OpenAI Ad Collector Tracking: How the __obi Cookie Links ChatGPT Accounts to Web Activity

OpenAI has implemented a cross-site tracking mechanism that allows the company to link a user's activity on third-party websites to their specific ChatGPT account. This is achieved through an ad collector hosted at bzr.openai.com and a specialized cookie named __obi.

The Tracking Mechanism: How __obi Works

OpenAI connects user identity across different domains using a three-step process involving a signed token and a cross-site cookie.

1. Identifier Generation and Signing

On chatgpt.com, the client generates 16 random bytes and requests a sync token via POST /backend-api/bazaar/obi/sync-token. The OpenAI backend returns an RS256 JWT (JSON Web Token) that binds a 22-character identifier (obi) to the user's account subject (sub). This token is scoped to the collector and expires within 60 seconds.

2. Cookie Deployment

The client then sends this JWT to bzr.openai.com/v1/obi/sync. The server responds by setting a cookie: __obi=«value»; Domain=.openai.com; HttpOnly; Max-Age=31536000; Path=/; SameSite=none; Secure.

Because the cookie is configured with SameSite=none and Secure, it is permitted to be sent on cross-site requests, unlike other OpenAI cookies (such as oai-did or session cookies) which are blocked by browsers due to SameSite=Lax or domain mismatches.

3. Data Transmission from Advertiser Sites

When a user visits a website that has installed OpenAI's measurement pixel (the SDK), the browser automatically attaches the __obi cookie to requests sent to OpenAI's hosts. This happens in three primary ways:

  • SDK Loading: The browser attaches the cookie to the <script src> request that loads bzrcdn.openai.com/sdk/oaiq.min.js before any SDK code even executes.
  • Conversion Events: POST requests to bzr.openai.com/v1/sdk/events with an obref identifier.
  • Credential-less Path: POST requests to bzr.openai.com/v1/sdk/events using the SDK's "no credentials" path.

Data Collection and Scraped Identity

Beyond the __obi identifier, the OpenAI SDK collects identity data directly from the advertiser's page. The SDK scrapes data from four sources: advertiser-supplied values (in), form fields (fm), rendered page text (ht), and the tag-manager bus (js).

Key findings regarding the data collected include:

  • Scraped vs. Supplied: Scraped identity data significantly outnumbers advertiser-supplied data (685 events to 255 in observed traffic).
  • Harvested Fields: The SDK targets email and phone numbers from tag-manager buses (replacing window.dataLayer.push and reading adobeDataLayer). Postal codes are the most frequently harvested form fields.
  • Privacy Protections: Email, phone, and names are SHA-256 hashed before transmission. However, country, region, city, and postal code are sent in cleartext.
  • Sensitive Data: While a denylist excludes passwords, SSNs, and medical history, observed paths sent to the collector included medical conditions, debt-solution funnels, and litigation intake forms.

Reach and Scope

Research indicates that the __obi identifier is sent to OpenAI from a wide variety of commercial websites, including Coursera, HelloFresh, Eventbrite, Wayfair, and SeatGeek. The mechanism works for both logged-in users (subject_type: account_user) and logged-out users (subject_type: anonymous), with anonymous identifiers persisting for at least 27 days.

Browser and Technical Limitations

The effectiveness of this tracking depends on the browser's cookie handling policies:

  • iOS Browsers: The mechanism does not operate on any iOS browser because Safari's Intelligent Tracking Prevention (ITP) and WebKit-based Chrome on iOS block all third-party cookies.
  • Android Chrome: The tracking was observed and functions on Chrome for Android.
  • Cookie Partitioning: Some users note that browsers implementing strict cookie partitioning (CHIPS) would render this concern moot by separating the cookie jars used when a site is a third party.

Community Perspectives and Counterpoints

Technical discussions highlight a tension between the "standard" nature of this technology and the context of AI products.

The mechanism is standard adtech. What has no precedent is running it on an AI chat product. People tell these products things they would not put on a social network, and these products increasingly act on their behalf.

Critics argue that the lack of transparency is particularly concerning given that some users pay for subscriptions, yet their data is still collected via third-party cookies. Others suggest that blocking bzr.openai.com via DNS or using browsers like Firefox, Brave, or Safari, which implement stricter cookie isolation, are effective mitigations.

Sources

Related