Skip to main content

OpenAI's Hidden Ad Tracking: Your ChatGPT Account Is Watching You Browse

OpenAI's Hidden Ad Tracking: Your ChatGPT Account Is Watching You Browse

Imagine this: you're chatting with ChatGPT about weekend plans, then later you're browsing a travel site. Unbeknownst to you, that travel site visit gets quietly linked back to your ChatGPT account. Sounds like a paranoid fantasy? Well, it's not. A security researcher has just exposed a cross-site tracking chain built by OpenAI's internal ad platform, codenamed "bazaar."

How the Tracking Works

When you open ChatGPT, the client generates a random identifier and grabs a JWT token tied to your account. Then it plants a cross-site cookie named "__obi" in a cross-site environment. Think of it as a digital breadcrumb. Later, when you visit third-party sites that have OpenAI's ad pixel embedded, that cookie lets OpenAI connect your browsing behavior directly to your ChatGPT identity.

Here's the kicker: this doesn't require you to have ever typed anything about those topics in ChatGPT. Even if you've never mentioned travel, shopping, or health in the chat window, just visiting a site with the pixel is enough. Your entire web footprint outside the chat interface gets swept into the profile.

The finding shot to third place on HackerNews' popular list and has sparked heated debate among developers. Many are calling it a worst-case scenario for privacy—one that turns a conversational AI into a silent surveillance tool.

Why This Matters

OpenAI has positioned ChatGPT as a helpful assistant, not an ad network. But this revelation suggests the line between the two is blurring. If your browsing habits are being tied to your account, what else might be collected? And who gets access to that data?

For everyday users, the takeaway is simple: your ChatGPT account may be more connected to your web life than you think. The company hasn't issued a public response yet, but the developer community is already demanding answers.

Key Points

  • OpenAI's internal ad platform, "bazaar," uses a cross-site cookie called "__obi" to link your ChatGPT account to third-party browsing.
  • A JWT token and random identifier are generated when you open ChatGPT, enabling the tracking.
  • No chat interaction is needed—just visiting a site with OpenAI's ad pixel triggers the association.
  • The discovery is trending on HackerNews and raising serious privacy concerns.
  • OpenAI has not yet commented on the findings.