OpenAI’s Ad Tracking Mechanism Under Scrutiny
OpenAI’s advertising measurement system has come under scrutiny for employing a cross-site cookie that can associate activity on advertiser websites with a user’s ChatGPT account. This cookie, identified as __obi, is implemented when a user accesses ChatGPT, and can be returned to OpenAI when the user visits sites hosting OpenAI’s advertising pixel.
The mechanism has been independently tested on mobile devices and observed across 936 advertiser pixels on 1,029 hostnames. It mirrors the cross-site conversion tracking seen in major ad platforms, yet its link to an AI service introduces fresh privacy challenges.
Understanding the Ad Tracking Process
Upon accessing ChatGPT, a client generates a random identifier and requests a short-lived signed token from OpenAI’s backend. This token includes an account-linked subject value, an obi identifier, and a consent decision marked as analytics_allowed.
Subsequently, ChatGPT transmits the token to bzr.openai.com, an entity thought to be called “Bazaar,” which sets the __obi cookie for the .openai.com domain. The cookie’s configuration allows it to be part of cross-site requests, with a lifespan of up to one year, distinguishing it from other OpenAI cookies.
Impact on User Privacy
Advertisers using ChatGPT ads can add OpenAI’s measurement pixel to their sites. This pixel triggers code from OpenAI’s infrastructure, sending conversion data to bzr.openai.com. If a visitor already has the __obi cookie, it may automatically attach to those requests, enabling OpenAI to collect information about visited pages on third-party sites.
Data observed includes page paths related to medical conditions, financial solutions, and legal services. Additionally, the software retrieves data from advertiser pages, including hashed personal information like email addresses and phone numbers.
OpenAI’s Response and Future Implications
Despite OpenAI listing __obi as an analytics cookie rather than a marketing one, the issuance of sync tokens occurred when analytics consent was obtained, sometimes without marketing consent. This raises questions about data classification and consent handling.
OpenAI has acknowledged a privacy inquiry but has yet to provide detailed clarifications. The ongoing concerns highlight the need for transparency in digital advertising practices, particularly as they intersect with AI technologies.
As the digital landscape evolves, the balance between innovation and privacy will remain a critical focus, with implications for both technology developers and users worldwide.
