Researchers Say OpenAI's __obi Cookie Follows You Across Sites, and Its Cookie Policy Classifies It as "Analytics"

The security research outfit Buchodi Threat Intel published a measurement report on September 20 — it reached the top of Hacker News that day — describing a cookie named __obi within OpenAI's ad measurement stack. Per the mechanism the report describes: on chatgpt.com a randomly generated tracking string is exchanged for a signed JWT binding that string to the internal ChatGPT account ID, the token is then posted to an OpenAI sync endpoint, and the endpoint sets the __obi cookie with SameSite=None and Secure — the two attributes that let it be sent cross-site — with a maximum lifetime of one year. Afterward, any page running OpenAI's advertiser pixel sends __obi back along with whatever the pixel collected on that page. The core issue the report raises is consent classification: OpenAI's cookie policy lists __obi as analytics rather than marketing, while every sync token the researcher decoded carried an analytics_allowed consent marker, meaning users who decline marketing consent and accept only analytics consent still receive this cross-site cookie. On scale, the report says it cross-checked 23,929 requests generated by 936 advertiser pixels across 1,029 hostnames, and that of 932 decoded tokens, 736 pointed at an account and 196 were anonymous; named sites include Chewy, Wayfair, ThriftBooks, Eventbrite, HelloFresh, Coursera and SeatGeek. It also says the pixel carries away data it collects on the page, including email, phone number, location and form fields, with postal code alone appearing in 100 events across 28 sites. On browsers, Safari and all iOS browsers, Firefox with Total Cookie Protection, and Brave block the mechanism by default, and the researcher reproduced it on Chrome for Android. One point must be stated plainly: whether the server actually links the cookie to a specific account was not directly observed in traffic — the inference rests on the token design containing the account subject identifier. The researcher contacted OpenAI on September 14; OpenAI support confirmed receipt and said it would pass the matter for internal review, but did not answer the two specific questions about classification and consent handling.

First, Separate What Is Already in the Official Docs From What Is New

This story invites the reading that a secret tracker was uncovered. The accurate dividing line is this. **Not news:** OpenAI has a ChatGPT ads measurement pixel, and that is public in its own developer documentation — a browser SDK for measuring website events attributable to ads in ChatGPT, where you add the script, initialize it, and call it on conversion. Functionally it belongs to the same category as Meta's and Google's conversion pixels. **New:** an outside measurement. What it records is how many sites this identifier actually traveled to, what rode along with it on the way back, and **under what consent state it was issued.** That the capability exists was public; the behavioral details had not been quantified externally before. Drawing that line matters, or the argument lands in the wrong place. The question worth pressing was never whether OpenAI has an ad measurement tool. It is whether this tool's classification, consent handling and collection scope match OpenAI's own policy.

The Strongest Claim Is the Classification, Because It Can Be Checked Against Public Text

The most credible and hardest-to-explain item in the report is the consent classification. OpenAI's cookie policy lists __obi as **analytics**, not marketing. And every sync token the researcher decoded carried an "analytics allowed" consent marker. If the mechanism works as described, then **a user who explicitly declined marketing consent and checked only analytics still receives a cookie configured to be sent cross-site with a lifetime of up to a year.** This claim deserves to be pulled out on its own because testing it requires no private data: the classification is what OpenAI wrote in its own public policy, and the consent toggles are the two options it designed. The only judgment being made is whether those two are consistent. It is also one of the two questions the researcher put to OpenAI. OpenAI support confirmed receipt and said it would go for internal review, but did not answer. As of publication, OpenAI has neither publicly confirmed nor disputed the report's technical details.

The Boundary That Has to Be Stated: One Key Inference Was Not Directly Observed

The report declares a limitation of its own that should not be lost in retelling: **whether the server actually links the cookie to a specific account was not directly observed in traffic.** What supports the inference is the token design — it contains the account subject identifier — but that is "the design points there," not "this was observed happening." So the accurate framing is: cross-site transmission was observed; server-side linkage to an account is a reasoned inference, not yet established. That distinction is not pedantry. It decides whether this is cross-site behavioral measurement or cross-site behavior bound to a named account, and those carry entirely different weight under privacy law. The figures need the same treatment: 23,929 requests, 936 pixels, 1,029 hostnames, 932 decoded tokens — all from a single research party's own measurements, with no second-party reproduction yet. Treat the scale data as an order of magnitude, not a settled finding.

Sites Running This Pixel Have Their Own To-Do Item

The audience most likely to skip this story is not ChatGPT users. It is **site operators.** The report says the pixel carries away what it collects on the page — email, phone number, location, form fields — with postal code alone appearing in 100 events across 28 sites, and that this kind of scraped identity data outnumbered advertiser-supplied identity in the observed traffic. If that holds, then for a site running this pixel it is not merely doing conversion measurement; it has a data egress point it needs to assess itself, particularly on form and checkout pages. This can be self-audited without waiting for OpenAI's reply: look at which pages the pixel is on, what fields those pages contain, and whether any automatic matching option is switched on. That is the most concrete action item here. The user-side action item is equally concrete and cheap: per the report, Safari and all iOS browsers, Firefox with Total Cookie Protection, and Brave block this mechanism by default, and the researcher reproduced it on Chrome for Android. Exposure therefore depends heavily on browser choice — **while everyone waits for a vendor answer, switching browsers or turning on the relevant cross-site isolation setting does more than any statement will.**

via: OpenAI's ads measurement pixel documentation, Cybersecurity News, explainX's review of the report, Captain Compliance's technical analysis