OpenAI's advertising platform, known internally as "bazaar," utilizes a cookie named __obi to connect user activity on external websites to specific ChatGPT accounts.
According to technical analysis, the process begins when ChatGPT generates a unique identifier for a user. This identifier is stored as a cookie on the .openai.com domain. When a user visits a website that has implemented OpenAI's advertising code, the browser sends this __obi cookie to OpenAI alongside data about the page being browsed.
The advertising SDK collects various types of data from these advertiser sites. In addition to data explicitly provided by advertisers, the SDK scrapes information from form fields, rendered page text, and tag managers. Observed data includes search terms, article content, and purchase behaviors. In observed traffic, paths reaching the collector included information related to medical conditions and debt solutions.
The mechanism relies on the __obi cookie being configured with SameSite=None, allowing it to be sent during cross-site requests. This differs from other OpenAI cookies on the same advertiser pages, which are blocked by browsers.
OpenAI's cookie policy classifies __obi as an analytics cookie intended to help the company understand how its services are used. While the system uses a denylist to exclude sensitive information such as passwords, credit card numbers, and medical history, the observed data included paths related to medical conditions and litigation intake forms.
Sources
- ChatGPT now knows what you do on other websites via ad collector （Hacker News Frontpage, 2026-09-20）