What Is OpenAI's __obi Cookie? ChatGPT Ad Tracking (2026)
The short version
On September 20, 2026, independent security researcher Buchodi published a teardown showing that OpenAI’s advertising pixel resolves what you do on ordinary websites back to your ChatGPT account. The mechanism is a single cookie, __obi, set on .openai.com with SameSite=None, which the browser attaches to requests advertiser pages make to OpenAI’s hosts. The researcher reproduced it end to end on their own phone, verified it with two capture methods, and cross-checked against months of observed traffic covering 936 advertiser pixels across 1,029 hostnames. Disclosed to OpenAI on September 14; OpenAI Support acknowledged the inquiry and did not answer the two questions asked.
Verified September 21, 2026 against the original teardown, OpenAI’s ads measurement-pixel documentation and OpenAI’s cookie policy.
How __obi works, step by step
1. ChatGPT mints an identifier and signs it. On chatgpt.com the client generates 16 random bytes and calls POST /backend-api/bazaar/obi/sync-token (/backend-anon/ when signed out). The backend returns an RS256 JWT with iss: chatgpt-wadi, aud: bzr.openai.com, purpose: obi_sync, the account subject (sub), subject_type: account_user or anonymous, the 22-character obi value, and a 60-second expiry. “Bazaar” (bzr) is OpenAI’s internal name for the ads platform; “wadi” is the issuing service.
2. The identifier becomes a first-party OpenAI cookie. The client POSTs the JWT cross-site to bzr.openai.com/v1/obi/sync. The response sets:
Set-Cookie: __obi=…; Domain=.openai.com; HttpOnly; Max-Age=31536000; Path=/; SameSite=none; SecureSameSite=None; Secure is precisely the configuration a cookie needs to be sent on cross-site requests. Max-Age is one year.
3. Advertiser sites send it back. Any company that buys ads in ChatGPT installs OpenAI’s measurement pixel — the same pattern as the Meta and Google pixels. Three request classes go from the advertiser’s page to OpenAI, and on a device with __obi in the jar all three carried it: the SDK script load itself (GET bzrcdn.openai.com/sdk/oaiq.min.js), conversion events (POST bzr.openai.com/v1/sdk/events), and the SDK’s “no credentials” event path. That first row matters: the browser attaches cookies to the <script src> request before any OpenAI code runs, so merely loading the tag discloses the identifier. Every request was accepted with HTTP 202.
What travels with the cookie
The SDK collects identity from the advertiser’s page and labels four sources: in (advertiser-supplied), and fm, ht, js (scraped from form fields, rendered page text and the tag-manager bus). It replaces window.dataLayer.push with its own function, reads adobeDataLayer, and finds renamed GTM layers by parsing the l= parameter off the gtm.js script tag. Current versions take email and phone from the bus; version 0.1.31 also took names and geography until the scope was narrowed on August 27, 2026.
- Hashed before sending: email, phone, first and last name (SHA-256).
- Sent in the clear: country, region, city, postal code. Postal code was the most-harvested form field (100 events across 28 sites).
- URLs: reduced to origin + path; none of 23,929 observed URLs carried a query string. Paths still leak intent — the sample included a medical condition, a debt-solutions funnel and a litigation intake form.
- Automatic matching was enabled on 638 of 881 pixels with a known setting, including every credit and lending advertiser observed. A denylist excludes passwords, one-time codes, card numbers, SSN, date of birth, medical history, diagnosis and court fields.
On the researcher’s own device, one __obi value was sent to OpenAI from 12 commercial websites under 13 pixel IDs, including Chewy, Wayfair, ThriftBooks, Eventbrite, HelloFresh, Coursera and SeatGeek. In the broader traffic, 12 of 30 distinct __obi values appeared under more than one advertiser; one appeared under ten.
Why “analytics cookie” is the contested part
OpenAI runs analytics and marketing as two separate consent choices (oai_consent_analytics, oai_consent_marketing). Its cookie policy lists __obi under Analytics — the only entry in that section — described as helping OpenAI understand how its services perform. Every sync token the researcher decoded carried consent_decision: analytics_allowed. The practical consequence: someone who allows analytics and refuses marketing still gets a cross-site ad identifier. That classification, plus the fact that the cookie works logged-out (196 of 932 decoded tokens were anonymous, and the anonymous subject persisted at least 27 days per device), is what turned a routine adtech design into the day’s top Hacker News story.
The researcher is careful about one limit: the server-side join was not observed. HTTP 202 shows the collector accepted the event with the cookie attached; that OpenAI resolves it to the account follows from the design (the JWT binds sub to obi) rather than from a captured lookup.
Who is and isn’t exposed
| Platform | Exposed? | Why |
|---|---|---|
| Chrome on Android | Yes (observed) | Third-party cookies allowed by default |
| Desktop Chrome | Untested | Same cookie defaults as Android; assume yes unless third-party cookies are blocked |
| Safari (macOS/iOS), any iOS browser | No | WebKit ITP blocks all third-party cookies |
| Firefox (strict ETP), Brave | No | Third-party cookies partitioned or blocked |
| ChatGPT mobile web client | No sync | Serves ads without minting __obi |
Advertisers cannot see, read or switch off __obi; it belongs to a domain their scripts cannot access. They installed a conversion pixel and have no way to know their visitors are being resolved to a ChatGPT identity. The pixel’s other cookie, __obref, is set on the advertiser’s own domain and does not cross sites (2,828 of 2,860 observed values appeared under exactly one advertiser).
How to block it
- Block third-party cookies in your browser settings — this alone defeats the mechanism.
- Filter the hosts
bzr.openai.comandbzrcdn.openai.comwith uBlock Origin or a DNS blocker. - Refuse analytics consent in ChatGPT’s cookie banner (not just marketing), then clear cookies for
.openai.com. - Sign out doesn’t help — the anonymous identifier is device-stable. Use a browser profile with cookie blocking for ChatGPT if you care.
For advertisers: the OpenAI Ads Manager “automatic matching” toggle controls how much identity the SDK scrapes from your pages; it does not stop the __obi cross-site send, which happens on script load.
Why it matters more than Meta’s pixel
Structurally this is the Meta Pixel model — logged-in account, third-party cookie on pixel fires, off-site conversions resolved to a profile. What is new is running it on an AI chat product. People tell ChatGPT things they would not post on a social network, ChatGPT ads launched with sponsored agents that act on users’ behalf, and OpenAI has spent 2026 defending its data handling — see Project Lily and who reads your chats. Anthropic’s stated ad-free position is covered in Anthropic ad-free vs OpenAI ads.
As of September 21, 2026 OpenAI has not publicly responded beyond the Support acknowledgment. The researcher has said the post will be updated if it does.