Report: ChatGPT sets a cookie linking your account to other sites
A reverse-engineered __obi cookie reportedly ties your ChatGPT identity to advertiser sites: hashed PII, plaintext location, consent on by default.
Copy markdown
A cookie that follows you off ChatGPT
A reverse-engineer reports ChatGPT now mints a random ID, pulls a signed JWT from /backend-api/bazaar/obi/sync-token, and swaps it at bzr.openai.com for an __obi cookie (SameSite=none, one-year expiry). On any site running OpenAI's ad pixel, your browser reportedly ships __obi back with the page — tying that visit to your logged-in ChatGPT account, not just an anonymous ad ID.
What reportedly leaves the page
The pixel is said to forward advertiser-supplied IDs, form-field values, page text, and tag-manager data. Email, phone, and name are SHA-256 hashed before sending; country, region, city, and postal code go in the clear. OpenAI's cookie policy reportedly files __obi under 'analytics,' not marketing — so refusing marketing cookies doesn't stop it.
The pixel isn't new — the account link is
OpenAI's ad-measurement pixel (the __oppref cookie plus a server-side Conversions API) has been documented since the Feb 9 US ad pilot, with marketing cookies on by default for free US accounts from Apr 30 and an EU rollout on Aug 24. The fresh claim is that your ChatGPT identity is now the join key stitching those events together.
How to turn it down
Consent reportedly initializes as true unless set false before init, so 'allow analytics, refuse marketing' still hands you the cookie. Check OpenAI's data and privacy controls to opt out; if you embed OpenAI's pixel on your own site, call consent-off before init (or block the script until the visitor opts in) to stay clean under EU/UK rules.