News · 2026-09-21

Investigation finds a ChatGPT-linked identifier in OpenAI advertiser-pixel traffic

ChatGPT has been observed issuing an OpenAI identifier that is later sent in advertiser-pixel traffic across unrelated websites. That matters because the technical path can carry page and conversion context to OpenAI before anyone has publicly demonstrated a final join to a named account or use in ad ranking.

Key facts

• Buchodi reported the investigation on 20 September 2026 after observing 936 advertiser pixels across 1,029 hostnames.
• ChatGPT obtained an obi token, synced it to OpenAI, and received a one-year __obi cookie on .openai.com.
• Advertiser pages loading OpenAI’s oaiq.min.js measurement SDK sent that cookie to OpenAI.
• The primary source is Buchodi’s technical investigation; OpenAI’s own Measurement Pixel documentation confirms the broader measurement product.

The mechanism is unusually concrete. Buchodi observed ChatGPT request a sync token, send it to bzr.openai.com, and then receive __obi with a one-year lifetime, HttpOnly, Secure, and SameSite=None attributes. When an advertiser page loaded OpenAI’s measurement script from bzrcdn.openai.com, the browser sent the cookie as part of that third-party request; later event requests did too. The investigator reports page paths, conversion data and advertiser-page identity signals in the surrounding traffic.

Think of the cookie as a membership-card number printed by the card issuer. The retailer cannot read the issuer’s card directly because it belongs to the issuer’s domain, but the issuer sees the number when its reader is embedded in the retailer’s page. That distinction explains both why the finding is material and why it does not by itself prove the final use of the data.

OpenAI publicly documents a separate but related advertising stack. Its supported-events page lists page views, leads, registrations, subscriptions, purchases and custom conversion events. The company writes that the pixel can support “automatic advanced matching,” which can detect supported information on an advertiser page. Its Conversions API supports server-side event reporting. Those documents establish that OpenAI has a broad measurement and optimization system; they do not publicly explain __obi.

The most important caveat is the account relationship. Buchodi decoded JWTs carrying subject_type: account_user in logged-in cases, but explicitly says the final server-side mapping was not observed. A 202 response shows event acceptance, not account resolution, ad targeting, retention, or memory use. OpenAI’s privacy policy permits receipt of advertiser and data-partner information for measurement, service improvement and more relevant ads, while its ads FAQ says advertisers do not receive chats or memories. Neither proves that the traffic in this investigation is used for in-chat personalization.

Consent is another unresolved point. The cookie policy classifies __obi as Analytics, and pixel documentation says consent initializes to true unless an advertiser changes it or a stored denial exists. Buchodi reports seeing analytics-allowed tokens even where marketing consent was refused. That is an observation worth explaining, not proof that the behavior violates a published rule.

The strongest counterargument is therefore not that the path is imaginary; it is that browsers may block it, advertiser deployment varies, and the last internal join has not been shown. The security and privacy consequence is nevertheless immediate: a cross-site measurement identifier is sensitive infrastructure when it can be exposed alongside paths that reveal medical, financial or legal interests. OpenAI should state what __obi is for, which consent state activates it, how long event records live, and whether those records can affect personalization. The finding extends the earlier Sponsored Agents story from conversational advertising into identity and measurement plumbing.

Primary source, verified: read the paper →

Ground Truth. (2026, September 21). Investigation finds a ChatGPT-linked identifier in OpenAI advertiser-pixel traffic. Ground Truth. https://groundtruth.day/news/chatgpt-ad-pixel-obi-cross-site-identifier.html

@misc{groundtruth:chatgpt-ad-pixel-obi-cross-site-identifier,
  title  = {Investigation finds a ChatGPT-linked identifier in OpenAI advertiser-pixel traffic},
  author = {{Ground Truth}},
  year   = {2026},
  month  = {sep},
  url    = {https://groundtruth.day/news/chatgpt-ad-pixel-obi-cross-site-identifier.html}
}

Topics: openai · ads · privacy · cybersecurity · tracking · ai-security