An independent researcher has uncovered what appears to be a cross-site tracking system connected to OpenAI's rapidly growing advertising business. At the center of it is a cookie called "__obi," which can reportedly travel from ChatGPT to websites using OpenAI's advertising technology.
That means if you use ChatGPT and later visit a participating retailer or other website, OpenAI may be able to recognize the same browser and receive information about what you do there.
The finding comes at a particularly interesting time. OpenAI has been rapidly expanding advertising inside ChatGPT, recently announcing new AI-powered advertising tools and Sponsored Agents. The company said last month that ChatGPT Ads had already reached a $1 billion annualized revenue run rate.
But this isn't quite as simple as assuming ChatGPT is watching everything you do online. There are some important limitations to the research, including one major piece of the system the researcher wasn't able to independently verify.
Here's what we know.
What is __obi?
The research comes from an independent researcher who publishes under the name Buchodi and says they analyzed months of network traffic involving 936 OpenAI advertiser pixels across 1,029 hostnames.
According to the analysis, visiting ChatGPT can result in OpenAI placing a cookie called __obi in your browser.
Cookies themselves aren't unusual; you've probably accepted them on a several websites. They're small pieces of information stored by your browser and are used for everything from keeping you logged into a website to remembering preferences and measuring advertising.
What's interesting here is how this particular cookie is configured. Buchodi found that __obi can last for one year and uses the SameSite=None setting, which allows it to be included in certain requests originating from other websites.
That's where OpenAI's advertising system comes in. Businesses advertising through ChatGPT can install OpenAI's measurement pixel on their websites, similar to the tracking technology used by advertising platforms such as Google and Meta.
When Buchodi visited participating websites, requests sent back to OpenAI included the __obi identifier. In other words, the same identifier created through ChatGPT could show up again when that browser visited another website.
What can OpenAI see?
Potentially more than simply whether you visited a website. According to Buchodi's network analysis, OpenAI's advertising collector received information associated with pages people visited and conversion events on participating sites.
The researcher examined 23,929 observed URLs and found that query strings were stripped before being sent to OpenAI, but URL paths remained.
A URL path can sometimes reveal considerable information about what someone is looking at. Buchodi says paths observed in the dataset included pages involving a medical condition, debt services and a litigation intake form.
The advertising system also supports what OpenAI calls conversion measurement.
OpenAI's own documentation says advertisers can install a pixel and use conversion measurement to understand what happens after someone interacts with a ChatGPT ad. Its measurement integrations can support conversion tracking and attribution across websites, apps and even offline activity.
That's standard practice in digital advertising. What's unusual is that the advertising platform in this case sits alongside an AI assistant where users may share substantially more personal context than they would with a traditional search engine or social network.
Is it connected to your ChatGPT account?
This is where the story gets more complicated. Buchodi found that the process used to generate the identifier included tokens labeled either account_user or anonymous.
Of 932 tokens the researcher decoded, 736 were associated with logged-in users and 196 were labeled anonymous. The researcher also found that anonymous identifiers could remain stable on the same device for at least 27 days.
However, there's an important caveat. Buchodi did not directly observe OpenAI taking an event received from an advertiser website and joining it to a person's ChatGPT account on its servers.
The researcher argues that the architecture makes such a connection possible, but that final server-side step wasn't independently observed.
So it would be premature to say OpenAI definitively attaches every page you visit on participating sites to your ChatGPT profile. What the research does demonstrate is that the same OpenAI identifier can be transmitted from participating websites back to OpenAI.
Buchodi says the identifier appeared across a number of recognizable websites during testing. On one device, the same __obi value was sent to OpenAI from 12 commercial websites using 13 separate advertising pixels. Across the larger dataset, 12 of 30 identifiers appeared with more than one advertiser, while one appeared across 10 different advertisers.
The researcher also notes several important limitations. Testing was performed using Chrome on Android, and desktop Chrome wasn't tested. Safari's anti-tracking protections block the third-party cookie mechanism described in the research, meaning it shouldn't operate the same way on Safari or other iOS browsers using Apple's WebKit.
The identifier also wasn't generated during every ChatGPT session. Buchodi estimates that roughly one in five sessions tested produced the synchronization token.
What does OpenAI say?
OpenAI hasn't publicly responded to the specific findings. Buchodi says they contacted OpenAI's press and privacy teams on September 14 and asked why __obi was classified as an analytics cookie and how it behaves when someone rejects marketing cookies.
According to the researcher, OpenAI acknowledged the inquiry and said the findings would be passed along internally but had not provided answers to those questions when the research was published.
Tom's Guide has contacted OpenAI for comment and will update this story if we hear back.
OpenAI's public documentation emphasizes that advertisers do not receive ChatGPT conversations, chat histories, memories or personal details.
The company also says it does not sell user data to advertisers, and advertisers receive aggregated reporting about things such as views, clicks and conversions.
That's an important distinction here: the research does not suggest advertisers themselves can read your ChatGPT conversations or access the __obi identifier.
Instead, the concern is about information potentially flowing in the other direction — from websites using OpenAI's advertising tools back to OpenAI.
Why this matters
Cross-site advertising measurement isn't new. In fact, Google, Meta and other advertising companies have spent years building systems designed to determine whether someone who saw or clicked an ad later visited a website or bought something. But ChatGPT introduces another dimension.
People don't just search for products using ChatGPT. They use it to discuss relationships, health concerns, finances, careers, travel plans and countless other parts of their lives.
OpenAI itself promotes ChatGPT advertising around this idea, telling advertisers that people share "richer context" in ChatGPT while exploring options and making decisions.
That's why the boundary between your ChatGPT activity and what you do elsewhere on the web matters.
For now, the evidence doesn't show that OpenAI is handing your conversations to advertisers — and OpenAI explicitly says it doesn't.
But the discovery of __obi raises a different question: how much information should be able to flow back into an AI platform after you leave it?
What do you think? Share your thoughts in the comments.
Follow Tom's Guide on Google News and add us as a preferred source to get our up-to-date news, analysis, and reviews in your feeds. Subscribe to Tom's Guide on YouTube and follow us on TikTok.
More from Tom's Guide
