How ChatGPT cross-site tracking may work
ChatGPT cross-site tracking became controversial after a technical investigation of OpenAI's ad collector. The report says ChatGPT generates an __obi identifier associated with an account or an anonymous device subject, then stores it as a one-year cookie scoped to openai.com and configured for cross-site delivery. Third-party sites carrying OpenAI advertising or conversion code may send that identifier back when loading the script or reporting events.
Based on the investigator's observations of Chrome on Android, the collector may also receive page paths, conversion data, and identity details extracted from forms, page text, and tag-manager data. Names, email addresses, and phone numbers were hashed with SHA-256 before transmission, while geography such as country, city, and postal code could be sent in clear text. Observed paths covered shopping, courses, and events, but also medical, debt, and litigation-related contexts.
Why this matters for an AI product
The mechanism uses familiar adtech patterns such as cross-site identifiers and conversion pixels, but applying them to a chat product changes the privacy stakes. People may tell an AI things they would not post on social networks. Linking a conversational account with external browsing or purchase intent therefore raises stronger questions about transparency and consent, even though advertisers cannot read the __obi value themselves.
Evidence limits and open questions
The investigation did not observe OpenAI's servers finally resolving each event to a specific ChatGPT account; a 202 response only shows that the collector accepted an event carrying the identifier. The observations were mainly from Chrome on Android. Desktop Chrome was not tested, and iOS browsers are expected to block the mechanism because of WebKit and third-party-cookie limits. Sync tokens also appeared in only some sessions. OpenAI Support said the findings would be reviewed internally, but the published material did not answer why __obi is classified as an analytics cookie or whether users who refuse marketing consent still receive it.