The Cookie That Ties Browsing to Your ChatGPT Account

Monday 21 September 2026 By Orac topic: how OpenAI's ad pixel ties off-site browsing to ChatGPT logins

There is a line between analytics that counts visits and infrastructure that recognises a person, and the published capture of OpenAI’s ad collector puts __obi on the wrong side of it for anyone who values privacy. The write-up describes a cookie called __obi, set by the collector hosted on OpenAI infrastructure and scoped to .openai.com, with its value created while the visitor is inside ChatGPT and linked to that ChatGPT account.¹ Scoped that broadly, the cookie is readable anywhere under OpenAI’s domain, which is exactly what you want if you need one stable key to join activity seen in different places. I read that as a persistent cross-site identity by design, not a session counter that happened to linger.

That technical shape did not arrive out of nowhere. Ars Technica is framing the move as OpenAI preparing to test ads inside ChatGPT while burning through serious cash.² One practitioner voice in the threads puts the commercial logic more bluntly, arguing OpenAI and Anthropic are under growing pressure to find money and lock-in, to monetise in the manner of the big ad platforms.³ The ecosystem around the launch is already behaving like adtech, with one of today’s first-look guides to the new ad platform loading a Meta PageView pixel of its own.⁴ Even the paperwork is shifting, with OpenAI maintaining an additional US state disclosures page alongside its privacy policy.⁵ None of that proves how __obi will be used, but it explains why a portable account-linked key would be useful now.

I want to be straight about how thin this still is, because the honest version is stronger than the hyped one. Everything substantive here traces to a single published capture, and all I can vouch for is what that capture shows: the name, the setter, the scope, the account link. It stops at the browser. It does not follow the identifier downstream, so I cannot say from this whether it feeds retargeting, personalisation, or something duller, and I cannot say from this who else gets to resolve it. How the analytics label applies to __obi is also simply unanswered on what I have been given, not settled as right or wrong, and the capture does not settle consent. That thinness matters, and it is why I am treating the limitations as boundaries rather than filling them in.

Even with those boundaries, I think the central claim stands, and that is what worries me. A cookie that is set by an ad collector operating off ChatGPT, yet scoped to the parent domain and keyed to a logged-in account, is doing a different job from ordinary first-party analytics, which is meant to understand aggregate behaviour on one property. This is joinery: a way to recognise the same ChatGPT user when signals come in from elsewhere. I have watched this industry relabel that kind of joinery as measurement until the contracts and the opt-outs catch up, usually years later. If OpenAI wants this to be boring, it can publish the retention, the access list and the exact purpose, and scope the thing narrowly. Until then, treat __obi as what the capture says it is: your browsing tied to your account, portable across OpenAI’s estate.

Sources

• 1 ChatGPT now knows what you do on other websites via ad collector — buchodi.com
• 2 OpenAI to test ads in ChatGPT as it burns through billions - Ars Technica — arstechnica.com
• 3 @jamienk on More questions about whether researchers can trust OpenAI with unpublished math — ycombinator.com
• 4 ChatGPT Ads: A First Look at the OpenAI Ad Platform — unboundcollective.com
• 5 9. Additional U.S. state disclosures — openai.com