ChatGPT now knows what you do on other websites via ad collector
Ranked #2 on Hacker News with 436 points and 235 comments.
OpenAI's ad collector at bzr.openai.com sets a cookie called __obi , scoped to .openai.com . The value is while you are on ChatGPT and tied to your ChatGPT account. __obi is then sent to OpenAI from ordinary websites you visit.
Any company that buys ads on ChatGPT installs a small piece of OpenAI code on its own site, the same way retailers already install Meta and Google tracking code. Loading that code, sends __obi to OpenAI along with data about the page you are browsing. This includes products you are searching for, articles you are reading, and purchase behaviors.
The bottom line is that OpenAI can connect what you do on those sites to your ChatGPT account.
I reproduced the full mechanism on my own phone, verified with two independent capture methods, and cross-checked against several months of observed traffic covering 936 distinct advertiser pixels across 1,029 hostnames.
Step 1. ChatGPT creates an identifier and signs it.
On chatgpt.com , the client generates 16 random bytes and calls POST /backend-api/bazaar/obi/sync-token (or /backend-anon/ when signed out). The backend returns an RS256 JWT: