OpenAI's ad pixel reads your page, not just your conversions — and the cookie that carries it home is filed under 'analytics'

Two stories, and the loud one is the smaller one

The headline everyone is running is that ChatGPT now watches what you do on other websites. That is accurate, it is uncomfortable, and for most readers it is the less actionable of the two findings in this research.

The other one: if a business installed OpenAI’s ads measurement pixel, OpenAI’s SDK is reading things off that business’s own pages that nobody at the business decided to send. Not the conversion events configured in the dashboard — form fields, rendered page text, and the contents of the tag-manager bus. And the operator of that site, not OpenAI, is the GDPR controller for it.

Both halves are corroborated. The ChatGPT-side mechanism comes from buchodi’s traffic analysis. The advertiser-side behaviour is described in OpenAI’s own developer documentation, which states that with automatic advanced matching enabled the pixel “automatically detects supported customer information from your website,” normalises and hashes it in the browser with SHA-256, and includes it with conversion events. The documentation and the packet capture describe the same product from two ends.

The mechanism, in order

Step one — token. Opening ChatGPT causes the client to generate 16 random bytes and call POST /backend-api/bazaar/obi/sync-token on chatgpt.com. The backend returns an RS256-signed JWT: issuer chatgpt-wadi, audience bzr.openai.com, purpose obi_sync, a consent_decision field, and a 60-second expiry. This is the step that binds an anonymous random ID to an account.

Step two — cookie. The client posts that token to bzr.openai.com/v1/obi/sync. The response:

Set-Cookie: __obi=«redacted»; Domain=.openai.com; HttpOnly; Max-Age=31536000; Path=/; SameSite=none; Secure

One year. SameSite=none is the operative attribute — it is what permits browsers to include the cookie on requests initiated from unrelated sites.

Step three — the ride-along. Visiting a site carrying OpenAI’s pixel generates three request classes that reach OpenAI infrastructure: GET bzrcdn.openai.com/sdk/oaiq.min.js to load the SDK, and two POST classes to bzr.openai.com/v1/sdk/events. The browser attaches __obi to these before OpenAI’s code executes, which is worth stating precisely: cookie attachment is browser behaviour governed by the cookie’s own attributes, not something the SDK chooses to do at runtime.

The researcher reproduced this on a personal device using two independent capture methods, cross-checked against traffic covering 936 distinct advertiser pixels on 1,029 hostnames. On one device a single __obi value connected to 12 commercial sites across 13 pixel IDs, including Chewy, Wayfair and Coursera; Eventbrite, HelloFresh, SeatGeek and ThriftBooks also appear in the observed set.

The part that belongs to the site owner

Here is where the story stops being about OpenAI’s conduct and starts being about a live compliance exposure sitting in other companies’ tag managers.

The SDK sources identity from four channels, labelled in the payload:

• in — values the advertiser deliberately supplied
• fm — form-field scraping
• ht — rendered page text
• js — tag-manager bus interception, by hooking window.dataLayer.push, reading adobeDataLayer, and parsing GTM layers via the l= parameter

Across observed traffic, scraped identity outnumbered advertiser-supplied identity 685 events to 255. Automatic matching was enabled for 638 of 881 pixels where the setting could be determined — which is to say the default was left on in roughly three-quarters of deployments, which is what defaults are for.

Emails, phone numbers and names are SHA-256 hashed in-browser. Location fields are not: country, region, city and postal code transmit in the clear, and postal code was the single most-harvested form field, appearing in 100 events across 28 sites. URLs are truncated to origin plus path — none of 23,929 observed carried a query string, a genuine mitigation — but paths alone were found exposing medical conditions, debt-relief funnels and litigation intake forms. There is a denylist, and it is real: passwords, one-time codes, card numbers, national identifiers, dates of birth, medical history, diagnosis and court fields are excluded. It does not cover what a URL path reveals about why someone is on the page.

For a European site operator the analysis is uncomplicated and unwelcome. Personal data collected on your pages makes you the controller. A vendor SDK that reads fields you never mapped, enabled by a default you never changed, is your processing activity to document, justify and disclose — and “the tag did it automatically” is not among the six lawful bases. Anyone running the pixel should treat this as a same-week audit item: is it deployed, is automatic matching on, and what is currently sitting on the dataLayer when it fires.

The classification is the whole argument

The disputed point is not the cookie’s existence. It is the label.

OpenAI’s cookie policy lists __obi as an analytics cookie. Every one of the 932 decoded sync tokens carried consent_decision: analytics_allowed — regardless of what the user chose about marketing. So a user who declines advertising cookies and accepts analytics has, by OpenAI’s taxonomy, consented to this.

Set the label beside the properties. The identifier is bound to an account, persists one year, is configured SameSite=none specifically so it crosses origins, and is read by 936 third-party advertiser pixels for the purpose of attributing ad conversions. Those are the properties of an advertising identifier. Analytics cookies, in the ordinary understanding that consent banners rely on, measure behaviour within a property.

Logged-out users are not outside this. Of 932 tokens, 736 carried subject_type: account_user and 196 carried anonymous — and the anonymous device-linked identifiers held stable for at least 27 days, matching account-user stability. Not having an account changes who the profile is named after, not whether one accumulates.

This matters more in Europe than the US, and it lands on ground that is already contested. When ChatGPT’s ads crossed into the EEA in August, the live issue was consent-or-pay and whether “freely given” survives a paid ad-free alternative. A cross-site account-bound identifier classified as analytics is the same question one layer down: consent-or-pay is at least a choice presented to the user. A classification that routes an advertising identifier through the analytics toggle removes the choice by relabelling it.

buchodi put both questions — the analytics classification, and the behaviour on marketing refusal — to press@openai.com and privacy@openai.com on 14 September. OpenAI Support acknowledged the inquiry and said it would be reviewed internally. Per the write-up, neither question was answered.

Where the boundary is, honestly

Several limits belong in any fair reading, and the researcher states them:

• iOS is unaffected. Safari’s Intelligent Tracking Prevention blocks third-party cookies, and Chrome on iOS runs on WebKit, so the mechanism does not operate on any iOS browser. Chrome for Android is where it was confirmed. Desktop Chrome was not tested — a notable gap, since that is where most work-related ChatGPT use happens.
• Not every session syncs. Roughly one ChatGPT session in five produced a sync token, and the mobile web client serves ads without syncing at all.
• Server-side account resolution is inferred. That OpenAI joins the cookie back to an account on its servers follows from the design — a JWT whose stated purpose is binding an ID to an account — but was not directly observed.
• None of this is unprecedented. The researcher says so plainly: comparable ad graphs were built years ago by others. The argument is not that the architecture is novel. It is that people tell an AI chat product things they would not put on a social network, and this architecture connects the two.

What to actually do

If you operate a website: check whether the OpenAI measurement pixel is deployed, and whether automatic advanced matching is enabled — the default is on. Inspect what your dataLayer and adobeDataLayer carry at the moment the pixel fires, since the SDK reads that bus. Whatever is on it is being evaluated for identity. If you are in scope of GDPR, this is a controller-side processing record and a consent-notice question, not a vendor question.

If you run privacy or procurement: the finding to record is not “ChatGPT tracks you.” It is that the consent control offered does not govern the identifier, because of how the identifier is classified. That is a concrete item for a DPIA and a concrete question to put to OpenAI in writing, and it applies equally to every assistant vendor now building an ads business — a list that is getting longer, as sponsored agents showed last week.

If you are choosing an assistant: this is a differentiator between products, not a reason to abandon one. Ads and their measurement are scoped to Free and Go; paid tiers stay ad-free, which makes the ad-free guarantee a priced feature — the same conclusion the EEA ads rollout pointed to. Claude has no advertising business. Perplexity has one and has been moving inference on-device partly as a privacy position. For sensitive or client work the standing advice holds regardless of this research: the free tier of an ad-supported assistant is the wrong place for it.

If you are a marketer running these campaigns: the attribution quality that automatic matching buys is real, and so is the liability it creates on your own domain. Those are separable decisions, and right now most deployments have made only the first one, by default. See the marketers guide and the best AI chatbots roundup for where the ad-supported and ad-free products currently sit.

The pattern

The durable lesson is about taxonomy, not tracking. Consent regimes work by sorting purposes into categories and letting people accept some and refuse others. The category is assigned by the party being consented to. When an identifier with every structural property of cross-site advertising infrastructure is filed under analytics, the consent interface keeps functioning exactly as designed while the choice it offers stops corresponding to anything.

That is not a bug a user can find in a cookie banner. It took packet captures over several months and 932 decoded tokens to see it — which is the actual finding. For a buyer, the operational consequence is to stop treating a vendor’s consent categories as a description of what a vendor does, and to ask, for any AI product with an advertising business attached, which identifiers exist, how long they live, what domain they sit on, and which toggle actually turns them off. Compare the answers across vendors the way pricing gets compared: see Claude vs ChatGPT for where that boundary currently falls.

Update, 22 September 2026 — what else arrived in the same product that week. On 21 September, the day this research was published, OpenAI also connected ChatGPT to a credit bureau: US Plus and Pro subscribers can now authorise an Experian credit-report connection inside Finances, returning a VantageScore 3.0, a report that refreshes monthly, and monitoring alerts for new inquiries, accounts and addresses. OpenAI’s stated position remains that advertisers receive no chats, memories or personal details, and nothing here contradicts it. The point for a DPIA is narrower and structural: the taxonomy question this article raises — who assigns the category, and what the consent control actually governs — now applies to a product surface that holds credit-standing data. The credit-file connection in full.

Questions or corrections? Email Pick Right. Want the full list? See all news.