ChatGPT Now Knows What You Did on 1,029 Other Websites, Would Like to Talk About the Sandals
The cookie is called "__obi," lasts one year, and is set by a service OpenAI internally calls "bazaar," the most honest branding in the industry.
SAN FRANCISCO — OpenAI's advertising system now sets a year-long cookie tied to a user's ChatGPT account that is sent back to the company from any website carrying its ad code, according to an analysis published Sunday that identified 936 advertiser pixels across 1,029 hostnames, all of which can now tell ChatGPT what you were doing there.
"Users have always been able to tell ChatGPT about themselves," said a company spokesperson. "Now they do not have to."
The mechanism works the way Meta's and Google's have for a decade: an advertiser installs a snippet, the snippet phones home, and the home is now a chatbot that has read your diary.
"I looked at a pair of sandals on Tuesday," said Marisol Ibarra, a privacy engineer who reproduced the mechanism on her own phone. "On Wednesday I asked ChatGPT to help me write a eulogy and it asked whether the deceased had been a size nine."
The company's own consent record for the system reads "analytics_allowed," a decision the spokesperson said users made "at some point, under a policy version we have given a name." The cookie carries a "SameSite=none" attribute, which engineers describe as the browser equivalent of a house key that works on every house.
"Meta did this. Google did this," said a 22-year veteran of the ad-tech industry who asked not to be named. "The difference is those companies never sat across a table from you and asked how your day was going. This one does, and now it knows, and it is nodding."
OpenAI said the data is used only to improve ad relevance, and that the model does not see it directly, a distinction the company compared to a waiter who does not read your texts but has been told what was in them.
At press time, the cookie had 364 days remaining.