OpenAI is silently tracking your web browsing to feed its ad platform

ChatGPT links your private chats to your web browsing history using a hidden cross-site tracking cookie. Here is how the ad pixel works.

Business · Source: Hacker News

What happened

OpenAI is building an ad network. They are using a cross-site tracking cookie called __obi to link your ChatGPT account to your browsing history. When you log into ChatGPT, the client generates random bytes and calls a backend sync token. This creates a JSON Web Token that binds your account to an identifier. OpenAI drops this cookie on your device. It stays active for a full year and is configured to allow cross-site requests.

Companies buying ads on ChatGPT install a tracking pixel on their websites. This works just like Meta or Google tracking codes. When you visit these sites, the pixel sends your __obi cookie back to OpenAI. This connects your off-site searches, purchases, and reading habits directly to your ChatGPT identity. The system works even if you are logged out. Anonymous subjects persist on a device for at least twenty-seven days.

The tracking code is aggressive. It scrapes form fields and tag managers for hashed emails, phone numbers, and clear-text postal codes. Postal codes were the most harvested form field across observed sites. It even captures sensitive page paths, including medical conditions, debt solutions, and litigation intake forms. OpenAI classifies this as an analytics cookie. If you opt out of marketing but allow analytics, you still get tracked.

Key facts

Why it matters

This changes the privacy expectation for AI products. Users tell chatbots intimate details they would never put on a social network. These AI products increasingly act on behalf of the user. Now, OpenAI is merging that highly sensitive chat data with standard adtech surveillance. Builders need to understand that OpenAI is no longer just an API provider. They are building a massive consumer data broker business. The structural equivalent is what Meta built years ago, but running it on an AI chat product has no precedent.

The second-order effect is regulatory and trust backlash. OpenAI is bypassing explicit marketing consent by hiding this tracker under analytics. Safari already blocks it through Intelligent Tracking Prevention, but Android Chrome users are fully exposed. When enterprise customers realize their employees browsing habits are linked to their corporate ChatGPT accounts, the fallout will be severe. Advertisers cannot even see this cookie. They installed a simple conversion pixel and have no way to know their visitors are being resolved to a ChatGPT identity.

For builders

Audit your site for OpenAI pixels

Check if your marketing team installed the OpenAI ad pixel. You are leaking user data to OpenAI without your users knowing. The SDK scrapes data from your tag manager bus and form fields. You carry the liability if sensitive customer data gets scraped and sent to OpenAI servers.

Do not trust default consent settings

OpenAI categorizes cross-site tracking as analytics. If you build AI tools, do not copy this dark pattern. Regulators will eventually fine companies that misclassify marketing trackers. Always separate your analytics and marketing consent flows honestly.

Expect enterprise pushback on ChatGPT

Corporate IT departments will start blocking ChatGPT domains to prevent data leakage. If you build enterprise AI wrappers, use this as a selling point. Promise zero cross-site tracking and win their business. Trust is the ultimate moat in enterprise AI.

My take

OpenAI is speedrunning the Meta playbook. You cannot build a product where people confess their deepest secrets and then track their web history to sell ads. This is a massive breach of user trust and a terrible precedent for AI founders. We must build better than this.

Original reporting: Hacker News. This is my rewrite and opinion.

More AI news for builders