ChatGPT now knows what you do on other websites via ad collector

A technical investigation reverse-engineered OpenAI's advertiser-facing tracking pixel and found a signed __obi cookie that syncs a user's ChatGPT account identity with browsing and purchase activity on any site running OpenAI's ad SDK. The researcher reproduced the behavior across close to 1,000 advertiser hostnames, showing the linkage isn't a one-off integration but a standard mechanism deployed at scale. The cookie ties chatgpt.com sessions to bzr.openai.com, OpenAI's ad-serving domain, effectively giving OpenAI visibility into what a ChatGPT user does and buys well outside the chat interface itself. For engineers and teams building on top of ChatGPT, or advising clients who use it, this is a concrete change in what OpenAI collects and can correlate, not a hypothetical privacy risk. It also raises data-handling questions for any product embedding OpenAI's advertiser SDK, since doing so can expose visitor behavior to a linked ChatGPT identity. Worth checking whether any site in your stack runs the ad pixel and what that implies for user data already collected.