{"id":3614,"date":"2026-09-21T17:38:54","date_gmt":"2026-09-21T17:38:54","guid":{"rendered":"https:\/\/netguide.io\/news\/2026\/09\/21\/chatgpt-cookie-__obi-security-researcher-uncovers-cross-site-tracking-by-openai\/"},"modified":"2026-09-21T17:38:55","modified_gmt":"2026-09-21T17:38:55","slug":"chatgpt-cookie-__obi-security-researcher-uncovers-cross-site-tracking-by-openai","status":"publish","type":"post","link":"https:\/\/netguide.io\/news\/en\/2026\/09\/21\/chatgpt-cookie-__obi-security-researcher-uncovers-cross-site-tracking-by-openai\/","title":{"rendered":"ChatGPT Cookie __obi: Security Researcher Uncovers Cross-Site Tracking by OpenAI"},"content":{"rendered":"<div id=\"netgu-995292715\" class=\"netgu-before-content netgu-entity-placement\"><script async src=\"\/\/pagead2.googlesyndication.com\/pagead\/js\/adsbygoogle.js?client=ca-pub-6258556257245998\" crossorigin=\"anonymous\"><\/script><ins class=\"adsbygoogle\" style=\"display:block;\" data-ad-client=\"ca-pub-6258556257245998\" \ndata-ad-slot=\"3494115342\" \ndata-ad-format=\"auto\"><\/ins>\n<script> \n(adsbygoogle = window.adsbygoogle || []).push({}); \n<\/script>\n<\/div><p>AI corporation OpenAI uses a cookie named <code>__obi<\/code> that can link users&#8217; web activities across hundreds of external platforms to their ChatGPT account. This was demonstrated in a study published on September 20, 2026, by independent security researcher &#8220;Buchodi&#8221;. The data collection particularly affects users whose web browsers allow third-party cookies by default.<\/p>\n<h2>How tracking via the pixel network works<\/h2>\n<p>According to the researcher&#8217;s findings, ChatGPT sets the cookie on the <code>.openai.com<\/code> domain with a lifespan of one year (31,536,000 seconds). Configured with the attributes <code>SameSite=None<\/code> and <code>Secure<\/code>, the identifier can also be accessed across browsers in the context of external websites. Upon visiting, the client generates random bytes and requests a signed authorization token via the endpoint <code>POST \/backend-api\/bazaar\/obi\/sync-token<\/code>. In addition to an account ID, this token contains a 22-character identification code.<\/p><div id=\"netgu-1404212970\" class=\"netgu-content netgu-entity-placement\"><aside class=\"deals-top deals-top--compact\">\n\n\t\t\t<h3 class=\"deals-top__title\">Top-Deals<\/h3>\n\t\n\t\t\t<ul class=\"deals-top__list\">\n\t\t\t\t\t\t\t<li class=\"deals-top__item\">\n\t\t\t\t\t<a class=\"deals-top__link\" href=\"https:\/\/netguide.io\/deals\/de\/deals\/ugreen-aluminium-tabletstaender-360-drehbar-hoehenverstellbar\/\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t<img class=\"deals-top__image\" src=\"https:\/\/netguide.io\/news\/wp-content\/uploads\/sites\/15\/2026\/09\/2825012_1-150x150.webp\" alt=\"\" width=\"52\" height=\"52\" loading=\"lazy\" \/>\n\t\t\t\t\t\t\n\t\t\t\t\t\t<span class=\"deals-top__body\">\n\t\t\t\t\t\t\t<span class=\"deals-top__name\">UGREEN Aluminium Tabletst\u00e4nder | 360\u00b0 Drehbar &amp; H\u00f6henverstellbar<\/span>\n\n\t\t\t\t\t\t\t<span class=\"deals-top__meta\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<span class=\"deals-top__price\">16.91 \u20ac<\/span>\n\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<s>20.37 \u20ac<\/s>\n\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<span class=\"deals-discount\">-17%<\/span>\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t<\/span>\n\n\t\t\t\t\t\t<span class=\"deals-top__temperature is-hot\">\n\t\t\t\t\t\t\t109\u00b0\n\t\t\t\t\t\t<\/span>\n\t\t\t\t\t<\/a>\n\t\t\t\t<\/li>\n\t\t\t\t\t\t\t<li class=\"deals-top__item\">\n\t\t\t\t\t<a class=\"deals-top__link\" href=\"https:\/\/netguide.io\/deals\/de\/deals\/train-sim-world-7-starter-pack-kostenlos-fuer-ps4-ps5-xbox-pc\/\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t<img class=\"deals-top__image\" src=\"https:\/\/netguide.io\/news\/wp-content\/uploads\/sites\/15\/2026\/09\/capsule_616x353-11-150x150.jpg\" alt=\"\" width=\"52\" height=\"52\" loading=\"lazy\" \/>\n\t\t\t\t\t\t\n\t\t\t\t\t\t<span class=\"deals-top__body\">\n\t\t\t\t\t\t\t<span class=\"deals-top__name\">Train Sim World 7: Starter Pack kostenlos f\u00fcr PS4, PS5, Xbox, PC<\/span>\n\n\t\t\t\t\t\t\t<span class=\"deals-top__meta\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<span class=\"deals-top__price\">Gratis<\/span>\n\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t<\/span>\n\n\t\t\t\t\t\t<span class=\"deals-top__temperature\">\n\t\t\t\t\t\t\t55\u00b0\n\t\t\t\t\t\t<\/span>\n\t\t\t\t\t<\/a>\n\t\t\t\t<\/li>\n\t\t\t\t\t\t\t<li class=\"deals-top__item\">\n\t\t\t\t\t<a class=\"deals-top__link\" href=\"https:\/\/netguide.io\/deals\/de\/deals\/kostenlose-emote-im-clash-royale-store\/\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t<img class=\"deals-top__image\" src=\"https:\/\/netguide.io\/news\/wp-content\/uploads\/sites\/15\/2026\/09\/share-image-clashroyale-150x150.jpg\" alt=\"\" width=\"52\" height=\"52\" loading=\"lazy\" \/>\n\t\t\t\t\t\t\n\t\t\t\t\t\t<span class=\"deals-top__body\">\n\t\t\t\t\t\t\t<span class=\"deals-top__name\">Kostenlose Emote im Clash Royale-Store<\/span>\n\n\t\t\t\t\t\t\t<span class=\"deals-top__meta\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<span class=\"deals-top__price\">Gratis<\/span>\n\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t<\/span>\n\n\t\t\t\t\t\t<span class=\"deals-top__temperature\">\n\t\t\t\t\t\t\t54\u00b0\n\t\t\t\t\t\t<\/span>\n\t\t\t\t\t<\/a>\n\t\t\t\t<\/li>\n\t\t\t\t\t\t\t<li class=\"deals-top__item\">\n\t\t\t\t\t<a class=\"deals-top__link\" href=\"https:\/\/netguide.io\/deals\/de\/deals\/gratis-forschungssuppe-im-clash-of-clans-store\/\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t<img class=\"deals-top__image\" src=\"https:\/\/netguide.io\/news\/wp-content\/uploads\/sites\/15\/2026\/09\/2839474_1-150x150.webp\" alt=\"\" width=\"52\" height=\"52\" loading=\"lazy\" \/>\n\t\t\t\t\t\t\n\t\t\t\t\t\t<span class=\"deals-top__body\">\n\t\t\t\t\t\t\t<span class=\"deals-top__name\">Gratis Forschungssuppe im Clash of Clans-Store<\/span>\n\n\t\t\t\t\t\t\t<span class=\"deals-top__meta\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<span class=\"deals-top__price\">Gratis<\/span>\n\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t<\/span>\n\n\t\t\t\t\t\t<span class=\"deals-top__temperature\">\n\t\t\t\t\t\t\t54\u00b0\n\t\t\t\t\t\t<\/span>\n\t\t\t\t\t<\/a>\n\t\t\t\t<\/li>\n\t\t\t\t\t\t\t<li class=\"deals-top__item\">\n\t\t\t\t\t<a class=\"deals-top__link\" href=\"https:\/\/netguide.io\/deals\/de\/deals\/the-clockwork-scarab-stoker-and-holmes-book-1-kindle-edition\/\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t<img class=\"deals-top__image\" src=\"https:\/\/netguide.io\/news\/wp-content\/uploads\/sites\/15\/2026\/09\/4982769_1-150x150.webp\" alt=\"\" width=\"52\" height=\"52\" loading=\"lazy\" \/>\n\t\t\t\t\t\t\n\t\t\t\t\t\t<span class=\"deals-top__body\">\n\t\t\t\t\t\t\t<span class=\"deals-top__name\">The Clockwork Scarab (Stoker and Holmes Book 1) \u2013 Kindle Edition<\/span>\n\n\t\t\t\t\t\t\t<span class=\"deals-top__meta\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<span class=\"deals-top__price\">Gratis<\/span>\n\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<s>0.01 \u20ac<\/s>\n\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<span class=\"deals-discount\">-100%<\/span>\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t<\/span>\n\n\t\t\t\t\t\t<span class=\"deals-top__temperature\">\n\t\t\t\t\t\t\t54\u00b0\n\t\t\t\t\t\t<\/span>\n\t\t\t\t\t<\/a>\n\t\t\t\t<\/li>\n\t\t\t\t\t<\/ul>\n\n\t\t\t\t\t<p class=\"deals-top__more\">\n\t\t\t\t<a href=\"https:\/\/netguide.io\/deals\/\">Alle Deals ansehen \u2192<\/a>\n\t\t\t<\/p>\n\t\t\t<\/aside>\n<\/div>\n<p>Via the script <code>bzrcdn.openai.com\/sdk\/oaiq.min.js<\/code>, a tracking pixel automatically extracts webpage content. The analysis identified four collection channels: advertiser inputs, form fields, page text, and tag managers. A total of 685 automatically collected data points were logged, compared to 255 events submitted manually by site operators.<\/p>\n<p>Data collected includes hashed\u2014i.e., cryptographically scrambled\u2014email addresses, phone numbers, and real names, alongside plaintext location data such as country, state or region, city, and postal code. Sensitive information such as passwords, payment cards, medical diagnoses, dates of birth, or one-time codes is not transmitted.<\/p>\n<h2>Hundreds of websites and sensitive URLs affected<\/h2>\n<p>The investigation documents a total of 936 OpenAI ad pixels across 1,029 hostnames and more than 23,900 observed URLs. Of 932 analyzed tokens, 736 could be directly linked to specific user accounts; 196 originated from anonymous sessions but nonetheless remained persistent for at least 27 days.<\/p>\n<p>During testing, twelve commercial platforms transmitted the exact same identifier, including prominent services such as HelloFresh, Eventbrite, Coursera, Wayfair, Chewy, and SeatGeek. Critically: While the system strips query parameters from URLs, directory paths remain completely visible. As a result, visited subpages in sensitive areas such as legal disputes, debt counseling, or medical services were also logged.<\/p>\n<h2>Background on the advertising push<\/h2>\n<p>The data collection is closely tied to the vendor&#8217;s commercial ambitions. After <a href=\"https:\/\/netguide.io\/news\/de\/2026\/08\/28\/openai-chatgpt-werbung-anzeigen-indien\/\" rel=\"nofollow noopener\">OpenAI tested ads in ChatGPT<\/a> across additional markets and recently tested <a href=\"https:\/\/netguide.io\/news\/de\/2026\/09\/16\/openai-testet-gesponserte-ki-agenten-in-chatgpt-mit-best-buy-und-shopify\/\" rel=\"nofollow noopener\">sponsored AI agents in ChatGPT<\/a>, advertisements for US users on Free and Go tiers launched as early as February. Advertisers there commit to minimum budgets of $200,000 at costs of around $60 per 1,000 impressions. Since August 24, 2026, these ads have also been rolled out to free-tier accounts in Germany.<\/p>\n<p>In its policy updated on September 10, 2026, OpenAI lists <code>__obi<\/code> purely as an analytics cookie, stating that advertisers do not receive access to chats or histories. However, the company left inquiries submitted by the researcher on September 14, 2026, unanswered. The analysis revealed that synchronization tokens were generated even when users had withheld consent for marketing purposes.<\/p>\n<h2>What users can do now<\/h2>\n<p>The test was conducted on an Android device using Google Chrome. Browsers such as Mozilla Firefox, Apple Safari, or Brave block third-party cookies out of the box, largely preventing synchronization. In Google Chrome and Microsoft Edge, third-party cookies remain enabled by default.<\/p>\n<p>Users can protect themselves with simple steps:<\/p>\n<ul>\n<li><strong>Block third-party cookies:<\/strong> Enable third-party cookie blocking in the privacy settings of Chrome or Edge.<\/li>\n<li><strong>Use tracking protection:<\/strong> Switch to browsers with built-in tracking protection (such as Firefox or Brave) or install ad-blocking extensions that filter requests to <code>bzrcdn.openai.com<\/code>.<\/li>\n<li><strong>Separate profiles:<\/strong> Use a separate browser profile or private browsing mode without being logged into ChatGPT for everyday browsing and research.<\/li>\n<\/ul>\n<p><em>Sources: <a href=\"https:\/\/borncity.com\/news\/chatgpt-cookie-__obi-openai-verknuepft-nutzer-ueber-936-pixel\/\" rel=\"nofollow noopener\" target=\"_blank\">Borncity.com<\/a><\/em><\/p>\n<div id=\"netgu-3570426408\" class=\"netgu-after-content netgu-entity-placement\"><script async src=\"\/\/pagead2.googlesyndication.com\/pagead\/js\/adsbygoogle.js?client=ca-pub-6258556257245998\" crossorigin=\"anonymous\"><\/script><ins class=\"adsbygoogle\" style=\"display:block;\" data-ad-client=\"ca-pub-6258556257245998\" \ndata-ad-slot=\"4559785002\" \ndata-ad-format=\"auto\"><\/ins>\n<script> \n(adsbygoogle = window.adsbygoogle || []).push({}); \n<\/script>\n<\/div>","protected":false},"excerpt":{"rendered":"<p>A security researcher has revealed how OpenAI&#8217;s __obi cookie can link browsing activity across hundreds of external websites to ChatGPT accounts. Users of standard web browsers are primarily affected.<\/p>\n","protected":false},"author":1,"featured_media":3094,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"site-sidebar-layout":"default","site-content-layout":"","ast-site-content-layout":"default","site-content-style":"default","site-sidebar-style":"default","ast-global-header-display":"","ast-banner-title-visibility":"","ast-main-header-display":"","ast-hfb-above-header-display":"","ast-hfb-below-header-display":"","ast-hfb-mobile-header-display":"","site-post-title":"","ast-breadcrumbs-content":"","ast-featured-img":"","footer-sml-layout":"","ast-disable-related-posts":"","theme-transparent-header-meta":"","adv-header-id-meta":"","stick-header-meta":"","header-above-stick-meta":"","header-main-stick-meta":"","header-below-stick-meta":"","astra-migrate-meta-layouts":"default","ast-page-background-enabled":"default","ast-page-background-meta":{"desktop":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"ast-content-background-meta":{"desktop":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"footnotes":""},"categories":[430],"tags":[2119,2997,1328,2118,1313,2995],"class_list":["post-3614","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cybersecurity-en","tag-chatgpt-en","tag-cookies-en","tag-cybersecurity-en","tag-openai-en","tag-privacy","tag-tracking-en"],"brizy_media":[],"_links":{"self":[{"href":"https:\/\/netguide.io\/news\/wp-json\/wp\/v2\/posts\/3614","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/netguide.io\/news\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/netguide.io\/news\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/netguide.io\/news\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/netguide.io\/news\/wp-json\/wp\/v2\/comments?post=3614"}],"version-history":[{"count":1,"href":"https:\/\/netguide.io\/news\/wp-json\/wp\/v2\/posts\/3614\/revisions"}],"predecessor-version":[{"id":3615,"href":"https:\/\/netguide.io\/news\/wp-json\/wp\/v2\/posts\/3614\/revisions\/3615"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/netguide.io\/news\/wp-json\/wp\/v2\/media\/3094"}],"wp:attachment":[{"href":"https:\/\/netguide.io\/news\/wp-json\/wp\/v2\/media?parent=3614"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/netguide.io\/news\/wp-json\/wp\/v2\/categories?post=3614"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/netguide.io\/news\/wp-json\/wp\/v2\/tags?post=3614"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}