped rather than supplied: 685 events from page text, forms and tag managers versus 255 handed over by the advertiser, with postal code in 100 events across 28 sites.
• OpenAI classifies __obi as an analytics cookie, so declining marketing consent does not prevent it, and the pixel initializes with consent true unless you say otherwise first.
• If you install the pixel you own the consent obligation: update your recipient disclosures, audit automatic matching, and gate the script rather than relying on a post-init flag.
• The single-device site list is illustrative, not a population estimate, and OpenAI has not answered questions about the classification.

Sources: Buchodi's Threat Intel, ChatGPT now knows what you do on other websites via ad collector, AI/TLDR, OpenAI's __obi cookie, Hacker News discussion, StevenBlack/hosts issue #3254, Data Marketing School, OpenAI Ads pixel with Google Tag Manager, Kukie, How ChatGPT ads and cookies work, Captain Compliance, OpenAI cookie list and ads pixel guide