Security researcher Buchodi has reported that OpenAI may be able to link a user's activity on external websites to their ChatGPT account through a mechanism involving an advertising tracking pixel.
ChatGPT Identifier Could Link External Web Browsing to User Accounts via Ad Pixel
According to Buchodi's investigation, when a user accesses ChatGPT, a unique identifier is generated and stored in the browser as a cookie named __obi under the .openai.com domain. When that same user visits a third-party website that has integrated OpenAI's "Measurement Pixel"—a tool used by advertisers to track conversions—the __obi cookie is sent to OpenAI's collection servers.
The research found that this mechanism allows OpenAI to associate specific web activities, such as viewing certain pages or interacting with site elements, with the individual's ChatGPT identity. Buchodi's tests on Android's Chrome browser showed the cookie being sent from 12 different commercial websites to OpenAI. While the URLs sent to the collector have their query strings removed, the path information remains intact.
In the observed data, some identity information, such as email addresses and phone numbers, was captured from form fields and page text by the SDK, though these are reportedly SHA-256 hashed before transmission.
OpenAI has previously described the Measurement Pixel as a tool to measure advertisement effectiveness and lists __obi as an analytics cookie. When contacted regarding why the cookie is categorized as an analytics cookie and whether users who opt out of marketing but allow analytics still trigger this tracking, OpenAI Support stated that the inquiry would be reviewed internally but provided no further specific answers.
Sources
- ChatGPTを開いた後に別サイトで見たページの情報がOpenAIへ送られる仕組みが指摘される （GIGAZINE, 2026-09-25）
- Buchodi