OpenAI's __obi Cookie: How ChatGPT Ads Track You Across Sites

OpenAI’s advertising collector, hosted at bzr.openai.com, sets a cookie called __obi. Its scope is .openai.com, its value stays active while someone is using ChatGPT, and it is bound to that person’s ChatGPT account. Solidot reported the details; the account binding is the part worth pausing on.

A cookie that points at an account, not a browser

Most tracking cookies hand out a random string. That is enough to stitch a browsing history together, but it does not necessarily point at a real person. __obi is described as tied to an account, which changes what the identifier is good for. Data arriving from other sites can be attached to a specific user rather than to a browser profile — the difference between “someone on this machine looked at X” and “this account holder looked at X.” For ad targeting, and for measuring whether an ad did anything, those are not the same thing.

A snippet on the advertiser’s site

Companies that buy ads on ChatGPT are expected to place a short piece of OpenAI code on their own sites, the way they already drop in a Meta pixel or a Google tag. When the page loads, the snippet sends __obi to OpenAI along with context about the visit: which products were searched, which article is being read, whether a purchase went through. As the report summarizes it, the ad collector lets ChatGPT know what you do on other websites.

Advertisers will recognize the pattern. Pixel-based retargeting and cross-site attribution have worked this way for more than a decade, and the mechanics are well documented in privacy research. What is different here is the destination. The data lands with OpenAI, which already holds conversation history, account details and billing relationships for the same person. Selling ads on ChatGPT creates an obvious measurement problem — an advertiser wants to know whether the ad led to a purchase — and pulling in off-site behavior is the standard way to answer it. Note also that nothing in this setup is hidden from the advertiser: the code sits on their pages, under their control.

The part the report leaves open

Cross-site identification is not new. Meta’s pixel and Google’s tags follow the same idea: put your identifier on someone else’s page and read it back later. Browsers have been closing that door for years. Safari and Firefox block third-party cookies by default, and Google’s plan to phase them out in Chrome has been revised more than once. That pressure is precisely why companies look for workarounds, and running code inside the advertiser’s own domain is one of them. None of this makes the mechanism novel; it means a company best known for a chatbot is now running machinery that looks a lot like an ad network’s.

The report does not explain how __obi travels from an advertiser’s page back to OpenAI. A cookie scoped to .openai.com is not readable on another domain by default, so either the value is stored somewhere else as well, or the handoff works differently from the plain description. The source does not say.

If you are logged into ChatGPT and an advertiser’s page loads that snippet, both sides end up holding a reference to the same account. The usual defenses still apply: clear cookies, block cross-site tracking in the browser, or browse logged out. Whether OpenAI offers anything more explicit than that is, for now, unstated.