OpenAI's Ad Pixel Links Your ChatGPT Account to What You Do on Other Websites

Introduction: A Pixel With a Long Memory

On September 20, 2026, a detailed reverse-engineering write-up rocketed to the top of Hacker News with 150+ points in its first three hours. The subject: a reverse-engineering analysis showing that OpenAI operates an ad-measurement pixel at bzr.openai.com that quietly connects what you do on ordinary shopping and reading websites to your ChatGPT account.

The mechanism centers on a cookie called __obi, scoped to .openai.com, set with SameSite=None and a one-year lifetime. Once it's in your browser's cookie jar, any advertiser site that embeds OpenAI's measurement code automatically pings OpenAI with your ChatGPT-linked identifier — along with data about the page you're browsing: products you're searching for, articles you're reading, and purchase behaviors.

The author reproduced the full mechanism on a real phone, verified it with two independent capture methods, and cross-checked it against months of observed traffic covering 936 distinct advertiser pixels across 1,029 hostnames. This isn't speculation — it's a documented, verifiable data flow.

How the __obi Cookie Actually Works

The system works in three steps that will feel familiar to anyone who has studied Meta's or Google's ad infrastructure — with one critical difference we'll get to shortly.

Step 1: ChatGPT creates an identifier and signs it

While you use ChatGPT, the client generates 16 random bytes and exchanges them for an RS256-signed JWT from a backend endpoint. The decoded token binds your account subject (a 64-hex identifier) to a 22-character obi identifier, scoped specifically to the ad collector, and expires in 60 seconds. Internally, OpenAI calls the ads platform bazaar — that's what the bzr in the domain stands for.

Step 2: The identifier becomes a cross-site cookie

The client then posts that JWT to bzr.openai.com, which responds with:

Set-Cookie: __obi=…; Domain=.openai.com; HttpOnly; Max-Age=31536000; SameSite=none; Secure

SameSite=None is precisely the configuration a cookie needs to be transmitted on cross-site requests — and the one-year Max-Age means it persists long after you've closed the tab and forgotten about it.

Step 3: Advertiser sites send it back

Three classes of requests flow from an advertiser's page to OpenAI's hosts, and all three were observed carrying the __obi cookie. Most notably, the mere loading of the SDK script itself transmits the identifier — before any of OpenAI's own code runs, the browser has already attached cookies to the request. Even the SDK's "no credentials" code path can't prevent it.

What Travels With It: Scraped Identity Outnumbers Deliberate Data

Here's where the story moves from "standard adtech" to genuinely uncomfortable. The pixel SDK also collects identity directly from the advertiser's page, and OpenAI's own payload labels distinguish deliberately passed values from scraped ones — scraped from form fields, rendered page text, and the tag-manager data layer. In the observed traffic, scraped identity outnumbered advertiser-supplied identity 685 events to 255.

The tag-manager bus turned out to be the single largest source of email addresses. The SDK replaces window.dataLayer.push with its own function, reads adobeDataLayer, and even locates renamed GTM layers by parsing parameters off the Google Tag Manager script tag. An earlier SDK version (0.1.31) also harvested names and geography before the scope was narrowed on August 27.

Emails, phone numbers, and first/last names are SHA-256 hashed before transmission — but country, region, city, and postal code are sent in the clear. Postal code was the single most-harvested form field in the dataset. Automatic matching was enabled for 638 of 881 observable pixels, including every credit and lending advertiser seen. A denylist does exclude passwords, card numbers, SSNs, and medical-history fields — yet the paths that reached the collector included, per the author, a medical condition, a debt-solutions funnel, and a litigation intake form.

The Observed Reach: 936 Pixels, 1,029 Sites

On the researcher's own device, a single __obi value was transmitted to OpenAI from 12 commercial websites under 13 distinct pixel IDs — including major names like Chewy, Wayfair, ThriftBooks, Eventbrite, HelloFresh, Coursera, and SeatGeak. Every single request was accepted with a 202 status.

In the broader traffic corpus, 12 of 30 distinct __obi values appeared under more than one advertiser — one appeared under ten. The identifier isn't a per-site throwaway; it's a durable cross-site link. And critically, advertisers themselves cannot see any of this. The cookie belongs to a domain their scripts can't read. They installed a conversion pixel and have no way to know their visitors are being resolved to a ChatGPT identity.

It Works Even When You're Logged Out

If you think logging out of ChatGPT protects you, the data says otherwise. Across 932 decoded sync tokens, 736 carried an account_user subject and 196 carried an anonymous subject — and the anonymous identifier is just as stable, one per device, persisting for at least 27 days.

There's also a consent wrinkle. OpenAI's cookie policy lists __obi under Analytics cookies — it's the only entry in that section — while the company runs analytics and marketing as two separate consent choices. Every decoded sync token carried consent_decision: analytics_allowed. In other words: someone who allows analytics and explicitly refuses marketing still gets this cookie. The author sent OpenAI two questions about this classification on September 14; the company's support team acknowledged the inquiry, said it would be shared internally, and did not answer either question.

Important Limits: What This Is and Isn't

Good research is honest about its boundaries, and this write-up is unusually careful:

• iOS is unaffected. Safari's Intelligent Tracking Prevention blocks all third-party cookies, and Chrome on iOS runs on WebKit — so the mechanism does not operate on any iOS browser.
• Not every session syncs. Roughly one ChatGPT session in five produced a sync token, and the mobile web client serves ads without syncing at all.
• The final join is inferred, not observed. The collector accepting a cookie-bearing event (202) doesn't literally show OpenAI resolving it to your account server-side — though that resolution follows directly from the system's design.
• This is structurally old adtech. Meta built the equivalent years ago: a logged-in account, third-party cookies on pixel fires, off-site conversions resolved to a profile. The mechanics are standard.

Which raises the real question: what has no precedent is running this machinery on an AI chat product. People tell these products things they would never post on a social network — health worries, relationship problems, career plans — and AI assistants increasingly act on their behalf across the web. Combining that intimate context with a cross-site advertising identifier is a category shift, not an incremental one.

The Bigger Picture: AdTech Meets the AI Assistant

The timing matters. ChatGPT's advertising business reportedly passed a $1 billion annual run rate within 200 days of launch, and 2026 has seen every major AI player — from Google's Gemini ecosystem to Perplexity — race to build monetization on top of assistants. Measurement pixels are table stakes for any ads business: without them, advertisers can't attribute conversions and won't spend.

But assistants are not social feeds. The implicit bargain with a chatbot — "tell me anything, I'm here to help" — was never explicitly renegotiated to include "and I may note what you buy elsewhere, hashed or otherwise." Regulators in the EU are already circling AI-data practices, and GDPR Article 17 deletion failures at other AI providers have been trending this same week. Expect this write-up to become a reference point in that fight.

For the industry, the lesson is straightforward: the moment an AI product becomes an ad product, it inherits every trust problem adtech spent two decades earning. Labs that want the ad revenue without the backlash will need consent flows and data separations far more conservative than what this pixel demonstrates.

How to Protect Yourself

You don't have to wait for OpenAI's response to the questions it hasn't answered. Practical defenses, in order of impact:

• Use a browser that blocks third-party cookies. Safari and all iOS browsers (including Chrome on iOS) already neutralize __obi entirely. Firefox's strict mode and Chrome's third-party cookie phase-out offer similar protection.
• Use a privacy-focused extension or browser. Content blockers like uBlock Origin kill the SDK script request before it ever loads — and remember, the script load itself is one of the transmission vectors.
• Review your OpenAI consent choices. Check the analytics consent toggle in your OpenAI account settings; since __obi is classified as analytics, that's the switch that governs it — though the logged-out anonymous identifier is a separate matter.
• Clear the cookie directly. Deleting __obi for .openai.com breaks the link until a new sync occurs — imperfect, but immediate.
• Use separate browsers or containers for AI tools. Keeping Claude, ChatGPT, and other assistants in a container or dedicated profile prevents cross-site identifier leakage by construction.

Frequently Asked Questions