OpenAI's advertising infrastructure uses a cookie named __obi to connect user activity on external websites to ChatGPT accounts, according to technical analysis of the system's operation.

The mechanism operates through a series of coordinated steps involving JavaScript tags installed by advertisers on their websites. When a user visits a participating site, a small piece of OpenAI code loads and transmits the __obi identifier back to OpenAI's servers. This identifier, previously assigned to the user's ChatGPT account, enables the company to associate browsing behavior with specific individuals.

The process begins when ChatGPT generates a temporary identifier tied to a user's session. This identifier is encoded in a JSON Web Token (JWT) and stored in a cookie on OpenAI's domain, configured to persist for one year and function across different websites. The cookie is explicitly designed to be sent during cross-site requests, a configuration requiring specific security settings that distinguish it from standard tracking cookies.

Advertisers implement this system by embedding OpenAI-provided scripts on their pages. These scripts collect various data points, including information users intentionally provide through form fields and data scraped from page content. In observed traffic, scraped data appeared significantly more frequently than voluntarily submitted information, with email addresses being the most commonly extracted field.

The transmitted data includes hashed email addresses, phone numbers, and other personal details, while location information such as postal codes is sent in plain text. URL paths are stripped of query parameters before transmission, preserving only basic navigation context. This collected information is then processed by OpenAI's systems to map user identities across different websites.

Technical testing confirmed the mechanism's operation across multiple commercial websites, including retailers and service providers. In one analysis of device activity, the identifier was observed being transmitted from 12 different sites under 13 distinct advertising tags. The system functioned even when users were not actively engaged with ChatGPT, as the cookie persisted independently of direct platform usage.

The technical implementation relies on specific browser behaviors regarding cookie transmission. While most OpenAI cookies are blocked during cross-site requests due to security policies, __obi is explicitly configured to bypass these restrictions through its SameSite=None setting and year-long expiration period. This allows it to function where other tracking mechanisms would be prevented.

The system's design enables automatic matching of user identities across advertiser domains, with approximately 72% of observed advertising pixels configured to perform this matching. OpenAI's advertising management interface controls this functionality, which includes exclusion lists for sensitive data categories such as financial information and medical history.

OpenAI classifies __obi as an analytics cookie in its public documentation, describing it as serving performance understanding purposes. However, the mechanism's scope extends beyond traditional analytics by directly linking user identities across the broader web ecosystem. This distinction has prompted inquiries from privacy researchers regarding the alignment between stated consent categories and actual data collection practices.

The technical implementation reflects established patterns in digital advertising technology, adapted for use within an artificial intelligence platform. While similar tracking architectures have existed in other contexts for years, their application to an AI chat interface raises distinct considerations given the nature of user interactions and the depth of personal information typically shared with such systems.

Browser compatibility presents limitations to the system's reach. Testing indicated the mechanism operates only in specific browser environments, with functionality disabled in Safari-based browsers due to tracking prevention measures. Mobile implementations showed inconsistent behavior, with some sessions failing to generate the necessary synchronization tokens.

The development highlights broader trends in digital data collection, where platform operators increasingly integrate advertising infrastructure with core service functions. This convergence blurs traditional boundaries between user engagement metrics and personal identity tracking, particularly in contexts where users may not anticipate cross-site data linkage.