ChatGPT now knows what you do on other websites via ad collector

6.3 relevance

ChatGPT tracking user activity, significant privacy and strategic implications for AI.

AI/ML buchodi.com

Answer the board on AI readiness

Arrive with evidence, not opinion. See how your foundation benchmarks against your peers, get a clear read, and leave with a ranked place to start.

Why It Matters

For a platform engineer focused on privacy and data flow, this reveals how a major AI provider implements cross-site tracking via a JWT-based cookie sync, with implications for consent management, SDK auditing, and user identity leakage in multi-tenant architectures.

Key Takeaways

Audit any third-party SDKs in your stack for automatic cookie transmission on script-load requests, especially those using SameSite=none cookies that bypass credential-omission code paths.

Summary

OpenAI's ad platform, bazaar, uses a cross-site cookie __obi (domain .openai.com, SameSite=none, Secure, 1-year expiry) to link ChatGPT accounts to browsing behavior on advertiser sites. The cookie is set via a JWT sync from chatgpt.com to bzr.openai.com, and is automatically sent on script-load requests for the SDK, even on its 'no credentials' path. The SDK scrapes identity from tag managers and form fields—email/phone hashed, postal codes in clear—with scraped data (685 events) outpacing advertiser-supplied (255) across 936 pixels on 1029 hostnames.

Author

Buchodi