Short answer: OpenAI's public cookie policy lists a one-year analytics cookie called __obi. An independent researcher observed that cookie traveling to OpenAI with requests from advertiser websites running OpenAI's pixel. The same research found account identifiers inside the short-lived token used to create the cookie, but did not observe OpenAI's server-side account join directly. The test was conducted on Chrome for Android; desktop Chrome was not tested, while Safari's tracking protections and all iOS browsers block the third-party-cookie path described in the report.
On September 20, 2026, the independent researcher Buchodi published a request-by-request technical analysis of __obi. OpenAI's own cookie policy lists __obi as an analytics cookie with a one-year duration on chatgpt.com and openai.com. Buchodi observed the cookie set with SameSite=None; Secure, the configuration that lets a browser attach it to eligible cross-site requests.
The mechanism sits inside OpenAI's ad-measurement system. When a website loads OpenAI's advertising pixel, the browser sends events to OpenAI. Buchodi observed one __obi value sent from 12 commercial websites under 13 pixel IDs, including Chewy, Wayfair, HelloFresh, Coursera, ThriftBooks, Eventbrite, and SeatGeek. The broader traffic set covered 936 distinct advertiser pixels across 1,029 hostnames. The report also found the pixel's automatic-matching system collecting identity fields from advertiser pages. OpenAI's conversion-measurement documentation says supported customer information is normalized and SHA-256 hashed in the browser, and raw customer information is not sent through automatic advanced matching.
Buchodi reported that every decoded sync token carried analytics_allowed, including the consent configuration in which analytics was accepted and marketing was declined. The researcher sent the mechanism and two questions to OpenAI on September 14. According to the report, OpenAI Support acknowledged the inquiry but did not answer the classification or consent questions. Growth Academy found no later public OpenAI response specific to those questions as of September 21.
__obi behavior. Source: OpenAI, Reimagining advertising with AI. Frame captured September 21, 2026.What this tracking system actually is
OpenAI publicly launched the current advertising expansion on September 16. Its official release says Sponsored Agents are being tested with select U.S. advertisers and that ChatGPT Ads now integrates with HubSpot and Shopify. A separate official announcement says OpenAI had already launched pixel-based conversion measurement so advertisers could understand what happened after an ad interaction.
That is a familiar advertising architecture. The unresolved issue is narrower: OpenAI publicly describes pixel measurement and automatic advanced matching, while its cookie policy classifies __obi as analytics. Buchodi's report says the cookie can still travel when marketing consent is declined if analytics consent remains allowed.
For a business owner, the relevant question is what OpenAI's advertising system receives. Based on the researcher's captures, OpenAI received the cookie alongside advertiser-page events and, when automatic matching was enabled, hashed identity fields detected on the page. The researcher inferred that OpenAI could resolve the identifier to the account because the cookie-creation token contained the account subject. The report explicitly says that server-side join was not observed.
What this changes for a 5 to 25 person firm
The practical exposure is clearest for owners who use the same browser for ChatGPT and vendor research. You might ask ChatGPT to compare software, then visit pricing pages or product sites that run OpenAI's pixel. In the Chrome for Android setup Buchodi tested, the browser sent __obi with those OpenAI requests. The account connection is supported by the signed token used to create the cookie, but the report did not observe OpenAI's later server-side join directly.
For most B2B decisions, this is an uncomfortable privacy issue rather than proof that an advertiser received your ChatGPT conversations. OpenAI says advertisers receive aggregated reporting and do not receive chats, names, email addresses, precise location, or IP addresses from ChatGPT. The concern in this report runs in the other direction: advertiser-page events and an OpenAI identifier traveled back to OpenAI.
Where this becomes more serious is client-sensitive research. If you would rather not let one vendor's advertising stack observe that you visited another company's pricing, intake, or product pages, separating the browsing contexts is a reasonable precaution while the consent and classification questions remain unanswered.
Three operational steps worth taking immediately:
Browser separation: Put ChatGPT and client-sensitive research in separate browser profiles or browsers. Safari's tracking protection and all iOS browsers block the third-party-cookie path described in the report. If you stay in Chrome, blocking third-party cookies is the more direct control.
Cookie audit: Clear site data for openai.com if you want to remove the current identifier. Buchodi's report says a new identifier may be created in a later eligible session, so a one-time clear is not a durable control.
Cookie settings review: Use OpenAI's cookie-settings control to review analytics consent on every device and browser you use. OpenAI says cookie choices are device- and browser-specific. This is separate from model-training controls in Account Settings.
For teams, the simplest response is a browser policy that separates AI sessions from client-sensitive research until OpenAI answers the classification and consent questions. The published test does not establish that every browser, session, plan, or user receives the cookie.
The broader pattern
OpenAI is building an advertising business alongside its subscription and API businesses. Sponsored Agents are the consumer-facing experience: clearly labeled branded conversations that begin after a user clicks an ad. OpenAI also documents conversion pixels and automatic advanced matching as measurement tools. Buchodi's report places __obi inside that broader advertising stack, but OpenAI has not publicly described the cookie's specific role in Sponsored Agents.
This is a structural shift in what ChatGPT is. A parallel advertising business makes measurement and attribution part of the product. That does not prove misuse, but it makes the boundaries around consent, identifiers, automatic matching, and account linkage material to business users.
Business owners should now evaluate ChatGPT as both an AI service and an advertising platform. The current public evidence supports a narrower statement than the original draft: the cookie traveled with advertiser-page requests in Chrome for Android, while desktop Chrome remained untested and the server-side account join was inferred from the design rather than directly observed.
The existing guide on stopping ChatGPT from training on your data covers the conversation-level privacy settings. That step and this one are separate: one addresses what OpenAI does with your conversation content, and the other addresses what OpenAI does with your browsing behavior. Both are worth addressing for a business that handles sensitive client information.
Common questions
What is the ChatGPT __obi cookie?
__obi is a one-year analytics cookie listed in OpenAI's cookie policy. Buchodi observed it created through a signed token flow and then sent with OpenAI requests from advertiser websites in Chrome for Android. The token contained an account subject for signed-in users and an anonymous subject for logged-out sessions. The report did not observe the later server-side account join directly.
Which websites was the __obi cookie observed on?
Buchodi observed one __obi value sent from 12 commercial websites under 13 pixel IDs, including Chewy, Wayfair, HelloFresh, Coursera, ThriftBooks, Eventbrite, and SeatGeek. The larger dataset contained 936 distinct advertiser pixels across 1,029 hostnames, but that does not mean the cookie was observed on every one.
Does the __obi cookie affect ChatGPT Work or Business plan users?
The published research does not establish plan-by-plan behavior. OpenAI's ads documentation says Business plan accounts are not shown ads, but that statement alone does not prove whether __obi is or is not set for every Business user. Treat the plan-specific answer as unknown until OpenAI documents it or independent testing covers it.
Does the __obi cookie work if I am not logged into ChatGPT?
Buchodi decoded 196 anonymous sync tokens alongside 736 account-user tokens and observed anonymous identifiers persisting. The test was performed on Chrome for Android. Safari's Intelligent Tracking Prevention and all iOS browsers block the third-party-cookie path described in the report; desktop Chrome was not tested.
What can business owners do to limit cross-site ChatGPT tracking?
Review OpenAI's analytics-cookie setting, block third-party cookies, separate sensitive business research from ChatGPT sessions, and clear OpenAI site data if you want to reset the current identifier. OpenAI notes that cookie settings are device- and browser-specific.
Is this connected to OpenAI's sponsored agents advertising program?
It is part of OpenAI's broader advertising and measurement stack. OpenAI publicly documents Sponsored Agents, pixel-based conversion measurement, and automatic advanced matching. Buchodi documented how __obi traveled with advertiser-page requests. That does not prove every Sponsored Agent interaction uses the cookie or that every cookie event followed a Sponsored Agent click.
Sources
Official / Primary Sources
- OpenAI Cookie Policy. Lists
__obias a one-year analytics cookie; checked September 21, 2026. - OpenAI Conversion Measurement documentation. Describes the pixel, automatic advanced matching, hashing, and modeled measurement; checked September 21, 2026.
- OpenAI: Reimagining advertising with AI. Official Sponsored Agents release and source of both article images; published September 16, 2026.
- OpenAI: New ways to buy ChatGPT ads. Official announcement of pixel-based conversion measurement; published May 5, 2026.
- OpenAI: Ads in ChatGPT. Official user-facing privacy and advertiser-reporting explanation; checked September 21, 2026.
- Buchodi: ChatGPT now knows what you do on other websites via ad collector. Primary technical investigation; published September 20, 2026.
Independent Coverage / Analysis
- Notebookcheck: ChatGPT's
__obicookie follows you to other websites. Published September 21, 2026. - Pasquale Pillitteri: OpenAI's
__obiCookie Tracks ChatGPT Users Across Sites. Published September 21, 2026.
Related: how to stop ChatGPT training on your conversation data, and what OpenAI's Project Lily means for your prompts.