A newly disclosed OpenAI advertising technique could link user activity on participating advertiser websites to ChatGPT user identities via cross-site cookies This article explores openai hosts advertiser. . The comprehensive analysis spanned several months of observed traffic involving 936 advertiser pixels across 1,029 hostnames.
The service returns a short-lived RS256 JSON Web Token, including an obi value and, for signed-in users, an account-associated subject field. ChatGPT Ad Collector Monitors User Behavior (Source: buchodi) The study revealed that other OpenAI cookies were bypassed by browser cookie controls in third-party contexts, whereas __obi was transmitted to OpenAI hosts during advertiser-page activity. Businesses purchasing ads through ChatGPT can reportedly install OpenAI’s measurement SDK on their websites, similar to existing Meta Pixel and Google Ads conversion tags.
Sources reportedly include values provided by advertisers, website form fields, rendered page text, and tag-management systems like Google Tag Manager and Adobe Data Layer. Email addresses, phone numbers, and names were reportedly hashed with SHA-256 before transmission, while location-related fields such as country, region, city, and postal code were sent in clear text. These paths may still reveal sensitive browsing contexts, such as medical condition pages, debt relief routes, and legal intake forms.
However, the researcher noted that decoded sync tokens indicated an analytics_allowed consent decision, even in cases where marketing consent was declined.
