Researcher: OpenAI ad pixel can link browsing to ChatGPT accounts

A security researcher who publishes as Buchodi reported on September 20 that OpenAI's advertising system can connect what people do on retail and ticketing websites to their ChatGPT accounts. The mechanism, according to the report, is a year-long cookie named __obi that ChatGPT sets in the browser and that OpenAI's ad pixel sends back from advertisers' sites.

OpenAI has not answered the researcher's two specific questions, by the researcher's account, and we found no public statement from the company on the findings. Its own developer documentation confirms that the pixel exists and describes what it collects.

How the link is said to work

A tracking pixel is a small script that an advertiser places on its website so that an ad platform can see whether an ad led to a purchase. Meta and Google have run them for years. OpenAI calls its version the Measurement Pixel, and its documentation says the script loads from bzrcdn.openai.com and reports events to bzr.openai.com.

Buchodi's contribution is the account link. According to the write-up, ChatGPT generates an identifier and asks OpenAI's backend for a signed token that binds that identifier to the user's account and expires in 60 seconds. The browser hands the token to bzr.openai.com, which sets the __obi cookie on the openai.com domain for one year. After that, any site carrying the pixel causes the browser to send the cookie to OpenAI along with page data.

The researcher decoded 932 of these tokens and reports that 736 were marked as belonging to an account user and 196 as anonymous.

What travels with it

Buchodi reports that, on a single test device, one __obi value was sent to OpenAI from 12 commercial websites, and names Chewy, Wayfair, ThriftBooks, Eventbrite, HelloFresh, Coursera and SeatGeek among sites carrying the pixel. The data included the page address without its query string, location down to postal code in plain text, and hashed versions of email addresses, phone numbers and names.

OpenAI's documentation matches that outline. It lists hashed email and phone, country, city, region and postal code among the fields, and describes "automatic advanced matching", in which the script finds customer details on the page and hashes them with SHA-256 in the browser before sending. Hashing scrambles an email address into a fixed code. It hides the address from an eavesdropper, but two companies holding the same email produce the same code, and that is what lets them match records.

Buchodi found automatic matching switched on for 638 of the 881 pixels whose settings could be read, including every credit and lending advertiser observed. Identity details scraped by the script outnumbered those deliberately supplied by advertisers, 685 events to 255.

The promise and the gap

OpenAI began testing ads in ChatGPT on February 9, 2026, and shows them to Free and Go users. Its help page says: "We do not share your conversations with ChatGPT with advertisers, and we never sell your data to advertisers." Advertisers get aggregate performance figures. Users can turn off ad personalisation and clear their ads data.

Nothing in the research contradicts that sentence. Here is what most coverage will miss. The promise covers what flows from OpenAI to advertisers. The pixel is about the opposite direction: what flows from advertisers' websites to OpenAI. The help page we read says nothing about that.

Consent is the sharper issue. OpenAI's documentation says that when consent is set to false "the Pixel doesn't send measurement-event pings", and it describes two first-party cookies, __oppref and __obref. We did not find __obi described on that page. Buchodi says every decoded token recorded analytics consent, and that a user who accepts analytics cookies but refuses marketing cookies still receives __obi. The researcher asked OpenAI why the cookie is classed as analytics and whether refusing marketing consent stops it. The report says the findings went to OpenAI on September 14, and that Support acknowledged the message without answering either question.

What is not proven

The researcher is careful about limits, and you should be too. "The join is not observed," the report says. Buchodi saw an identifier tied to an account and saw it come back from advertiser sites, but the matching of the two would happen on OpenAI's servers, where no outsider can look. The tests covered only Chrome on Android. Desktop Chrome is untested, and the report says the mechanism does not function in iOS browsers because of Safari's tracking protections.

This is one person's reverse engineering, and nothing we read shows anyone else repeating it. The thing to watch is whether OpenAI explains what the __obi cookie is for and why it sits in the analytics category.