ChatGPT's ad collector sets a cross-site cookie that follows users onto advertiser pages
A teardown published 20 September traces OpenAI's ad stack at bzr.openai.com: POST /backend-api/bazaar/obi/sync-token mints an RS256 JWT valid for 60 seconds, /v1/obi/sync sets an __obi cookie scoped to .openai.com with SameSite=none; Secure, and /v1/sdk/events ships conversion data back. Testing on Chrome for Android across 12 commercial sites including Chewy, Wayfair and Coursera, the author found the SDK scraping SHA-256 hashed emails and phone numbers, unhashed geographic data, postal codes and page paths including medical-condition and litigation forms, with scraped identity outnumbering advertiser-supplied identity 685 events to 255. The mechanism does not fire on iOS because of WebKit tracking prevention, and OpenAI Support acknowledged a 14 September inquiry without answering whether __obi is a tracking cookie.
Source
↳ Follow the thread