A newly discovered method by OpenAI could link user activity on participating advertiser websites to ChatGPT users via cross-site cookies This article explores openai hosts advertiser. . A thorough examination of traffic over several months revealed activity involving 936 advertiser pixels across 1,029 hostnames.
The service responds with a short-lived RS256 JSON Web Token, which includes an obi value and, for signed-in users, an account-associated subject field. ChatGPT Ad Collector Monitors User Activity(Source: buchodi) The study revealed that other OpenAI cookies were impeded by browser cookie controls in third-party contexts, but __obi was transmitted to OpenAI hosts during advertiser-page activity. Businesses purchasing ads through ChatGPT can reportedly install OpenAI's measurement SDK on their websites, much like Meta Pixel and Google Ads conversion tags.
The data sources reportedly include values provided by advertisers, website form fields, rendered page text, and tag-management systems like Google Tag Manager and Adobe Data Layer. Email addresses, phone numbers, and names were reportedly hashed with SHA-256 before transmission, while location-related fields including country, region, city, and postal code were sent in clear text. Those paths might still reveal sensitive browsing habits, such as medical condition pages, debt relief routes, and legal intake forms.
However, the researcher noted that decoded sync tokens showed an analytics_allowed consent decision, even in cases where marketing consent was declined. Explore for your team.
