OpenAI is testing a persistent cross-site identifier inside ChatGPT ads. The cookie is called __obi. It can live in a browser for up to a year and reappear on every advertiser site that runs OpenAI's ad pixel. Independent researcher Buchodi published the finding on September 23, 2026. If you run ChatGPT ads, you are now part of a measurement system you did not design and may not have audited.

What __obi actually does

The cookie is set when a user visits ChatGPT. When the same browser later lands on a site using OpenAI's advertising pixel, the requests sent back to OpenAI can carry the same identifier plus page and conversion data. Buchodi did not observe the final server-side step that would join that activity to a named ChatGPT account, so the full join from off-site action to identifiable user is not yet proven. What is proven is that one OpenAI identifier travels from ChatGPT into participating advertiser sites and back to OpenAI. That is, mechanically, a third-party cookie in a new wrapper.

For a marketer who has been told that the death of the third-party cookie is the central story of the decade, this lands strangely. The technology you spent the last three years redesigning attribution to avoid is now arriving inside the channel you just added to your media plan. The upside is real: ChatGPT ad performance has had almost no post-click measurement, and a stable cross-site identifier gives OpenAI a way to close that loop. The cost is also real, and it is paid in consent, not impressions.

Why the analytics label matters

OpenAI lists __obi as an analytics cookie. Buchodi's testing suggested the cookie could be set when a user had granted analytics consent but declined marketing consent. That distinction is the entire fight. Users have a reasonable expectation that an analytics-only choice means product or site measurement, not cross-site advertising attribution. OpenAI has not, as of the research publication, publicly answered why the cookie carries that label or whether analytics-only consent was meant to cover the reported behavior.

If you are a marketer running ChatGPT ads, that gap is yours to close. Your consent management platform probably treats OpenAI's cookie class the way OpenAI labels it. Your vendor due-diligence questionnaire probably asks whether the partner respects user choice. The answers your CMP and your vendor packet will give you are now, at best, ambiguous. The answers your privacy team will want are specific.

What regulators will look at first

ChatGPT users share more personal information in a single prompt than most people share with a search engine in a month. That volume of volunteered context is exactly what makes an off-site identifier attached to it different from a third-party cookie set by an ad network on a news site. The EU AI Act, the FTC's evolving ad-tech work, GDPR, and the UK's ICO have all asserted jurisdiction over behavioral advertising systems that process personal data. A persistent identifier that travels from an AI assistant to advertiser domains and back is the kind of system each of those regulators can describe in one sentence.

What to actually do this week

  • Treat __obi as marketing-class data in your CMP, regardless of how OpenAI labels it. Reclassify the cookie to your marketing category and force a consent refresh for existing users if your vendor supports it.
  • Pull your last 30 days of ChatGPT ad conversions and ask your agency what identifier linked the off-site event back to OpenAI. If the answer is "we trust OpenAI's reporting," that is the answer you fix first.
  • Update your vendor security questionnaire for ChatGPT ads with three questions: where is __obi set, what consent category gates it on your CMP, and does OpenAI retain the identifier after a user deletes their ChatGPT account. Document the response.
  • Brief your privacy and legal teams before the next campaign review. The consent story you have for Google and Meta ads is not the consent story you have for ChatGPT ads, and pretending otherwise is the audit finding you do not want.

Sources