Researcher: ChatGPT's __obi cookie links your off-site shopping data back to your account
新智元 · wechat · 2026-09-21
Independent researcher Buchodi published an investigation (573 points on HN) showing that on Android Chrome, ChatGPT plants a year-long obi cookie under .openai.com with SameSite=none. OpenAI's ad-tracking pixel on merchant sites like Chewy, Wayfair and HelloFresh sends that cookie back along with page paths, countries, cities and plaintext ZIP codes, potentially tying your off-site browsing and purchases to your ChatGPT account.
Key findings: logged-out users get a device-level anonymous ID that persists 27 days; the cookie is classified under the "data analytics" toggle, so turning off "advertising" doesn't block it; Safari and iOS users are unaffected; and the researcher can only prove data reaches OpenAI's servers, not that it is actually joined to accounts. OpenAI did not directly answer his questions. The technique mirrors Facebook's Pixel era, but merging chat history with off-site shopping data into one account is a new privacy frontier.
Related event: ChatGPT Accused of Cross-Site Tracking via __obi Cookie(3 posts)→
More from Safety
- Safety researchers blast OpenAI/Anthropic plan: automating alignment research with possibly misaligned AI — trevposts · 2026-11-12
- OpenAI finds models are getting harder to monitor through their chain-of-thought — xiamengzhou · 2026-11-12
- New York's RAISE Act takes effect, forcing OpenAI and Anthropic to register and report incidents — emmanuelvivier · 2026-11-12
- Gemini won't let you keep chat history while opting out of AI training — Google bundles both into one setting — arshdeep · 2026-11-12
- French public WiFi warning: torrent piracy could cost you EUR 7,500 — michalmalewicz · 2026-11-12
- Dan Robinson flags contradiction: China race rhetoric vs loosening GPU export controls — Puzzleheaded-King584 · 2026-11-12