ChatGPT Has Gone Ad Network: ChatGPT Is Plugging Your Cross-Site Behavior Into Ad Profiles

Hot Tracking: Hot releases × Technical judgment × Practical advice. Author: Yongliang

---

Let’s pin down the timeline first. On September 20, an independent researcher published a disclosure on their personal blog buchodi.com: ChatGPT is, through an ad collector, directly linking user behavior on third-party websites to their ChatGPT accounts. The article was featured on the Hacker News front page the same day, garnering 555 upvotes and 303 comments, with discussion stacking hundreds of layers deep. This piece is written within the 48-hour window following the initial disclosure. The mechanism itself is nothing new in ad technology; what’s new is where it’s running — on a product people habitually use to confide in. The following facts are based on the disclosing party’s own account; the official policy page portions have been independently verified.

What Happened

Lay out the facts according to the official account, all sourced from the original disclosure and OpenAI’s official policy page.

The researcher claims to have reproduced the entire flow on a mobile phone and cross-validated it with two packet-capture methods; months of traffic observation covered 936 ad pixels and 1,029 domains. The flow breaks down as follows:

Step one: the ChatGPT client generates 16 random bytes and exchanges them with the server for an RS256-signed JWT that expires in 60 seconds, carrying the consent policy version (user_granular_consent_v1) and account identifier. Step two: the server sets a cookie named __obi, sitting on the openai.com first-level domain, HttpOnly, SameSite set to none, Secure, valid for a full year. Anyone who knows the field would understand these three characteristics at a glance: HttpOnly means scripts can’t read it but browsers automatically attach it; SameSite=none means cross-site requests fire without obstruction; a one-year validity means it functions as a long-term identity anchor, not a disposable session marker. Together, these three characteristics determine that it can be carried across sites.

On the advertiser side, websites just need to install OpenAI’s pixel SDK — the same kind of tracking code as Meta’s or Google’s — and the moment a user opens a page, the browser automatically attaches the cookie and sends it to OpenAI. This step requires no code writing from the advertiser; the browser already carries the credentials before the SDK even runs. The disclosing party’s original point was: even if the code path doesn’t actively transmit it, you can’t stop the browser from automatically attaching it.

The SDK doesn’t just report ad events: in the observed traffic, “scraped identity” appears 685 times while “advertiser actively provided” appears only 255 times — meaning over 60% of identity information is scraped by the SDK from the page itself, not filled in by the advertiser. Scraping sources include data layers from Google Tag Manager; the SDK first renames variables, then parses this renamed-layer data. The v0.1.31 released on August 27 narrowed the scope; earlier versions also collected names and geolocation. Current practice: emails and phone numbers are SHA-256 hashed before transmission, while country, region, city, and zip code are sent in plaintext. Zip code is the most harvested form field — 28 sites, 100 events.

At the URL level, only the referrer and path are sent, never the query string; none of the 23,929 observed requests carried query parameters. But the path itself is information: among the observed paths appeared a medical condition, a debt resolution funnel, and a litigation intake form.

The “auto-matching” feature is enabled in 638 out of 881 pixels where settings could be confirmed, covering every credit-category advertiser observed. The toggle is controlled via OpenAI Ads Manager. Auto-matching works by connecting the customer lists advertisers already hold with the visitor identifiers collected by pixels: advertisers don’t need to know who you are — as long as the lists match, the ad system knows whom to target and what to show. This feature being fully enabled for credit and lending advertisers is itself very telling — the conversions in this kind of business depend precisely on precise, individual-level identity identification.

An exclusion list does exist: passwords, one-time verification codes, card numbers, social security numbers, dates of birth, medical history and diagnoses, and court-related fields are all on it. The existence of the list shows the designers thought about boundaries; but what gets scraped beyond the list, what page paths leak, the list can’t govern.

Which companies are using it? The disclosure lists 12 commercial websites and 13 pixel IDs, with recognizable names: Chewy, Wayfair, ThriftBooks, Eventbrite, HelloFresh, Coursera, SeatGeek.

Anonymous identifiers are as stable as login identifiers: one per device, lasting at least 27 days; among 932 decoded sync tokens, 736 carry account identifiers. The researcher estimates that roughly one in five ChatGPT sessions produces a sync token. Mobile web can serve ads without mounting cookies.

The Mechanism Is Old, the Location Is New

The disclosing author’s own judgment is restrained: Meta built a structurally equivalent system years ago; this is standard ad technology, and what has no precedent is running it on an AI chat product.

The difference in “location” is worth spelling out in full. On social networks, users inherently assume they are being watched: every post, every like adds to the profile; the psychological account is public. Things you wouldn’t say in your WeChat Moments wouldn’t be posted there in the first place — that boundary is drawn for you by the product’s form factor. Chatbots have torn down that boundary. People type into chat boxes things they wouldn’t send to any social platform — medical conditions, debts, lawsuits, marital problems, even just a sentence they’re afraid to say to anyone. The default understanding people have of this product is: it’s a private space, and the entity on the other end won’t remember you, let alone monetize you.

And what this collector does is plug the behavior inside that private space into the public ad system’s identity matching. What you said in the chat box may not reach the ad end directly; but your behavior elsewhere — medical websites, debt counseling pages, legal document pages — is strung together by the same account identifier. The same set of companies now has what you searched for on other sites, what you read, whether you placed orders. The two datasets may not be merged in plaintext, but the identifier is the same, and the ad system can use it without merging. That is the real lethality of “location”: the user thinks they’re operating in two unrelated spaces, but the system sees one person.

The Official Narrative Doesn’t Add Up

The second landing point is on OpenAI’s own policy page.

In OpenAI’s Cookie Policy, __obi is explicitly listed under the Analytics section: domain is OpenAI, valid for one year, and it is the sole entry in that section. The entire “Analytics” category contains only this one entry — sitting alone, occupying the analytics name.

On the same page, analytics and marketing are two separate consent options — users can check only analytics and decline marketing in their settings. This is the commitment structure the policy page itself provides: two use cases separated, and the user’s genuine choice exists.

Contrast with actual behavior: this identifier classified as “analytics” carries account identifiers, is carried across sites, and feeds into the ad system, covering every credit advertiser observed. Users who only decline marketing (per the policy, understanding they’ve consented to analytics) should not receive ad-related tracking — but __obi is still set regardless. The classification is analytics, the use case is ads; there’s a definitional game in between — every word in the policy text is technically valid, but the combined effect is divorced from the use case the policy promised.

The researcher sent the mechanism and two specific questions to OpenAI: Is __obi classified as an analytics cookie? Do users who only consent to analytics and decline marketing still receive it? The support team confirmed receipt and said it would be internally forwarded; neither question was answered. As of press time, OpenAI has not directly responded; the author stated they will update the article if a response comes.

Keep the perspective steady: this mechanism can currently only be described as “per disclosure, reproduced by the researcher.” OpenAI has not directly responded, and how regulators characterize it is a matter for later. But the fact that “the official classification doesn’t match the actual behavior” holds true without waiting for a response — the policy page is a primary, public document.

What the Comments Say

In the HN discussion thread, several judgments stood out. One person said they’re still paying OpenAI yet have become part of this business — Google and Facebook users at least don’t pay; using data on free products is an old rule, but doing it on paid products changes the flavor. Another said this practice borders on malware in their book; the problem is that people don’t get angry when they can’t see it: the SDK hides inside pages, the cookie lies deep in the browser, there are no popups, no notifications — ordinary people have no way to detect it. Whenever someone uses “Meta does it too” as a defense, someone immediately fires back: others doing it doesn’t make any instance forgivable — laying out the scope for comparison isn’t a defense. Others said OpenAI hired a large number of former Meta and Google employees for this purpose, so producing a same-source product is hardly surprising. Someone also compared it to a tragedy of the commons — every time someone says “building this feature requires building spyware first,” the response is “it’s already like this anyway,” and the baseline gets defaulted lower and lower.

Three Things Ordinary Users Can Do

First, switching to the right browser immunizes most of it. Firefox blocks third-party cookies by default, so this sync chain can’t reach you; all browsers on iOS use the WebKit engine and are similarly unaffected. Immunity on these two platforms isn’t accidental — it’s engine-level default policies blocking for you. Desktop Chrome has no test data; don’t assume it’s safe. If you primarily use Chrome, install a third-party cookie blocking extension for near-equivalent protection.

Second, in cookie consent, only check the necessary items. When consent popups appear, reject marketing and turn off analytics wherever possible. Even though __obi is officially classified as analytics, checking fewer items means feeding fewer signals. Also take a moment to review your approved settings: many users check everything on their first login and never look back; the permissions page often sits with a row of switches they never consciously toggled.

Third, don’t reveal personal details in AI chat boxes. Account passwords, verification codes, ID numbers, and medical details should never be entered as content to “just tell the AI.” You don’t know what collectors are hanging on the other end, or which version of the SDK is running. More practically, AI products change their business models far faster than users update their understanding. Today it promises not to use conversations for ads; tomorrow the policy page changes one line, and what you handed over is already on someone else’s server.

Conclusion

The conclusions from the words-versus-actions audit: the mechanism is not new — Meta’s same model; the location is new — chatbots have become the new confessional, and the ad network has hung itself on that confessional; the official classification puts __obi under Analytics, with no direct response to the researcher’s two questions, and the classification doesn’t match the actual use case.

One more layer on the proportion of this matter. The disclosing party is currently one person, and reproduction was only done on one phone; this doesn’t constitute confirmed surveillance conviction — all statements in this piece stop at “per disclosure, reproduced by the researcher, official not responded.” But even at a discounted listen, two facts are hard: the pixel SDK genuinely exists, and the policy page’s classification is in black and white. Two nodes worth watching next: whether OpenAI directly responds to the two specific questions — the author promises to update if they do; and the regulatory stance — will privacy enforcement agencies at the EU and U.S. state level open cases, especially in Europe where this kind of consent mechanism’s conflict with GDPR is almost textbook. Ad technology is not short of precedents; what it lacks is asking users for consent before treating AI chat products as ordinary traffic entry points. That question mark doesn’t just hang over OpenAI — it hangs over every company currently plugging AI products into ad systems.

Reference Sources

• buchodi.com (2026-09-20): “ChatGPT now knows what you do on other websites via ad collector” — mechanism, data, and named company list (details based on the disclosing party’s own account)
• Hacker News discussion thread (id 49776729, 2026-09-20): 555 upvotes / 303 comments, user reactions
• OpenAI Cookie Policy (openai.com/policies/cookie-policy/): __obi classified as Analytics, one-year validity, analytics and marketing have separate consent options