Is ChatGPT Watching You Beyond the Chat?

A researcher has identified a cross-site tracking system linked to OpenAI's advertising ventures, centered around a cookie named '__obi.' This cookie, placed in a user's browser after visiting ChatGPT, can persist for a year and uses settings that allow it to be sent to OpenAI's advertising servers from other websites. Businesses using OpenAI's ad technology can embed pixels on their sites, enabling OpenAI to receive the '__obi' identifier when a user visits. This mechanism could potentially allow OpenAI to collect information about pages visited and conversion events on these participating sites.

The research indicates that the '__obi' identifier might be associated with logged-in users or be anonymous, with anonymous identifiers remaining stable for at least 27 days. While the researcher found the architecture makes it possible, they did not independently verify the server-side step of connecting this data directly to a user's ChatGPT account. OpenAI states that advertisers do not receive ChatGPT conversations or personal details and that user data is not sold. Advertisers receive aggregated reporting on ad performance.

This development raises questions about the flow of information back to AI platforms after users leave them, especially given that people discuss deeply personal topics with AI assistants. The research noted limitations, including testing primarily on Chrome on Android, and that Safari's protections would likely block this tracking method. The identifier was also not generated in every ChatGPT session.