OpenAI's __obi cookie follows ChatGPT users onto advertiser pages for a year

The report describes designed product behavior. No CVE, no patch, no third-party attacker anywhere in the chain ^[18]. Whether the flow works at all depends on the browser: the capture was made on Chrome for Android, and Safari's tracking protections block the described third-party-cookie path ^[13].

The design follows established ad-tech tracking ^[16]. ChatGPT's client generates a random identifier and asks OpenAI for a short-lived signed token, and that token carries the identifier plus a subject representing either the logged-in account or an anonymous device ^[2]. The token goes to bzr.openai.com, which writes __obi as a .openai.com cookie, SameSite=None; Secure, with a one-year lifespan ^[3]. From then on, an advertiser page running OpenAI's SDK that loads an OpenAI resource or posts a conversion event can have the cookie attached automatically by the browser ^[5].

The SDK's reach on the advertiser page goes past conversion counts. It can read values supplied by the advertiser, form fields, rendered page content and tag-manager data layers ^[7]. Email addresses, phone numbers and names were reportedly hashed with SHA-256 before transmission, while city, region and postal code could be sent in plaintext ^[8]. Query strings were stripped from URLs and paths were not, and the observed paths included references to medical conditions, debt services and litigation intake pages ^[9]. A denylist in the SDK is intended to exclude passwords, payment-card numbers, Social Security numbers, medical history and diagnoses ^[10].

Buchodi's comparison set was several months of observed traffic covering 936 advertiser pixels across 1,029 hostnames ^[4]. That is about 1.1 hostnames per pixel, so at least some pixels are served from more than one host ^[17].

OpenAI's cookie policy lists __obi as an analytics cookie, and every synchronization token the researcher examined referenced analytics consent ^[11]. The behavior captured is cross-site advertising measurement, with conversion events posted back to OpenAI from advertiser sites ^[1][5]. OpenAI Support acknowledged questions submitted on September 14 about that classification and about how analytics consent interacts with marketing consent; according to the report, substantive answers did not follow ^[12].

He did not directly observe OpenAI joining collected advertiser events to individual accounts, and said the cookie and signed-token design appeared structured to enable such a link ^[14]. For anyone who has approved ChatGPT for staff use, the controllable variable is the browser: third-party cookies blocked, a browser with stronger tracking prevention, and the ChatGPT cookie and consent settings reviewed ^[15].