OpenAI uses a cookie called “__obi” in ChatGPT that links accounts with activity on external advertising partner sites. That is what an analysis published on September 20, 2026, by independent security researcher Buchodi shows. The identifier stays stored in the browser for up to 365 days and is filed as an “analytics” cookie, not a marketing cookie.
Cookie exchange links ChatGPT account to shopping sites
The mechanism runs in several steps: the ChatGPT client generates 16 random bytes and posts them to /backend-api/bazaar/obi/sync-token. The server replies with a signed JWT token that contains the account identifier and is valid for only 60 seconds. The client then submits that token to bzr.openai.com/v1/obi/sync; the response sets the __obi cookie on the domain .openai.com – with the attributes SameSite=None, Secure, and a validity of 31,536,000 seconds, or one year. When a person then visits a partner site carrying OpenAI’s tracking script, the browser automatically sends the cookie along. Buchodi’s traffic analysis found the matching script on 936 distinct advertising pixels across 1,029 domains, including online retailers Wayfair and Chewy as well as providers such as HelloFresh, Coursera, Eventbrite, ThriftBooks, and SeatGeek – independently unverified. In one specific test, the same __obi identifier turned up on twelve commercial websites under 13 different pixel IDs. The mechanism has so far only been tested on Chrome for Android; on iOS devices, Safari’s built-in tracking protection currently blocks the cookie’s cross-site transfer.
OpenAI files the tracking cookie as an analytics tool
OpenAI places __obi in its own cookie policy under the “Analytics” category, describing such cookies as helping it understand “how our Services perform and are used.” Buchodi evaluated 932 intercepted sync tokens; every one carried the field consent_decision with the value analytics_allowed – regardless of whether a person had explicitly declined advertising tracking beforehand. 736 of the tokens carried the account type “account_user,” 196 were logged as “anonymous,” meaning the mechanism also runs for signed-out visitors. For 638 of 881 examined ad pixels, automatic identity matching was additionally switched on. By Buchodi’s count, the observed forms yielded 685 automatically scraped data points against 255 fields supplied directly by advertisers; the most frequently harvested field was the postal code, in 100 instances across 28 different sites. Buchodi says they contacted OpenAI’s press and privacy teams on September 14, 2026, asking about the classification and how a declined consent is handled. Support confirmed receipt of the request, according to Buchodi, but did not answer the substantive questions; one further report says OpenAI merely announced an internal review of the findings.
Ad program has run across Europe since August
The advertising program in question has been active in Germany and 30 other European countries since August 24, 2026 and applies to the free Free and Go tiers; Plus, Pro, and business accounts stay ad-free. At launch, OpenAI had pledged to delete usage data for ad selection after 30 days at the latest – a markedly shorter span than the __obi cookie’s one-year lifetime, though it remains unclear whether the two mechanisms cover the same data. Under the EU’s General Data Protection Regulation, personalized advertising requires separate consent, while analytics purposes can sometimes rely on legitimate interest instead – so the analytics classification is not a mere formality, but decides whether a declined ad consent actually takes effect.
Whether a European data protection authority will review the __obi cookie’s analytics classification, and whether it holds up against the GDPR’s stricter consent rules for ad tracking, remains open. For OpenAI Ireland, which is responsible for ChatGPT in the EU, a formal inquiry would be another item alongside the ongoing classification as a large online search engine.
