ChatGPT Ad Tracking Cookie __obi Reaches 936 Pixels Across 1,029 Sites
OpenAI's __obi ChatGPT ad tracking cookie links advertiser-site visits to ChatGPT accounts for about a year, and an analytics label may sidestep consent.
OpenAI's advertising measurement stack uses a cross-site cookie named __obi to connect activity on outside advertiser sites to a ChatGPT account or a device-linked identifier, according to an investigation into the company's ad measurement code. The same investigation reported reproducing the cookie across 936 advertiser pixels on 1,029 hostnames. For anyone who has declined marketing cookies and assumed that settled the matter, the ChatGPT ad tracking cookie is the piece worth checking.
Two attributes do most of the work. __obi is issued with SameSite=None, which instructs the browser to attach it to requests that begin on other sites instead of restricting it to OpenAI's own domains. Without that attribute, browsers withhold a cookie from cross-site requests by default. The second attribute is time: the investigation reported a maximum lifetime of about one year. A year-long cookie that travels between origins is the basic equipment cross-site measurement needs.
OpenAI's policy files place __obi under analytics rather than marketing, according to the investigation. The label carries more weight than the cookie. The two categories usually sit behind separate consent gates, so someone who rejects marketing cookies may never trigger the prompt that would have covered __obi. The identifier can be set while the consent record still reads clean.
Results varied by browser in the investigation's testing. __obi was reproduced on Chrome for Android. Safari's Intelligent Tracking Prevention blocked it. ITP restricts the cross-site cookies that measurement stacks depend on, which leaves the same cookie active on one platform and inert on another.
The investigation describes the match as going to a ChatGPT account or to a device-linked identifier. Under that description, setting __obi does not depend on a signed-in session. The cookie works as a device-level marker as much as an account feature, and that widens the group it can cover beyond people who are logged in while using ChatGPT.
The hostname count is what lifts this past a niche technical note. Every one of the 1,029 hostnames runs an advertiser pixel, and each pixel is a place where the cookie can be read or written. Counting clicks on a single campaign does not require reach that wide. A footprint spanning nearly a thousand pixels looks more like infrastructure for comparing behaviour across many publishers.
The ratio between the two figures is also telling. Fewer hostnames than pixels means some of those sites carried more than one advertising tag capable of touching __obi, which points to a standardised deployment rather than one-off integrations. Measurement code that lands in a repeatable pattern across publishers is easier to audit in bulk, and harder to unwind site by site if the classification ever changes.
How the Cookie Is Configured
Attributes of the ChatGPT ad tracking cookie, as reported by the investigation:
| Attribute | Detail |
|---|---|
| Cookie name | __obi |
| Policy classification | Analytics, not marketing |
| Maximum lifetime | About one year |
| SameSite setting | None, so it is sent on cross-site requests |
| Reproduced across | 936 advertiser pixels on 1,029 hostnames |
| Browser outcome | Ran on Chrome for Android; blocked by Safari's ITP |
Every attribute above comes from the investigation into OpenAI's ad measurement code.
For advertisers, the appeal is easy to see. Conversion attribution is only as good as the identifier that survives the trip from an ad click to a purchase, and a one-year lifetime covers far more of that trip than a session cookie. The trade-off lands on users, who carry an identifier with no visible expiry and no obvious way to check whether it was set.
Device-linked identifiers are not unique to OpenAI, and the investigation's account places __obi inside that broader pattern of measurement that works without a login. What the findings add is a concrete case of how far such an identifier reaches inside an assistant product.
A practical asymmetry runs through this. A third-party cookie from a conventional ad network usually shows up in browser storage tools and falls under the same consent banner that governs marketing tags. __obi sits on OpenAI's side of the relationship, attached to an account people use daily, which makes it harder to separate from the product itself. Any company running both a widely used app and an ad business gets that structural advantage.
The Label Is the Real Dispute
My view is that the classification of the ChatGPT ad tracking cookie matters more than the measurement. Measuring ad performance is standard practice for a company that sells ads. Filing an identifier that spans more than a thousand hostnames and outlives a browser session under analytics is a different kind of claim.
Privacy regimes generally treat analytics as first-party measurement of how people use a service. A cookie that reconciles visits to advertiser sites with a ChatGPT account does something else. It joins one person's behaviour across domains into a single profile, which is the activity marketing-consent rules exist to gate.
The strongest counter-argument is that measurement is not targeting. A cookie used to count conversions and attribute spend need not feed a targeting graph, and the analytics label could reflect function rather than intent. That distinction carries real weight in how consent frameworks are drafted. It weakens here for a specific reason: the investigation's own description pairs the account with a device-linked identifier, and once a cookie follows a device rather than a login, the line between counting and recognising is hard to hold.
A second problem is that browser defences now carry much of the load, and they are uneven. Safari's ITP stopped the cookie on its platform. Chrome for Android did not. The protection a user receives depends on the phone in their pocket rather than on what they agreed to.
The investigation leaves questions open, including how the analytics classification was reached and whether the cookie behaves differently by region. Consent tooling is built around accounts and sessions, and the identifier described here outlives both. Treating it as ad tech rather than measurement is the change that would close that gap.
Why this matters
Declining marketing cookies no longer covers the whole field. If an assistant-level identifier can sit under an analytics label while reaching across a thousand hostnames, the consent screens people depend on describe less than they appear to. Regulators and browser makers now have to decide whether an identifier tied to an assistant counts as ad tech under rules written before assistants were in the picture.
Photo by Brett Wharton on Unsplash
Related Articles
- OpenAI Rewrites ChatGPT Advertising Policy to Block Rival Image and Audio AI Ads
- OpenAI's ChatGPT Ads Europe expansion reaches 31 markets ahead of IPO
- OpenAI's ChatGPT Sponsored Agents Turn Ad Clicks Into Brand Chats
✔Human Verified
Researched and cross-referenced against primary sources by the Bytevyte editorial team. This article was generated with the assistance of artificial intelligence and reviewed by the Bytevyte editorial team.