ChatGPT's __obi cookie evades ad opt-out

A security researcher's write-up on Buchodi's Threat Intel blog, published September 20, traced a cookie called __obi that OpenAI sets on .openai.com and that follows users onto unrelated commercial sites. The cookie uses SameSite=None; Secure and a one-year expiry (Max-Age=31536000), which is exactly the configuration you need if you want a cookie to travel to third-party domains and persist long after the session that created it. The post became the top AI story on Hacker News today, pulling 707 points and 372 comments, and was independently covered within hours by 36Kr, daily.dev and ai-tldr.dev.

The reason this traveled so fast isn't that OpenAI runs ad tech — most large consumer platforms do. It's the classification. OpenAI files __obi under "Data Analysis" in its own privacy settings rather than "Advertising & Marketing." That means a user who accepts analytics cookies but explicitly declines marketing/ad consent still receives the tracking cookie, because their opt-out toggle was never wired to the category it actually belongs in. For engineers who build on top of ChatGPT, embed similar SDKs, or run their own consent banners, this is a concrete example of how a label in a privacy dashboard can diverge from what the code underneath actually does — and why "the vendor says it's analytics" is not a fact you can trust without checking.

The mechanism described in the research is straightforward once you see it laid out. OpenAI's ad-tech stack is internally named "Bazaar," served from bzr.openai.com, with an issuing component called "wadi." When a user interacts with ChatGPT, the client generates a signed, 60-second JWT. That short-lived token gets exchanged for the __obi cookie, which then becomes the persistent identifier stored in the browser — no longer a token that expires in a minute, but a year-long cookie scoped with SameSite=None so it rides along on requests to other domains.

The researcher observed the associated tracking pixel firing on at least 12 named commercial sites, including Chewy, Wayfair, HelloFresh, Coursera and SeatGeek. Crucially, this doesn't require an active ChatGPT session: anonymous, logged-out identifiers remained stable for at least 27 days, meaning the cookie keeps correlating a browser's activity across sites well after someone has logged out or closed ChatGPT entirely.

The scale here isn't small. Of 932 decoded sync tokens the researcher captured, 736 were tied to logged-in ChatGPT accounts and 196 to anonymous users — meaning identity resolution works whether or not you're signed in. And the pixel doesn't just pass an ID: it scraped emails, phone numbers, and location data directly out of advertiser page data layers, the same structured data blocks that sites use internally to feed analytics and ad tools. That's the difference between "we know an anonymous ID visited a shopping cart" and "we have your email and location tied to that ID."

The disclosure that went unanswered

This isn't a case of a researcher publishing without giving OpenAI a chance to respond. The findings were disclosed to OpenAI on September 14, 2026, with two specific questions: why is __obi classified as analytics rather than marketing, and should declining marketing consent block it. OpenAI Support acknowledged the report on September 20 — the same day the public write-up went live — but did not answer either question.

Separately, OpenAI's own SDK narrowed the scope of data it collects in version 0.1.31, released August 27, 2026, several weeks before the disclosure went public. It's not confirmed whether that change was a direct response to the researcher's private report or an unrelated adjustment, but the timing means anyone auditing this pattern should check which SDK version their integration pulls, since older versions had a broader collection footprint.

The unanswered disclosure is itself the operationally useful part of this story. If you rely on a vendor's own dashboard label to decide whether a cookie is in scope for your consent banner, you're trusting a classification the vendor hasn't been willing to defend even when directly asked. That's a weak foundation for a GDPR or CCPA compliance argument, and it's the exact gap regulators look for.

What this means if you embed any third-party SDK

The mistake to avoid isn't "don't use OpenAI's ad tools" — it's "don't take a vendor's cookie category at face value." If your product embeds ChatGPT, an OpenAI ad pixel, or any third-party AI SDK that sets its own cookies, you need to independently verify three things: what cookie names get set, what scope and duration they use (SameSite=None plus a long Max-Age is the signature of a cross-site tracker, regardless of what category it's filed under), and whether your consent banner's toggle actually gates the request that sets it. A cookie labeled "analytics" that a network request confirms is scoped for cross-site ad delivery should be treated as marketing in your own privacy policy, whatever the vendor calls it internally.

Practically, that means opening browser devtools on your own integration, checking the Set-Cookie headers your third-party scripts trigger, and mapping each one against your actual consent categories rather than the vendor's stated ones. If a script fires regardless of a user's marketing opt-out choice, your consent banner is making a promise your code doesn't keep — and that's the specific liability regulators are testing right now, not the abstract question of whether OpenAI runs ads. Audit before you ship, not after a researcher's blog post forces the question for you.