ChatGPT Has an Ad Cookie Now, and It Follows You to Other Websites
An independent traffic analysis describes an OpenAI advertising pixel that sets a cookie tied to your signed-in ChatGPT account, so advertiser sites carrying the pixel can report your visits back to OpenAI.
A reverse-engineering write-up published this week describes how OpenAI’s advertising measurement works, and it is the familiar machinery of the ad industry pointed at a chatbot account. When you are signed in, ChatGPT generates a random identifier and requests a signed token binding that identifier to your account. The token is posted to an OpenAI endpoint, which sets a cookie called __obi on the openai.com domain, marked SameSite=None and Secure with a one-year lifetime. Those two flags are what let a cookie travel: they permit the browser to send it along with requests made from entirely different websites.
That matters because advertisers who buy ChatGPT ads can embed OpenAI’s measurement pixel on their own sites. A pixel is a small piece of code, not really an image any more, whose job is to fire off a message when a page loads. Because the pixel loads from OpenAI infrastructure, the browser attaches the __obi cookie, and OpenAI can receive which pages you visited on that advertiser’s site, including product pages, article URLs and purchase confirmations. The author reports the pixel also collects page content, hashed email addresses and phone numbers, unencrypted city, region and postal data, and values scraped from form fields on the page, and that scraped identity outnumbered advertiser-supplied identity by 685 events to 255.
What is behind this
Two details are worth separating from the general unease. First, the classification: OpenAI’s cookie policy lists __obi as an analytics cookie rather than a marketing one, which means someone who declined marketing consent may still receive it. Whether that holds up under the EU’s rules is a question for regulators, not for us, but it is the kind of distinction those rules exist to police. Second, browser defences already blunt this. Safari and other WebKit browsers block third-party cookies outright through Intelligent Tracking Prevention, so on iPhone and on Safari for Mac the mechanism should not function at all.
None of this is unusual technology. Meta and Google have run conversion pixels for many years, and measuring whether an ad worked is a legitimate thing for an advertiser to want. What is new is the identifier it attaches to. A ChatGPT account is not an advertising profile assembled from guesses, it is a login attached to a service where people type things they would not put in a search box.
What this means for you: If you want to limit it, the practical steps are ordinary ones: use Safari or Firefox, or a Chromium browser with third-party cookies disabled, or a content blocker, and review OpenAI’s cookie settings in your account. None of that is dramatic. The broader point is that ChatGPT has crossed from being a product you pay for or use free into being a product with an advertising business behind it, and the incentives of those two things are not the same. It is worth knowing which one you are using.
Sources
Source: https://www.buchodi.com/chatgpt-now-knows-what-you-do-on-other-websites-via-ad-collector/
Shopify Is Letting Meta's AI Assistant Buy Things for You
Shopify says Meta's Muse agent can now search its catalog and complete purchases through Shop Pay across Shopify stores by default, routed through the Universal Commerce Protocol it co-developed with Google.
