ChatGPT's Hidden Cookie Tracks You Across the Web. How To Block It

A cookie connected to ChatGPT may allow OpenAI to link your account with activity on other websites, according to new independent research.

The cookie, named __obi, reportedly travels with you when you visit sites running OpenAI’s advertising pixel. That can tell OpenAI which products you browsed, which articles you read, and whether you completed a purchase or another action.^[1]

OpenAI lists the cookie in its privacy documentation. However, it classifies __obi as an analytics cookie rather than a marketing cookie, which could make it easy to approve without realizing how far it may travel.

Thanks for subscribing!

Please check your email for your first message.

Never miss the privacy news that affects you.

Join thousands who get the latest security news, scams, and policy changes every week, right to their inbox.

Sign me up

By submitting this form you agree to receive emails from All About Cookies and to the privacy policy and terms.

How ChatGPT’s tracking cookie works

The findings come from security researcher Buchodi, who analyzed traffic involving 936 OpenAI advertising pixels across 1,029 website hostnames.

When someone uses ChatGPT, the site can create an identifier and save it in the __obi cookie for up to one year. For logged-in users, the identifier is reportedly connected to their ChatGPT account. Logged-out users may receive a persistent anonymous identifier instead.

The connection follows users onto websites that have installed the ChatGPT Ads Measurement Pixel. The pixel is OpenAI’s version of the tracking tools already offered by companies such as Meta and Google.

Advertisers install it to determine whether someone who saw or clicked a ChatGPT ad later visited their website or made a purchase.

When the advertiser’s website loads OpenAI’s code, the browser may automatically send the __obi cookie back to OpenAI. Buchodi observed the same identifier traveling from 12 commercial websites, including Chewy, Wayfair, Eventbrite, HelloFresh, Coursera, and SeatGeek.

This does not mean ChatGPT can see everything you do online. OpenAI receives information only when you visit a site using its tracking technology, and the exact information collected depends on how that site has configured the pixel.

The pixel might collect more than purchases

OpenAI says its pixel measures events that can be attributed to ads shown in ChatGPT. Its documentation describes events including purchases, account registrations, subscriptions, and submitted leads.

Buchodi found that the pixel could also transmit the website’s domain and page path. Those paths sometimes exposed surprisingly sensitive context, including visits to a medical-condition page, a debt-relief funnel, and a legal intake form.

The researcher said URL query strings were removed before transmission. However, page paths alone can reveal plenty when a website uses descriptive addresses such as /debt-relief or /cancer-treatment.

OpenAI also offers advertisers an “automatic advanced matching” feature. According to OpenAI’s documentation, this feature can detect customer information on a website and send hashed versions of details such as email addresses, phone numbers, and names.

Hashing converts information into a scrambled string, but it does not necessarily make predictable information anonymous. A company can hash an email address it already knows and compare the result to find a match.

Buchodi also observed some location information, including city and postal code, being transmitted without hashing.

Why the “analytics” label?

OpenAI’s cookie policy describes analytics cookies as tools that help the company understand how its own services perform and how people interact with them.

The __obi cookie is the only cookie currently listed in that section. It lasts one year and can be used on ChatGPT.com and OpenAI.com.

However, the researcher found that the cookie was also being sent from unrelated advertisers’ websites. The tokens he analyzed referred to whether the user had allowed analytics cookies, even though OpenAI maintains a separate preference for marketing cookies.

That raises the possibility that someone could reject marketing cookies and still receive __obi after allowing analytics.

Buchodi contacted OpenAI about the findings. OpenAI Support acknowledged the report and said it would share the information internally, but it did not answer why __obi is categorized as analytics or whether refusing marketing cookies prevents the tracking.

How to block ChatGPT’s tracking cookie

The most reliable defense is blocking third-party cookies. This prevents your browser from sending an OpenAI cookie while you are visiting an unrelated advertiser’s website.

In Chrome on a computer:

1. Open Settings.
2. Select Privacy and security.
3. Select Third-party cookies.
4. Choose Block third-party cookies.

Chrome also blocks third-party cookies by default in Incognito mode. Google warns that blocking them can affect websites that depend on cross-site cookies, although you can create exceptions for individual sites.

You should also visit OpenAI’s cookie preferences and disable analytics cookies where available. After changing the setting, delete existing cookies and site data for chatgpt.com and openai.com to remove the current __obi identifier.

Firefox users can enable Strict Enhanced Tracking Protection, while Safari users generally have cross-site tracking protection enabled by default. WebKit, the browser engine used by Safari and all iOS browsers, blocks third-party cookies by default.

A reputable tracker-blocking extension may provide another layer of protection by preventing requests to OpenAI’s advertising domains. Remember that a VPN alone will not block this system because the cookie identifies your browser rather than relying solely on your IP address.

Bottom line

OpenAI’s advertising pixel behaves similarly to tracking systems that have followed people around the web for years. The difference is the account on the other end.

People routinely tell ChatGPT about their health, finances, relationships, and other matters they might never post on a social network. Connecting that account to activity on shopping, lending, medical, or legal websites creates a much more revealing digital footprint.

Blocking third-party cookies and clearing existing OpenAI site data can sever that connection. Until OpenAI explains why it categorizes a cross-site advertising identifier as analytics, clicking “reject marketing cookies” may not be enough.

#1 Adblocker — Even Blocks YouTube Video Ads

5.0

AllAboutCookies writers and editors score products based on a number of objective features as well as our expert editorial assessment. Our partners do not influence how we rate products.

Editorial Rating

Claim Deal

On Total Adblock's website

2026 Editors’ Choice

Best Overall Ad Blocker

Ad Blocker

Total Adblock

PROMOTION: Get 80% Off

• Top ad blocker that historically scores 100/100 on AdBlock Tester, passing every banner, interstitial, pop-up, and contextual ad test
• Successfully blocked YouTube ads in our testing, one of the trickier platforms for ad blockers to handle consistently
• Works across Chrome, Edge, Safari, and Opera, plus Android and iOS mobile apps

Author Details

Thomas Kent

About the Author

Thomas Kent is a multi-disciplined reporter with over a decade of experience covering online platforms, digital trends, and consumer-facing tech. Tom focuses on digital privacy, data tracking, and user behavior, with a particular interest in how cookies, online surveillance, and platform design shape the modern internet experience. His reporting takes a research-driven, news-focused approach, translating complex technical topics into clear, accessible insights.