conv.

All stories
TechFading · day 2

OpenAI's ChatGPT ad system tracks users across advertiser websites via cookies

Independent researcher reveals cross-site tracking mechanism that links third-party ad activity to ChatGPT accounts.

newest coverage 15h agosummary written 11h ago2 pieces MastodonNewswires

What to know

  • OpenAI's advertising system uses a cross-site tracking cookie (__obi) to link third-party website activity to ChatGPT user accounts, a mechanism similar to established ad-tech systems but raising privacy concerns given the sensitivity of AI conversations.
  • The tracking system collects extensive data from advertiser sites—form fields, page content, tag-manager data—with sensitive information like emails hashed but location data sent in plaintext; paths to sensitive pages (medical, debt, litigation) remain visible.
  • OpenAI classified __obi as an analytics cookie in its policy; the researcher found the technical design structured to enable server-side linking of advertiser events to individual accounts but did not observe this linkage directly.
  • The tracking affects major sites including Chewy, Wayfair, Coursera, and Eventbrite; Safari's tracking protections block the mechanism, but Chrome and other browsers that permit third-party cookies remain affected.

Buchodi Independent cybersecurity researcherOpenAI AI company operating ChatGPT and advertising platform

OpenAI's ChatGPT ad system tracks users across advertiser websites via cookies
cyberinsider.com

How it unfolded 1 development · click the chart to see its coverage articlesposts

Peak 1 piece in one hour at Sep 21, 6 PM; 2 pieces over 2 days (1 article · 1 post) Sep 21, 6 PM — 1 piece · 1 post — Mastodon 1Sep 21, 7 PM — quietSep 21, 8 PM — quietSep 21, 9 PM — quietSep 21, 10 PM — quietSep 21, 11 PM — quietSep 22, 12 AM — quietSep 22, 1 AM — quietSep 22, 2 AM — quietSep 22, 3 AM — quietSep 22, 4 AM — quietSep 22, 5 AM — quietSep 22, 6 AM — quietSep 22, 7 AM — quietSep 22, 8 AM — quietSep 22, 9 AM — quietSep 22, 10 AM — quietSep 22, 11 AM — quietSep 22, 12 PM — quietSep 22, 1 PM — quietSep 22, 2 PM — quietSep 22, 3 PM — quietSep 22, 4 PM — quietSep 22, 5 PM — quietSep 22, 6 PM — quietSep 22, 7 PM — quietSep 22, 8 PM — quietSep 22, 9 PM — quietSep 22, 10 PM — quietSep 22, 11 PM — quietYesterday, 12 AM — quietYesterday, 1 AM — quietYesterday, 2 AM — quietYesterday, 3 AM — quietYesterday, 4 AM — quietYesterday, 5 AM — quietYesterday, 6 AM — quietYesterday, 7 AM — quietYesterday, 8 AM — 1 piece · 1 article — Newswires 1Yesterday, 9 AM — quietYesterday, 10 AM — quietYesterday, 11 AM — quietYesterday, 12 PM — quietYesterday, 1 PM — quietYesterday, 2 PM — quietYesterday, 3 PM — quietYesterday, 4 PM — quietYesterday, 5 PM — quietYesterday, 6 PM — quietYesterday, 7 PM — quietYesterday, 8 PM — quietYesterday, 9 PM — quietYesterday, 10 PM — quietYesterday, 11 PM — quiet 1
Sep 22yesterdaynow · 12:08 AM ET
  1. 1

    CyberInsider publishes detailed analysis of OpenAI's tracking mechanism

    CyberInsider reports the full technical details of how OpenAI's advertising SDK collects user data from advertiser websites, including form fields, page content, and tag-manager data layers, with sensitive fields like emails hashed and location data sent in plaintext.

    “OpenAI's advertising infrastructure can link activity on third-party advertiser websites to a user's ChatGPT account through a cross-site cookie called __obi.”
    — CyberInsider
    1. 1 outlet ChatGPT advertising system reportedly tracks users across websites

      first by CyberInsider, 15h ago

    • packet_storm@infosec.exchange

      ChatGPT Ad Collector Tracks User Activity across Third-Party Advertiser Websites https:// packetstorm.news/news/view/437 26 # news

      packet_storm@infosec.exchangeMastodon2d agoview on Mastodon ↗
  2. background

    OpenAI Support receives questions about cookie classification — OpenAI Support acknowledged questions about the __obi cookie's classification as an analytics cookie and the interaction between analytics and marketing consent, but did not provide substantive answers according to the researcher's report.

  3. background

    Researcher identifies ChatGPT cross-site tracking cookie — Independent researcher 'Buchodi' reproduced the behavior of OpenAI's advertising infrastructure tracking users across websites through a cross-site cookie called __obi, using two independent traffic-capture methods and analyzing 936 advertiser pixels across 1,029 hostnames.