"Security researcher Jamie Larson (Buchodi) published a full teardown on the self-hosted Threat Intel newsletter describing how OpenAI uses an ad collector at bzr.openai.com to attach a cross-site behavioral profile to ChatGPT users. The mechanism is not subtle; the key variable is a single cookie named __obi.\n\n## Three steps to bind an account to browsing history\n\nThe reproduction runs on Chrome for Android. The author verified it with two independent capture methods and cross-checked against several months of traffic covering 936 distinct advertiser pixels across 1,029 hostnames.\n\n- Step 1 (issue a JWT): while on chatgpt.com, the client generates 16 random bytes and POSTs to /backend-api/bazaar/obi/sync-token. The backend returns an RS256 token containing both sub (the account's 64-hex subject) and obi (a 22-character identifier). The binding is written into the payload and expires after 60 seconds. bzr is OpenAI's internal name for the ads platform "bazaar".\n- Step 2 (set a cross-site cookie): the client POSTs the token to bzr.openai.com/v1/obi/sync. The response Set-Cookie is Domain=.openai.com; HttpOnly; Max-Age=31536000; SameSite=None; Secure. SameSite=None with Secure is the standard configuration for a cookie to travel on cross-site requests. Lifespan is one year.\n- Step 3 (advertisers send it back): any company that buys ads on ChatGPT installs the SDK at bzrcdn.openai.com/sdk/oaiq.min.js on its own site, the same way retailers install Meta and Google tracking code. The script-load request itself carries __obi, and the events endpoint /v1/sdk/events does too. Browsing data from 13 advertiser domains (Chewy, Wayfair, HelloFresh, Coursera, and others) flows back to OpenAI and gets tied to the ChatGPT account.\n\n## What else the SDK collects\n\nIn observed traffic, the SDK scraped 2.7× more identity fields than advertisers passed in deliberately (685 vs 255). The tag-manager bus is the largest source of email: the SDK overwrites window.dataLayer.push, reads adobeDataLayer, and reconstructs renamed GTM layers from the l= parameter on the gtm.js script tag. Version 0.1.31 once scraped first/last name and geography; OpenAI narrowed the scope on 27 August.\n\nEmail, phone, first and last name are SHA-256 hashed before transmission. Country, region, city and postal code are sent in the clear. URLs are reduced to origin + path: none of 23,929 observed requests carried a query string, but paths reaching the collector included a medical-condition funnel, a debt-solutions funnel and a litigation intake form.\n\n## Cookie policy and SameSite behaviour\n\nOpenAI's policy lists __obi under Analytics cookies, one year, scoped to chatgpt.com and openai.com; it is the only entry in that section. OpenAI splits analytics and marketing into two separate consent switches: oai_consent_analytics and oai_consent_marketing. Every token the author decoded carried consent_decision: analytics_allowed — users who allow analytics and refuse marketing still get the cookie.\n\nIn the same capture, oai-did and oaicom-stable-id were blocked by SameSite=Lax; oai-client-auth-info and session cookies were blocked by domain mismatch. Only __obi was sent.\n\n## Limits worth stating\n\n- Verified only on Chrome for Android. Safari's ITP blocks all third-party cookies; every browser on iOS (including Chrome on iOS) runs on WebKit, so the mechanism does not work. Desktop Chrome is untested.\n- About one ChatGPT session in five produces a sync token; the ChatGPT mobile web client serves ads without syncing.\n- Whether OpenAI resolves the cookie back to the account server-side was not directly observed. The author only saw the collector accept events with HTTP 202.\n- The mechanism still works when signed out. Of 932 decoded tokens, 736 were account_user and 196 anonymous; anonymous subjects are stable per device for at least 27 days.\n- Advertisers cannot see the value. __obi lives on openai.com, a domain their scripts cannot read. They installed a conversion pixel and have no way to know their visitors are being resolved to a ChatGPT identity.\n\n## Why this is not the same as Meta's old playbook\n\nBundling a logged-in account, third-party cookies, and off-site conversion events into a single profile is a structural equivalent Meta built years ago. The mechanism itself is standard adtech. What has no precedent is running it on an AI chat product: people say things to ChatGPT that they would never post on a social network, and ChatGPT is increasingly acting on their behalf. Tying a logged-in session to a third-party cookie exposes conversational context to any advertiser willing to buy ChatGPT placements.\n\nThe author sent the mechanism and two questions to press@openai.com and privacy@openai.com on 14 September: why __obi is classified as an analytics cookie, and whether a user who grants analytics consent but refuses marketing consent still receives it. OpenAI Support acknowledged the inquiry and said it would be reviewed internally, but did not answer either question."