How ChatGPT learns what you do on other websites

An independent researcher has published a teardown of OpenAI's advertising infrastructure, showing the company can link a user's behaviour on unrelated websites to their ChatGPT account. He reproduced the mechanism on his own phone, verified it with two independent traffic-capture methods, and cross-checked against several months of observations: 936 advertiser pixels across 1,029 hosts.

How it works

At the core is a cookie called __obi, scoped to .openai.com. While you are in ChatGPT, the client generates an identifier and receives a signed JWT from the backend that binds this identifier to your account subject. The token is then sent to the collector at bzr.openai.com, which returns the __obi cookie with a one-year lifetime and SameSite=None — precisely the setting that lets a cookie ride along on cross-site requests.

Any company that buys ads on ChatGPT installs a small piece of OpenAI code on its site, just as sites already install Meta and Google pixels. Simply loading the script discloses __obi: the browser attaches the cookie to the <script src> request before any OpenAI code runs. The SDK's "no credentials" path does not help.

What travels with the identifier

The SDK also harvests page data and personal details. Email, phone, first and last name are hashed before transmission, but country, region, city and postal code are sent in the clear. The biggest source of addresses is the tag-manager bus: the SDK replaces dataLayer.push with its own function. URLs are trimmed to origin plus path, yet the paths survive — those reaching the collector included one naming a medical condition, a debt-relief funnel and a litigation intake form.

On the author's device a single __obi value was sent to OpenAI from twelve commercial sites, including Chewy, Wayfair, HelloFresh and Coursera. The mechanism works when logged out too: the anonymous identifier is just as stable and persists at least 27 days.

Analytics or marketing?

OpenAI's cookie policy lists __obi as an analytics cookie — the only entry in that section. Yet every decoded token carried an analytics_allowed flag: a user who permits analytics but refuses marketing still receives it. Asked about this on 14 September, OpenAI Support said only that the observations would be shared internally for review.

The author stresses that structurally this is standard adtech — Meta built the equivalent years ago. What is unprecedented is running it on a chat product people confide in, telling it things they would never post to a social network.

Source: Hacker News