A cookie called __obi may be connecting what you do on third-party advertiser websites back to your ChatGPT identity. Independent technical reporting published September 20–21, 2026, describes a cross-site tracking mechanism that OpenAI classifies as “analytics” in its cookie policy, updated September 10, 2026. This kind of covert data collection echoes concerns raised when a secretly tracking users story revealed similar cross-platform surveillance patterns.
That classification gap carries real weight for users and, potentially, for regulators.
How the Mechanism Reportedly Works
Independent reporting describes a token exchange that places a persistent, cross-site identifier on your browser through ChatGPT.
According to independent investigator Buchodi, ChatGPT generates a short-lived token, sends it to OpenAI’s bzr.openai dot com domain, and receives a signed token in return. That exchange sets the __obicookie, which is scoped to openai.com and carries the SameSite=None, Secure, and HttpOnly attributes. Those settings allow the cookie to be included in cross-site requests, but only when a website has loaded OpenAI’s measurement pixel and initiates a cross-origin request to OpenAI’s servers.
Advertiser sites using that pixel reportedly load a script from bzrcdn.openai dot com/sdk/oaiq.min.js. Those sites then send conversion events to bzr.openai dot com/v1/sdk/events, and those requests can carry the __obi cookie back to OpenAI along with page data, form-derived identity signals, and conversion activity. This approach resembles the mechanics described in reporting on a surveillance app built to covertly monitor targets across digital platforms.
Buchodi also observed anonymous tokens in the exchange, suggesting a logged-in ChatGPT account may not be required for the cookie to appear. The behavior was seen on Chrome for Android; iOS browsers face constraints from WebKit’s Intelligent Tracking Prevention that appear to limit this mechanism.
One material caveat applies to the full tracking claim. Buchodi acknowledges the server-side join of identifiers was not directly observed, so the complete chain connecting off-platform behavior to a specific ChatGPT identity remains an inference from the reported mechanics, not a confirmed fact.
The “Analytics” Label and What OpenAI Has Said
OpenAI classifies __obi as an analytics cookie, but independent reporting describes behavior that more closely resembles ad-conversion measurement.
OpenAI’s cookie policy lists __obi as an analytics cookie with a one-year duration on chatgpt dot comand openai.com. OpenAI describes the cookie as helping the company understand the effectiveness of its services and marketing efforts.
Buchodi observed that sync tokens carried a field reading consent_decision: analytics_allowed, which reportedly means analytics-only consent permits the cookie to be set. Users who accepted analytics cookies but declined marketing cookies may not realize that choice reportedly enabled cross-site ad measurement.
“Analytics” and “ad conversion measurement” are not the same category under most privacy frameworks. Purpose limitation is a core principle in regulations like GDPR. It requires that data collected under one stated purpose not migrate to another, and whether OpenAI’s classification survives that scrutiny is an open question.
OpenAI did not directly answer questions about why __obi carries an analytics label or whether analytics-only consent is intended to cover this use. According to the reporting, the company acknowledged the inquiry and said it would be reviewed internally.
What This Means for You Right Now
Until OpenAI clarifies its position, your cookie consent choices on ChatGPT may not mean what you expect.
You may have consented to analytics cookies on ChatGPT or openai.com without consenting to marketing cookies. Whether that choice covers the off-platform ad measurement the report describes is currently unclear.
To review or change your selections, open ChatGPT settings, navigate to Data Controls, and review your cookie consent options. If those controls are unavailable in your region, OpenAI’s privacy request form is the next available path.
Whether “analytics” accurately describes a mechanism that reportedly links advertiser site behavior to a ChatGPT account is a disclosure question privacy authorities in Europe, and increasingly in the United States, have shown clear interest in pursuing.
