OpenAI Built a Cross-Site Tracker. It Filed It as Analytics.

Last Saturday, a researcher published the architecture of something OpenAI has never announced. When a browser running ChatGPT visits any of the 936 advertiser sites in OpenAI’s ad network — Chewy, Wayfair, HelloFresh, Coursera, SeatGeek — it fires a signed JWT token to bzr.openai.com, a domain belonging to an OpenAI advertising product named Bazaar. That token, valid for sixty seconds, is issued by OpenAI’s own backend and binds your ChatGPT account identifier to whatever you do on that page. The cookie it creates — __obi — is classified in OpenAI’s consent framework as an analytics cookie, not a marketing one. On Wednesday, September 23, Sam Altman will brief the United Nations Security Council on AI safety and the need for international coordination. Those two facts belong in the same paragraph.

The Bazaar Mechanism

The three steps are documented in the investigation published by buchodi.com on September 20. Step one: ChatGPT calls its own backend at /backend-api/bazaar/obi/sync-token, which returns an RS256 JWT with an issuer field labeled chatgpt-wadi and a sixty-second expiration window. Step two: the browser makes a cross-site POST to bzr.openai.com/v1/obi/sync, which sets the __obi cookie with SameSite=None; Secure flags — configuration that explicitly tells browsers to attach this cookie to cross-domain requests. Step three: every page running OpenAI’s advertiser pixel reads __obi and ships it back to OpenAI servers alongside whatever the SDK extracted from that page.

The SDK extraction is where the full scope becomes visible. OpenAI’s advertiser pixel, loaded from bzrcdn.openai.com, does not just log a conversion event. In the version active before August 27, it automatically collected four categories of data from every page it ran on: advertiser-supplied values, form field contents, rendered page text, and tag-manager bus data. The researcher ran a controlled analysis across those 936 advertiser pixels spanning 1,029 hostnames. Scraped identity events — data the SDK extracted automatically — numbered 685. Deliberately passed identity events, where advertisers explicitly provided user data, numbered 255. The ratio means that for most of what OpenAI received, neither the user nor the advertiser chose to send it; the SDK collected it on its own.

What that collected data included: email addresses, phone numbers, postal codes, and URL paths revealing medical conditions, debt counseling intake, and litigation interest forms. Location data was transmitted unencrypted — not hashed, not obfuscated, raw. Then on August 27, SDK version 0.1.31 narrowed the automatic collection: names and geography were removed. OpenAI made no public disclosure of that change. The narrowing happened three weeks before the researcher published. That gap is evidence of internal detection, not external exposure. Someone at OpenAI knew what the SDK was collecting, decided to reduce scope, and said nothing to users or advertisers. The scope narrowing was a product decision made in private. It took an outside researcher to make it public.

The Consent Architecture

OpenAI’s public developer documentation for the Measurement Pixel describes a consent framework. Advertisers can disable tracking for a user. The docs state that when consent is set to false, the pixel does not send measurement-event pings. The documentation also asserts that raw customer information is not sent to OpenAI — that identity data is securely hashed in the browser using SHA-256.

Both claims describe the advertiser-side pixel SDK. Neither one governs the __obi identity sync that runs inside ChatGPT itself.

The __obi sync is classified in OpenAI’s browser consent dialog as an analytics cookie. This is not a semantic quirk. Consent frameworks — GDPR in Europe, and CCPA-derived frameworks in the US — split browser storage into distinct categories. Analytics covers understanding how users behave on a first-party site. Marketing covers tracking users across sites to target or attribute advertising. The categories exist separately because regulators concluded these represent different levels of privacy intrusion warranting different levels of user control. When a user declines marketing cookies, analytics proceed. OpenAI’s implementation places the mechanism that links ChatGPT account identities to cross-site browsing behavior into the analytics category, which survives marketing rejection. An independent analysis found no setting that disables it despite its cross-site tracking function. OpenAI’s cookie consent tool presents __obi to users as analytics. Users reasonably interpret analytics consent as covering site performance measurement, not cross-site behavioral profiling tied to their ChatGPT account.

The developer documentation’s SHA-256 hashing claim also has a timing problem. Location data was being transmitted unencrypted until August 27. That transmission contradicts the claim that raw customer information is not sent to OpenAI. Location is customer information. Transmitting it unencrypted is transmitting it raw. The documentation either describes a standard the product was not meeting, or it describes the advertiser-configurable pixel fields while the SDK auto-scraped different data under a different regime. Either way, the claim and the behavior did not match for at least the period the investigation covered.

The researcher emailed [email protected] and [email protected] on September 14. OpenAI Support acknowledged the inquiry. Neither question — why is __obi classified as analytics rather than marketing, why does the consent control not govern the identity sync — received a substantive answer.

Why the Context Changes the Calculus

The honest version of the defense is that cross-site tracking pixels are standard infrastructure. Meta’s pixel runs on tens of millions of sites. Google’s conversion tags are embedded in nearly every checkout flow. The mechanism OpenAI built — identity synced from a first-party domain, linked to cross-site behavior via an advertiser pixel — follows the same architecture the entire performance-advertising industry operates on. That observation is accurate, and it is the right place to start the counter-argument. The mechanism is not exotic. What matters is what the mechanism is pointed at.

What the standard defense misses is that the risk profile is determined by the first-party context, not just the mechanism. Users tell ChatGPT things they do not write in public places. That is precisely what makes the product valuable — people are more forthcoming with it because the interface implies a private conversation. Medical diagnoses, debt situations, legal questions, mental health disclosures — these are exactly the queries where a capable AI assistant provides genuine value, and exactly the conversations users would not post to social media or type into a Google search bar. The URL paths the SDK was collecting until August 27 included paths showing medical conditions, debt solutions, and litigation intake forms. A user who described a health situation to ChatGPT and then visited the medical intake site running OpenAI’s pixel has had those two data points linked at the ChatGPT-account level. The exposure is structural.

The argument that every ad company does this also stops making sense applied to a company that has spent two years arguing it is categorically different from every ad company. OpenAI’s pitch to regulators, to the UN Security Council this week, and to the press consistently positions it as safety-focused and user-protective in ways that justify unusual levels of public trust and regulatory deference. The __obi cookie does not disqualify that positioning entirely — running an ad product is legal, and OpenAI disclosed the advertising business through its developer portal. But classifying the user-side identity sync as analytics, which makes it invisible to marketing consent refusals, is the specific move that erodes the basis for that trust. You do not earn a safety-lab designation by reclassifying surveillance under the category that survives rejection.

The Name of the Product

OpenAI named this product Bazaar. It has a developer portal with documentation. It has a JavaScript SDK with a versioned release history. It has dedicated domains — bzr.openai.com and bzrcdn.openai.com — that serve no other purpose. As of the investigation’s publication, it operates across 936 active advertiser pixels on more than a thousand hostnames. This is a production advertising platform that has been running since at least August 2026. The researcher who documented its architecture was not a disgruntled employee or a hostile party. The information was visible in standard browser developer tools to anyone paying attention.

The question the __obi incident puts on the table is not whether OpenAI should run an ad business. The question is whether the consent classification for the __obi cookie reflects an honest characterization of what the cookie does, or an expedient one. A cookie that fires in roughly 20% of ChatGPT sessions, persists for a year, and links ChatGPT account identities to commercial browsing behavior across hundreds of websites is not performing analytics on how users navigate openai.com. It is enabling cross-site attribution for an advertising platform. What it does and what it is labeled are not the same thing, and OpenAI has declined to explain the gap.

On Wednesday, Sam Altman will address the UN Security Council and emphasize, per the OpenAI spokesperson’s statement, the steps OpenAI is taking to ensure AI is safe and benefits people globally. The __obi cookie was set in user browsers three weeks before his opening remarks were drafted. The SDK scope was already narrowed. The reporter’s questions were already unanswered. The consent category will remain analytics. The product will keep running. And in forty-eight hours, its creator will explain to the world why AI companies should be trusted.

AI-generated editorial illustration · TemperatureZero · September 21, 2026