ChatGPT browsing activity tracking: what AI builders need to know about the __obi cookie

OpenAI has started setting an analytics cookie called __obi that links your browsing activity across websites to your ChatGPT account, according to cybersecurity researcher Buchodi. For AI builders, this means any product or service built on ChatGPT's recommendation or personalization layer could be influenced by tracked browsing data, and it signals a shift toward advertising within AI chat interfaces.

How the __obi cookie works

The obi cookie was discovered by researcher Buchodi, who documented how it operates. When you visit a website that uses OpenAI's ad code, that code sets the obi cookie and sends data about the page you are browsing back to OpenAI. This includes products you are searching for, articles you are reading, and purchase behaviors. The cookie is tied to your ChatGPT account, allowing OpenAI to connect your browsing history to your identity.

More concerning: the tracking appears to continue even when you are logged out. Buchodi reports that OpenAI can track your activity as an "anonymous subject" for at least 27 days after you remove your ChatGPT account. OpenAI's support team acknowledged the inquiry but only promised internal review, with no immediate policy changes disclosed.

Why this matters for AI builders

If you build on ChatGPT's API or use ChatGPT for user-facing recommendations, this tracking introduces a new variable. User browsing history could influence the responses or suggestions they receive, potentially steering them toward sponsored content. The article describes this as preparation for more extensive ad services within ChatGPT.

For product teams, this raises a trust issue. Users who share sensitive information with ChatGPT may not expect their browsing activity to be linked to their account. If you are building AI tools that rely on user data, this is a reminder to design for privacy by default: minimize data collection, provide clear opt-outs, and avoid linking browsing behavior to user profiles without explicit consent.

Practical steps to block ChatGPT browsing tracking

You can mitigate this tracking today. The simplest approach is to deny non-essential cookies when you first access ChatGPT or through your account settings. Blocking third-party cookies in your browser also works. On iOS devices, third-party cookies are blocked by default regardless of browser. On Chrome for Android or Windows, you need to manually block third-party cookies in browser settings.

If you are building products that integrate with ChatGPT, consider adding a privacy notice or toggle that lets users opt out of any analytics or tracking that could be linked to their browsing history.

Caveats and what remains unclear

The evidence for this tracking comes from a single article and a researcher's blog post. OpenAI has not publicly confirmed or denied the advertising plans that the article speculates about. The __obi cookie mechanism is described but not independently verified by multiple sources. It is possible that OpenAI changes its approach or clarifies its policies soon. Builders should monitor official OpenAI communications rather than act on speculation alone.

For now, the safest approach is to treat ChatGPT as a data-collecting service and apply standard privacy practices: block third-party cookies, review cookie consent, and assume browsing activity may be linked to your account. If you are building AI products, consider how similar tracking could affect user trust and design opt-out defaults accordingly.