GoKawiilOpenAI's ad collector at bzr.openai.com sets a cookie called __obi , scoped to .openai.com . The value is while you are on ChatGPT and tied to your ChatGPT account. __obi is then sent to OpenAI from ordinary websites you visit.
Any company that buys ads on ChatGPT installs a small piece of OpenAI code on its own site, the same way retailers already install Meta and Google tracking code. Loading that code, sends __obi to OpenAI along with data about the page you are browsing. This includes products you are searching for, articles you are reading, and purchase behaviors.
The bottom line is that OpenAI can connect what you do on those sites to your ChatGPT account.
I reproduced the full mechanism on my own phone, verified with two independent capture methods, and cross-checked against several months of observed traffic covering 936 distinct advertiser pixels across 1,029 hostnames.
How it works
Step 1. ChatGPT creates an identifier and signs it.
On chatgpt.com , the client generates 16 random bytes and calls POST /backend-api/bazaar/obi/sync-token (or /backend-anon/ when signed out). The backend returns an RS256 JWT:
{ "iss": "chatgpt-wadi", "aud": "bzr.openai.com", "purpose": "obi_sync", "operation": "set", "consent_decision": "analytics_allowed", "consent_policy_version": "user_granular_consent_v1", "sub": "«redacted: 64-hex account subject»", "subject_type": "account_user", "obi": "«redacted: 22-char identifier»", "exp": "«iat + 60s»" }
sub is the account. obi is the identifier. The token binds them, is scoped to the collector, and expires in 60 seconds. bzr stands for bazaar , OpenAI's internal name for the ads platform; wadi is the issuing service.
Step 2. The identifier becomes a cookie on OpenAI's domain.
... continue reading