OpenAI’s advertising ambitions appear to be reaching beyond ChatGPT itself. An independent researcher has found that a ChatGPT-related cookie can resurface when the same browser visits websites using OpenAI’s ad pixel, raising fresh questions about measurement, consent and data linkage.
What the researcher found
Researcher Buchodi identified the mechanism around a cookie called __obi. ChatGPT can place the cookie in a browser, where it may persist for up to a year. When that browser later lands on a site running OpenAI’s advertising technology, requests sent back to OpenAI can carry the same identifier along with page and conversion data.
That does not prove OpenAI is linking every off-site action to a named ChatGPT account. Buchodi did not observe the final server-side step that would join advertiser-site activity to a specific user. What the research does show is that the same OpenAI identifier can travel from ChatGPT to participating advertiser sites and back to OpenAI.
Why marketers should pay attention
For advertisers, this is essentially a traditional third-party cookie in a new context. ChatGPT has offered few ad performance metrics, so a persistent identifier could improve conversion measurement and close a reporting gap.
But the privacy trade-off is sharper than on a typical search engine or social platform. ChatGPT users often share richer personal context, which means any system linking chatbot activity to off-platform behavior makes consent, disclosure and vendor diligence immediate concerns.
The analytics label matters
OpenAI lists __obi as an analytics cookie. The researcher reports the cookie could be set when analytics consent was allowed, even if a user had declined marketing cookies. Many users reasonably understand “analytics” as product or site measurement, not cross-site advertising attribution.
OpenAI had not publicly answered questions about the cookie’s classification, or whether analytics-only consent was intended to cover the reported behavior, at the time the research was published.
What marketers should do
Before treating better attribution as a win, teams using or evaluating ChatGPT ads should treat consent design and vendor due diligence as part of the task:
- Audit how ad platforms classify tracker cookies such as __obi.
- Confirm whether analytics consent is separate from marketing consent in any consumer-facing flow.
- Ask what server-side data join exists, and what is disclosed to users.
The practical test is not whether a platform can measure more, but whether customers understand and accept how that measurement works. If the label and the behavior diverge, marketers can inherit both a trust problem and a compliance risk.
The compliance exposure is not hypothetical. ChatGPT must meet the many laws governing personal information handling, and a tracking identifier that follows a browser after a chatbot session adds to that burden. For a platform that has asked for lighter regulation, this kind of finding invites exactly the scrutiny it hoped to avoid.
Source: MarTech
