Researcher Finds ChatGPT Cookie Can Link Off-Site Purchases to Accounts
Independent researcher Buchodi reported that an OpenAI cookie named __obi can send merchant-site browse, search, and purchase activity to OpenAI from Android Chrome. The cookie is grouped under data analysis, so disabling advertising tracking does not prevent it from being set.
Report and scope
On or about 20 September 2026, independent researcher Buchodi published a first-hand investigation of OpenAI advertising collection. The post reached 573 points and 308 comments on Hacker News.
Buchodi captured traffic between an Android phone and websites over several months, covering thousands of sites and nearly 1,000 advertising trackers, and repeated the capture with a second method.
The finding stated in the report is that search, page view, and purchase activity on merchant sites can be associated with a ChatGPT account through a cookie named __obi.
What was observed
On the researcher's phone, the same __obi value was sent to OpenAI from 12 commercial sites, including Chewy, Wayfair, HelloFresh, and Coursera, and was accepted. Over a longer window, the same person's identifier was returned from multiple merchants as a regular pattern. One identifier appeared in return records from ten different merchants at once.
Merchant sites that buy ChatGPT advertising had installed a short OpenAI measurement snippet. Collection occurred when the merchant page loaded, without a required user click. The report states those merchants were installing the snippet for advertising performance and were not told that customer browsing was being bound to a ChatGPT account.
The OpenAI snippet also collected information from forms and on-page text. Email, telephone, and name were transmitted encrypted. Country, city, and postal code were sent in plaintext. Postal code was the most frequent of those fields: 100 captures across 28 sites.
Visited URLs were returned. Search terms were stripped; page paths remained. Paths observed in the collector included a disease-lookup page, a debt-plan page, and a lawsuit registration form.
Account state and settings
Nearly 1,000 identity credentials were examined. When the ChatGPT account was logged out, the system still assigned the phone an anonymous device identifier that lasted at least 27 days.
In ChatGPT privacy settings, data analysis and advertising marketing are separate controls. __obi is classified under data analysis. Turning off advertising tracking therefore does not stop this cookie from being set.
On 14 September 2026, Buchodi sent OpenAI the findings and two questions: why the cookie is treated as analysis rather than marketing, and whether users who disabled marketing still receive it. Support said the message was received and would be reviewed internally. Neither question received a substantive answer.
Who is affected
The mechanism was observed on Android Chrome. Apple Safari blocks this class of cross-site cookie, as does Chrome on iOS, so iPhone and iPad users were not affected in the tests. Desktop Chrome was not tested.
Not every ChatGPT visit produced the identifier. About one visit in five did. The mobile web edition did not trigger it.
The researcher showed that data reached OpenAI servers. The report does not claim direct observation of how those servers join the data to an account.
Context
The collection pattern matches long-standing advertising pixels used by other platforms. ChatGPT began selling advertising placements in February 2026. In late April 2026, marketing tracking was turned on by default for free users. Earlier public concern focused on data leaving ChatGPT conversations. This investigation describes merchant-site activity flowing toward ChatGPT identifiers.
Source: https://www.buchodi.com/chatgpt-now-knows-what-you-do-on-other-websites-via-ad-collector