ChatGPT is OpenAI’s conversational AI product; its Measurement Pixel is an advertising tag that companies install on their websites to report visits or conversions back to OpenAI’s ad system. A September 2026 Buchodi report says OpenAI can use a cookie named `__obi` to connect activity on those advertiser sites with a ChatGPT identity. This is the researcher’s account of browser behavior, not a result independently verified by OpenAI.
The researcher’s report is the source of the proposed token, cookie, and account-linking mechanism described in this paragraph.
The proposed mechanism starts when ChatGPT requests a short-lived signed token. The token contains an internal advertising identifier and, for a signed-in user, an account subject. It is converted into `__obi`, a cookie on `.openai.com` that lasts one year and is configured to be sent across sites. When an advertiser loads OpenAI’s pixel script, the browser can send that cookie to OpenAI before the script itself runs. The report says a logged-out device can also receive a stable identifier, but it does not establish that anonymous identifier as the same thing as a named account.
The pixel may also send identity signals supplied by the advertiser or collected from the page. According to the report, email addresses, phone numbers, and names are SHA-256 hashed—a one-way transformation—while location details can travel in readable form. URLs are said to lose their query strings but retain their paths, so a page path could still reveal the kind of funnel visited without exposing every URL parameter. The researcher observed these fields in network traffic; the packet does not prove that every advertiser sends them.
A key reader concern is whether refusing marketing consent stops this. The report says every decoded sync token recorded `analytics_allowed`, even where marketing was refused, and that OpenAI’s cookie policy lists `__obi` as an analytics cookie lasting one year. OpenAI’s supplied Measurement Pixel documentation confirms the advertising system and its conversion-tracking purpose, but the supplied excerpt does not independently confirm the cookie’s cross-site behavior or the consent interaction. OpenAI Support acknowledged the researcher’s questions without answering them.
OpenAI’s documentation confirms the Measurement Pixel and its advertising purpose, while the article distinguishes that from the researcher’s browser-test claims.
The documentation is the official source cited for the pixel’s existence and conversion-tracking role, not for the reported cookie behavior.
The practical effect is limited but important: on Chrome for Android, the reported identifier appeared on requests from multiple commercial sites, including retailers and ticketing services. The researcher did not observe OpenAI’s server-side matching, so the final account join remains inferred from the token and cookie design. The report also says Safari, iOS browsers, and some Chrome sessions may block or skip the mechanism. What remains uncertain is the full browser coverage, the exact account-matching process, and whether OpenAI changes the implementation after review.