ChatGPT now knows what you do on other websites via ad collector
4 hours ago
- OpenAI's ad collector uses a cookie called __obi, scoped to .openai.com, to track users across websites and link activity to their ChatGPT account.
- The cookie is set via a sync process involving a JWT token, and it is sent on cross-site requests because it has SameSite=None and Secure attributes.
- Advertiser sites load OpenAI's SDK, which sends __obi along with page data such as products, articles, and purchases back to OpenAI.
- The SDK scrapes identity data from form fields, page text, and tag-manager buses, transmitting hashed emails/phones and cleartext location data like postal codes.
- OpenAI classifies __obi as an analytics cookie, and it is sent even when users consent only to analytics and refuse marketing.
- The tracking works on Chrome for Android but not on iOS browsers due to ITP; it also functions when users are logged out of ChatGPT with a persistent anonymous identifier.
- OpenAI's response did not answer key questions about the cookie's classification or consent handling.