ChatGPT's "__obi" Cookie Tracks Users Across Other Websites

An independent security researcher known as Buchodi has published a technical investigation, picked up by several cybersecurity outlets, describing a tracking mechanism in ChatGPT built around a cookie named "__obi." The cookie is generated when a user opens the app and is later sent to sites running OpenAI's advertising pixel, linking the user's activity on those sites back to their ChatGPT account.

According to the investigation, which was independently reproduced on a mobile device, the mechanism was observed across roughly 936 advertiser pixels on more than a thousand hostnames. It can pass information about the pages a user visits on advertiser sites — from product pages to purchase flows — back to OpenAI. The company classifies the cookie as "analytics" rather than "marketing," meaning it can still be set even when a user declines marketing consent.

OpenAI has not issued a public comment on the investigation so far.