OpenAI Built Ad Tech's Worst Habit Into ChatGPT — And Called It "Analytics"

#privacy #security #ai #webdev

The claim that started this

This week a researcher going by Buchodi published a teardown of bzr.openai.com — the domain behind OpenAI's ChatGPT Ads Measurement Pixel — and the HN thread it spawned (715 points, 382 comments) is the most-engaged story on the site today. Not the new Qwen release. Not Samsung's HBM4 numbers. A cookie.

That should tell you something. Engineers can smell it when a company reaches for the oldest trick in ad tech and wraps it in an SDK.

What's actually happening, mechanically

Strip the marketing copy from OpenAI's own pixel docs and cross-reference it with what Buchodi captured on the wire, and you get this flow:

1. ChatGPT mints you an identity token.

The client generates 16 random bytes and POSTs to /backend-api/bazaar/obi/sync-token. Back comes an RS256 JWT:

{
  "iss": "chatgpt-wadi",
  "aud": "bzr.openai.com",
  "sub": "<64-hex account id>",
  "obi": "<22-char tracking id>",
  "exp": 60,
  "consent_decision": "analytics_allowed"
}

Sixty seconds to live. Just long enough to do one thing.

2. That token buys a cookie that outlives it by 31,536,000 seconds.

The client POSTs the JWT to bzr.openai.com/v1/obi/sync, which sets __obi — a year-long, SameSite=None; Secure, HttpOnly cookie scoped to .openai.com. Read that attribute combination again: SameSite=None exists for exactly one reason, and it isn't first-party analytics.

3. Advertisers drop OpenAI's script on their own sites.

Same integration pattern as Meta Pixel or Google Tag Manager — a snippet in <head>:

<script>
  window.oaiq = window.oaiq || function(){(oaiq.q=oaiq.q||[]).push(arguments)};
  // async-load https://bzrcdn.openai.com/sdk/oaiq.min.js
  oaiq("init", { pixelId: "<YOUR-PIXEL-ID>" });
  oaiq("measure", "order_created", { amount: 42.00, currency: "USD" });
</script>

Loading that script sends __obi back to OpenAI, along with page context. Buchodi's SDK teardown found four extraction paths feeding the payload: in (advertiser-supplied fields like email/name), fm (scraped form inputs), ht (rendered page text), and js (tag-manager event bus interception). Email, phone, and name get hashed client-side. Country, region, city, and postal code go over in cleartext.

The kicker: scraped identity outnumbered advertiser-supplied identity 685 events to 255 in the sample. OpenAI isn't just accepting what advertisers hand it — the SDK is out there reading your page.

4. It works even if you've never touched ChatGPT.

Of 932 decoded sync tokens Buchodi captured, 736 carried subject_type: account_user — but 196 were anonymous, meaning OpenAI still assigns a persistent per-device ID, good for at least 27 days, to people who have zero ChatGPT account. You don't opt in. You just load a page that happens to have the pixel on it.

One __obi value was seen arriving at OpenAI from 12 different commercial sites — Chewy, Wayfair, HelloFresh, Eventbrite among them — under 13 distinct pixel IDs. That's cross-site identity resolution, the exact mechanism that got Meta and Google a decade of regulatory scar tissue.

The tell is in the field name

consent_decision: analytics_allowed. Not marketing_allowed. Not advertising_allowed. Analytics.

That's not a technical detail, it's a legal one. Under GDPR/ePrivacy, "strictly necessary" and "analytics" cookies get looser consent requirements than "marketing" cookies in a lot of consent-management implementations. If a cross-site, SameSite=None, year-long identity cookie that feeds an ad-conversion pipeline gets classified as "analytics," a huge number of sites' cookie banners will wave it through without ever showing the user a marketing opt-out.

When researchers asked OpenAI directly (1) why __obi is classified as analytics rather than marketing, and (2) whether users who deny marketing consent still receive it — the company acknowledged the inquiry and answered neither question. Draw your own conclusion from that silence.

Why this matters even if you don't work in ad tech

If you're integrating the ChatGPT Ads Measurement Pixel into a product right now — and plenty of people are, it rolled out to the US, UK, Canada, Australia, Japan, South Korea, and 31 European markets between August and September — you are the one who ends up holding liability for a cookie whose consent semantics OpenAI won't clarify. __oppref and __obref, the pixel's first-party cookies, are yours to defend in front of a DPA, not OpenAI's.

And if you're building anything that touches ChatGPT's ecosystem as a user rather than an advertiser — a browser extension, a proxy, a privacy tool — this is your reference architecture for what "OpenAI knows about you" now includes: not just your prompts, but your Wayfair cart and your HelloFresh subscription, correlated to the same account, for a year.

The fix, if you're the one shipping the pixel

Don't trust the vendor's consent bucketing. Classify __obi/__oppref as marketing in your own CMP regardless of what OpenAI's docs imply. Get affirmative opt-in before the script loads, not after.
Call oaiq("consent", false) by default, and only flip it after your own consent gate fires. The docs confirm this removes __oppref and __obref — but consent defaults to true if you don't set it, which means the SDK ships wide open unless you explicitly close it.
Audit what fm and ht are actually scraping on your pages before you assume you know what the pixel sends. "Rendered page text" and "form field scraping" on a medical intake or litigation form is not a hypothetical — Buchodi's report names those exact funnel types as observed paths.
Load the SDK after consent, not before. OpenAI's own install instructions tell you to put it high in <head> "so early conversions aren't lost." That's optimized for their conversion numbers, not your compliance posture.

Ship fast, sure. Just don't let someone else's ad SDK decide your legal exposure for you.

Sources: Buchodi's technical writeup, OpenAI Measurement Pixel documentation, Hacker News discussion.

DEV Community