OpenAI’s New Tracking Mechanism Revealed
Researchers have identified a persistent tracking cookie named __obi that ChatGPT sets in users’ browsers, enabling cross-site monitoring of activity beyond OpenAI’s own domains. The cookie, which remains active even after users leave chatgpt.com, can be read by third‑party websites and potentially used to build behavioral profiles for advertising or analytics purposes.
The discovery was detailed in independent analyses by ExplainX.ai and Notebookcheck, which traced how the __obi cookie is transmitted and accessed across unrelated web properties, raising concerns about undisclosed data collection practices in AI‑powered services.
__obi cookie: How OpenAI tracks you across sites
Building on those findings, the __obi cookie is set as a JSON Web Token (JWT) containing an encrypted identifier when a user interacts with ChatGPT, issued from the openai.com domain with attributes including SameSite=None and Secure, allowing it to be sent in cross‑site requests. Once established, the cookie is automatically included in subsequent requests to any third‑party resource loaded from pages where the user is authenticated, such as embedded scripts or tracking pixels.
Advertiser pixels and analytics tags on external websites can read the __obi cookie value and transmit it back to their servers, enabling the correlation of a user’s ChatGPT activity with their browsing behavior on unrelated sites. This flow allows OpenAI or affiliated parties to link conversational data with off‑platform actions, as noted in analyses of tracking mechanisms in AI services.
Data collected through this mechanism may include timestamps, page URLs, referral sources, and interaction events, which can be aggregated to infer user interests or habits. The use of JWT ensures the identifier is tamper‑resistant while remaining accessible to parties with the decryption key, facilitating persistent identification without relying on traditional cookie matching.
For further context on related developments, see coverage of OpenAI’s advanced voice mode rollout and independent reporting on AI‑driven tracking practices.
Key Facts
- The __obi cookie is set by OpenAI’s ChatGPT service and persists across browsing sessions.
- It is issued as a JSON Web Token (JWT) with an encrypted identifier from the openai.com domain.
- The cookie has attributes SameSite=None and Secure, enabling transmission in cross‑site requests.
- Its lifespan extends beyond the chatgpt.com domain, allowing third‑party sites to access its value.
- OpenAI has stated the cookie is used to maintain session integrity and prevent abuse, not for cross‑site tracking.
- Independent analyses confirm the cookie can be read by external scripts and correlated with off‑platform behavior.
Privacy Implications and What Users Can Do
These technical details highlight why the __obi cookie raises concerns about user privacy: it enables persistent identification across unrelated websites, potentially allowing behavioral profiling based on ChatGPT interactions. While OpenAI states the cookie is intended for session integrity and abuse prevention, its design—particularly the SameSite=None and Secure attributes—permits cross‑site transmission, a characteristic shared with certain third‑party tracking mechanisms used in advertising technology.
Users seeking to limit exposure can take several practical steps: blocking or deleting cookies from the openai.com domain, using browser privacy settings to restrict third‑party cookies, or employing tracker‑blocking extensions that prevent external scripts from accessing cookie data. Guidance on managing AI‑related tracking is available in resources such as the tutorial on ChatGPT data collection practices.
These privacy considerations come amid broader developments at OpenAI, including the testing phase of SearchGPT as a potential alternative to traditional search engines and ongoing enterprise adoption efforts supported by AI consultant hiring initiatives, which may influence how user data is utilized across emerging products and services.
Frequently Asked Questions
How can I view the contents of the __obi cookie and decode its JWT token?
You can open your browser’s developer tools, locate the __obi cookie under the openai.com domain, and copy its value. Paste the value into a JWT decoder (online tools or command‑line utilities like jwt‑decode) to see the base64‑decoded header and payload. The payload contains an encrypted identifier, but without OpenAI’s private key you cannot fully decrypt the identifier itself.
What browser settings or extensions can I use to block the __obi cookie from being set or sent in cross‑site requests?
In Chrome or Firefox you can block cookies from the openai.com domain via the site‑specific cookie settings and enable the “Block third‑party cookies” option. Tracker‑blocking extensions such as uBlock Origin, Privacy Badger, or Ghostery can also strip SameSite=None cookies like __obi. Using container tabs or private‑browsing modes further prevents the cookie from persisting across sites.
Does deleting the __obi cookie affect my ChatGPT session or functionality?
Yes, removing the __obi cookie will log you out of ChatGPT because the JWT is used to maintain session integrity. When you return to the service, a new __obi cookie will be created automatically. Any cross‑site tracking linked to the previous identifier will be lost, but normal ChatGPT functionality will resume after re‑authentication.
Last Updated on September 21, 2026 11:56 am by Laszlo Szabo / NowadAIs | Published on September 21, 2026 by Laszlo Szabo / NowadAIs
