Hacker News front pageBuchodi5 min readintermediate
ChatGPT now knows what you do on other websites via ad collector
Summary
OpenAI’s ChatGPT sets a cross‑site cookie (__obi) that advertisers’ ad‑pixel scripts automatically send back to OpenAI, linking browsing activity on third‑party sites to a user’s ChatGPT account. The author reverse‑engineered the token exchange, captured traffic from hundreds of pixels, and quantified the data collected (emails, phone numbers, locations, page paths). The mechanism works for logge…
- ChatGPT generates a per‑device identifier (obi) bound to the user’s account via a short‑lived JWT, then stores it as a SameSite=None cookie (__ob i) on .openai.com.
- Advertiser pages load OpenAI’s SDK script (oaiq.min.js); the browser automatically includes __obi on the script request, exposing the identifier before any OpenAI code runs.
- The SDK scrapes form fields, page text, and tag‑manager data, hashing emails/phones and sending them (plus clear‑text location data) to OpenAI’s collector.
- Observed traffic: 936 advertiser pixels across 1,029 hostnames; 685 scraped‑identity events vs 255 advertiser‑supplied; 12‑plus sites per identifier; anonymous tokens persist ≥27 days.
Linking off‑site browsing behavior to a ChatGPT account enables detailed profiling and targeted advertising without user awareness, potentially violating privacy expectations and consent choices. The persistence and cross‑site nature of __obi make it a powerful tracking vector that can survive acro…
7/10
