OpenAI added an analytics cookie called “__obi” to ChatGPT that can track users’ activity on other websites. Cybersecurity researcher Buchodi examined the mechanism across thousands of sites for months and found that items searched for, viewed or purchased on a merchant’s website could be linked to a ChatGPT account. Cookies work through small pieces of data placed in the browser; advertisers use them to track online activity. Buchodi said the method is standard at companies such as Google and Meta, but that it has been seen for the first time in an AI chat product.
OpenAI expanded the advertising tests it launched in the US to the following countries:
- United Kingdom
- Mexico
- Brazil
- Japan
- South Korea
The company classifies the tracker under the “Analytics” category rather than “Marketing.” Buchodi’s submission was forwarded to the relevant departments for review. The tracking mechanism was observed in Chrome for Android and appears to be present only in free versions of ChatGPT.
Why it matters
The development raises the possibility that ChatGPT use may not be limited solely to chat content, and that some users’ behavior across different websites could be linked to it. This raises questions, particularly for people using free versions and accessing the internet through Chrome on Android, about the purposes for which data is collected and with whom it is associated. The mechanism being classified under Analytics rather than Marketing creates uncertainty over how the tracking activity is explained to users and whether consent processes are adequate. The expansion of advertising tests to different countries turns the issue from merely a technical implementation into a privacy matter affecting a broader user base. However, because the findings have not been independently verified, the scope and certainty of the implementation remain unclear.