OpenAI's advertising push now reaches beyond what happens inside ChatGPT. An independent researcher found that a cookie placed by ChatGPT can reappear when the same browser visits websites running OpenAI's advertising pixel, most likely giving OpenAI a way to link ad interactions to later activity on participating sites.

The system centers on a cookie called __obi, according to a researcher who goes by the name Buchodi. ChatGPT can place the cookie in a browser, where it persists for up to a year. When that browser later visits a site running OpenAI's advertising technology, requests sent back to OpenAI can include the same identifier along with page and conversion data.

That does not mean OpenAI attaches every off-site action to a named ChatGPT account. Buchodi did not observe the final server-side step that would join activity from an advertiser's site to a specific user account. What the research shows is that the same OpenAI identifier can travel from ChatGPT to participating advertiser sites and back to OpenAI.

The technique is not new. It is essentially a traditional third-party cookie operating in a new context. For marketers, it could mean better conversion measurement in a channel that currently offers few ad performance metrics.

Consumers may object to these cookies more than they would elsewhere. ChatGPT users share far more personal information than they typically give a search engine or social platform. A system that links chatbot activity to off-platform behavior therefore raises questions about consent, disclosure, and the extent of data advertisers should expect an AI platform to connect.

The consent language deserves scrutiny

There is also a question about how OpenAI classifies the cookie.

OpenAI lists __obi as an analytics cookie. Buchodi found that the cookie could reportedly be set when analytics consent was allowed, even if a user had declined marketing cookies.

That distinction matters. Users may reasonably understand "analytics" to mean product or site measurement rather than cross-site advertising attribution. OpenAI has not publicly answered questions about why the cookie carries that label, or whether analytics-only consent was intended to cover the reported behavior, at the time the research was published.

For marketers using ChatGPT ads, that puts consent design and vendor due diligence on the list of things to understand before celebrating improved attribution. Knowing that a platform can measure more is different from knowing customers understand and accept how that measurement works.

It also means ChatGPT must comply with the many different laws governing the handling of personal information. That is likely not the type of government oversight OpenAI has been asking for.