Optimize for
An independent investigation found that OpenAI's ad technology may connect activity on advertiser websites with a ChatGPT-linked identifier. Here's what the evidence shows, what OpenAI confirms, and what users should know.
ChatGPT is no longer just an AI chatbot.
OpenAI is building a growing advertising business around it. That raises an important privacy question:
Can activity on other websites be connected to your ChatGPT identity?
A September 20, 2026 investigation Threat Intel reports that OpenAI's advertising infrastructure uses a cookie called _obi that can be sent from participating advertiser websites to OpenAI.
The investigation claims the identifier can connect off-site browsing activity with a ChatGPT account or an anonymous device identifier.
OpenAI's own current cookie policy also lists _obi as an analytics cookie with a one-year duration on chatgpt.com and openai.com.
But there is an important distinction: the independent investigation observed the technical mechanism; OpenAI's public documentation does not independently confirm every conclusion in that investigation.
The reported system centers on an OpenAI advertising domain, bzr.openai.com, and a cookie named _obi.
According to the investigation, ChatGPT can create an identifier and synchronize it with OpenAI's advertising infrastructure. That identifier can then be included when certain OpenAI advertising code loads on participating websites.
The researcher observed:
936 distinct advertiser pixels
1,029 hostnames
23,929 observed URLs
One identifier appearing across 12 commercial websites
932 decoded sync tokens
736 tokens associated with account users
196 associated with anonymous subjects
These are findings from the independent investigation, not figures published by OpenAI as an official measurement.
The reported process has three main stages.
The investigation found that ChatGPT can request a signed token containing an obi identifier.
For logged-in users, the observed token included an account-related subject. For anonymous sessions, the system used an anonymous subject.
The investigation observed OpenAI setting an _obi cookie on the .openai.com domain.
The reported cookie configuration included:
One-year lifetime
Secure
HttpOnly
SameSite=None
That last setting matters because it allows the browser to send the cookie in certain cross-site requests.
OpenAI's current cookie policy independently lists _obi as an analytics cookie with a one-year duration.
According to the investigation, participating advertiser websites can load OpenAI's advertising SDK.
When that happens, the browser may send the _obi cookie back to OpenAI.
The researcher also reported that the SDK collected information from advertiser pages, including information passed through tag-management systems and some rendered page content.
This is the part that creates the biggest privacy question.
The investigation found evidence that the advertising SDK could process several types of information.
Reported examples include:
Page URLs and paths
Product or service pages being viewed
Email addresses
Phone numbers
Names
Country and region
City
Postal code
Information passed through tag-management systems
The report says email addresses, phone numbers, and names were hashed before transmission, while some geographic information was observed in readable form.
It also found that certain sensitive fields were placed on a denylist, including passwords, payment-card numbers, Social Security numbers, medical history, diagnoses, and court fields.
That does not mean every advertiser sends all of these fields. The investigation describes what its testing observed across the advertising ecosystem.
This requires careful wording.
The investigation argues that the _obi identifier creates a technical path through which OpenAI could connect activity on participating websites with a ChatGPT account or anonymous identifier.
The researcher says this conclusion follows from the identifier design but also explicitly notes a limitation: the actual server-side account join was not directly observed.
So the most accurate statement is:
An independent investigation found evidence of a cross-site identifier mechanism that may allow OpenAI to associate advertiser-site activity with ChatGPT-linked identifiers. The final server-side account matching was not directly observed by the researcher.
That distinction matters.
OpenAI's own documentation confirms that ChatGPT has an advertising system and that personalization can use signals from a user's broader ChatGPT experience when personalized ads are enabled.
OpenAI also says advertisers do not receive users' chats, chat history, memories, names, email addresses, precise location, IP addresses, or sensitive information. Advertisers receive aggregated reporting such as ad views and clicks.
OpenAI's advertising principles also state that conversations are kept private from advertisers and that user data is not sold to advertisers.
This creates an important distinction:
OpenAI may process advertising and analytics data without giving advertisers access to your ChatGPT conversations.
The independent investigation is about the data flow to OpenAI, not evidence that advertisers can read your ChatGPT conversations.
OpenAI's current cookie policy provides one important piece of independent confirmation.
It lists:
Cookie: _obi
Duration: 1 year
Purpose: Analytics
Domain: chatgpt.com and openai.com
That confirms the cookie exists and is classified by OpenAI as an analytics cookie.
No.
The investigation itself reported limitations.
It was primarily tested on Chrome for Android. The researcher found that roughly one in five ChatGPT sessions produced a sync token in the observed testing. The researcher also reported that ChatGPT's mobile web client could serve ads without syncing the identifier.
The researcher also noted that Safari's Intelligent Tracking Prevention changes how third-party cookies behave and that desktop Chrome was not tested.
So the findings should not be interpreted as proof that every ChatGPT user is tracked in the same way.
Traditional advertising already uses cross-site measurement.
Google, Meta, and other advertising platforms have used pixels, cookies, conversion tracking, and identifiers for years.
The difference here is the context.
AI assistants can contain highly personal conversations. People may discuss financial problems, health questions, relationships, work, purchases, or other sensitive topics.
That makes the connection between an AI account and external browsing behavior especially important to understand.
OpenAI's current privacy policy says it uses cookies and similar technologies to operate its services and improve user experience. It also describes information received from other sources and marketing vendors.
Users who care about privacy should understand their available cookie and advertising settings rather than assume that all tracking works the same way across browsers and plans.
OpenAI's advertising documentation says users can control personalized advertising, and its privacy documentation explains how cookies and related technologies are used.
For the latest information, review OpenAI's Cookie Policy and OpenAI's advertising information.
There is another side to this story.
AI platforms are becoming part of the advertising and discovery ecosystem. Brands now need to understand not only where they rank in Google, but also how AI systems describe and recommend them.
That is the broader AI visibility problem.
The new ChatGPT ad-tracking story deserves attention, but the evidence needs to be separated carefully.
An independent investigation found a cross-site _obi identifier associated with OpenAI's advertising infrastructure and observed it being sent from participating advertiser websites. It also reported cases involving account-linked and anonymous identifiers.
OpenAI independently confirms that _obi exists as a one-year analytics cookie and confirms that ChatGPT has an advertising system.
However, the investigation did not directly observe the final server-side join between off-site activity and a ChatGPT account.
That is the key fact to keep in mind.
The technology is real. The broader privacy implications are still being clarified.
Does ChatGPT track what I do on other websites?
An independent investigation found evidence of an OpenAI identifier being sent from participating advertiser websites. The researcher did not directly observe the final server-side account join.
What is the _obi cookie?
OpenAI currently lists _obi as an analytics cookie with a one-year duration on chatgpt.com and openai.com.
Can advertisers see my ChatGPT conversations?
OpenAI says advertisers do not receive ChatGPT conversations, chat history, memories, or personal details.
Is ChatGPT ad tracking the same as Meta or Google tracking?
The investigation describes a mechanism that resembles established advertising technology. The major difference is that the identifier originates from an AI assistant rather than a traditional social or search platform.
Where can I learn about OpenAI's privacy practices?
Check OpenAI's current cookie policy, privacy policy, and ChatGPT advertising documentation because these policies and features can change.
Continue reading our latest insights
Learn how AI search engine optimization works. Improve your brand visibility, citations, and recommendations across ChatGPT, Google AI Mode, and other AI search platforms.
Learn how Agentic Engine Optimization helps websites become easier for AI agents to read, understand, and use.