Buchodi, who writes about what mobile apps actually do with your data, rebuilt OpenAI’s ad-tracking machinery on his own phone, verified it with two independent capture methods, and cross-checked the result against months of observed traffic. The finding is narrow and concrete: when a business buys ads on ChatGPT, the tracking code OpenAI gave it can tie the visitor’s browsing on that business’s own website back to the visitor’s ChatGPT account.

The mechanism, in plain terms:

  • ChatGPT’s front end asks OpenAI’s server for a short-lived signed token that binds your account to a random identifier. The token expires in 60 seconds.
  • That token is traded in for a cookie named __obi, set on the whole openai.com domain, lasting one year, and configured with the one browser setting a cookie needs in order to travel between websites.
  • Every site that runs OpenAI’s ad measurement pixel then sends that identifier back to OpenAI, along with data about the page and the visitor.
  • In the same requests, the browser refused every other OpenAI cookie. __obi was the only one built to cross sites.

The pixel also scrapes identity off the page it sits on — form fields, rendered text, and the tag manager’s shared data bus. In the observed traffic, scraped identity outnumbered what advertisers supplied on purpose, 685 events to 255. Emails, phone numbers and names are hashed before transmission; country, region, city and postal code are sent in the clear, with postal code the most-harvested form field. URLs were stripped of their query strings before sending, but the paths still arrived — including one pointing at a medical condition and another at a debt-solutions funnel.

How far it reaches:

  • 936 distinct advertiser pixels across 1,029 hostnames, observed over several months.
  • On one device, a single identifier was sent to OpenAI from 12 commercial sites, among them Chewy, Wayfair, ThriftBooks, Eventbrite, HelloFresh, Coursera and SeatGeek.
  • Signing out is not an escape. Of 932 decoded tokens, 196 were marked anonymous — and that anonymous identifier was as stable as the account one, persisting at least 27 days.
  • Automatic matching of visitors to identities was switched on for 638 of 881 pixels with a known setting, including every credit and lending advertiser observed. A denylist does exclude passwords, one-time codes, card numbers, SSN, date of birth, medical history, diagnosis and court fields.

The consent detail is the sharpest part. OpenAI’s cookie policy files __obi under Analytics — it is the only entry in that section — while the company runs analytics and marketing as two separate consent choices. Every token Buchodi decoded carried analytics_allowed. He wrote to OpenAI on 14 September asking why the cookie is classified as analytics, and whether someone who allows analytics but refuses marketing still receives it. Support acknowledged the inquiry, said the observations would be shared internally, and answered neither question.

He is careful not to oversell it. Every browser on iOS runs on WebKit, which blocks third-party cookies outright, so the mechanism does not work there; desktop Chrome is untested; and only about one ChatGPT session in five produced a token. He also does not claim to have watched OpenAI’s servers join the identifier to an account — he saw the events accepted, and the join follows from the design. In his own framing the technology is not the news: Meta built the structural equivalent years ago, and the whole thing is standard advertising machinery. What has no precedent is running it on an AI chat product, where people type things they would not put on a social network and the product increasingly acts on their behalf. And the advertisers themselves cannot see it: the cookie sits on a domain their scripts cannot read.

The 320-comment thread on Hacker News mostly skipped the outrage and went straight to what actually stops this, which is the part the article only gestures at.

What the thread adds

  • varenc — the cleanest technical read in the thread: for browsers that implement strict cookie partitioning, “the privacy concern is moot,” because the cookie jar used when chatgpt.com is a third party is separate from the one used when it is the first party, “so your chatgpt.com account can’t be linked to your ad views.” The essay’s Limits section notes iOS blocking; this generalizes it to the desktop.
  • jazzcomputer — the concrete countermeasure, two blocklist rules for anyone running an ad blocker: ||bzr.openai.com^$third-party and ||bzrcdn.openai.com^$third-party.
  • tgsovlerkhgsel and JoshTriplett — the same fix from the browser side, with a correction: the reason is Firefox’s separate cookie jars, and JoshTriplett adds that this is exactly why you also run an extension that blocks tracker scripts, since partitioning stops the join and blocking stops the collection.
  • luke5441, skybrian, kylecazar, arealaccount — a compact audit of the browser landscape, including a correction. luke5441 pointed at MDN’s list and said Firefox, Brave and Safari block third-party cookies while Chrome and Edge do not; skybrian replies that the linked page says Chrome blocks them only in Incognito or if the user turns it on in settings, and suggests running OpenAI in its own profile. kylecazar gives the short version (“Chrome still allows it. Safari and Firefox don’t.”). arealaccount is the person in the thread who assumed this had been solved years ago.
  • mokre — the pushback on treating partitioning as a cure: it does “not fully protect you,” because short-lived third-party identifiers can still be matched against a site’s own cookie or a device ID from a companion app. In their words, it is not one-to-one matching, but it “works relatively good with modern ITP.”
  • ryankrage77 — what the layered defence looks like in practice and where it ends: Pi-hole, an ad blocker and container tabs, and Firefox still reported over 2,800 trackers blocked that month alone. Their closing line is the honest one: “I wonder how many are still getting through.”
  • AznHisoka — the scale question, answered with a commenter’s source rather than the article’s data: sites carrying ChatGPT ad trackers are “on track to be doubled from last month,” citing Bloomberry. It is a third-party number quoted in a comment, not something the essay measured.
  • mavsman — why the piece landed for people who have known the mechanism for years, quoting the article’s own line about standard adtech on an unprecedented product, then: “I still feel icky anytime I re-read the details of it.”

Where the thread pushes back

  • The dominant objection is that this is not news. Legend2440 (“the same kind of tracking that Facebook, Google, etc have been doing for decades?”), stingraycharles (retargeting, “about 2 decades at this point”) and ben_w (“I’m old enough to remember when people had expectations of privacy on Facebook”) all make that case. The counter-argument in the thread is about context rather than mechanism: 1saadcodes argues people hold entirely different privacy expectations when talking to an AI than when scrolling Facebook, and emptybits, robots0only, dofm and gizmodo59 circle the awkward part — that people are paying OpenAI a subscription while being tracked, with gizmodo59 noting paid Google and Meta tiers collect the same data anyway.
  • gentlewater supplies a firsthand counterexample to the idea that the defences are reliable: they opened an AI service in Incognito specifically to avoid it in their search history, still had a tracker fire to Meta, and had their home IP matched to their Facebook account and used to fill their feed with ads for that service. Their question — “which defense do normal people have against this?” — is the article’s question in a sharper form.
  • The EU’s role splits the thread. thih9 is glad legislation is fighting these practices; dmix answers that the data-broker business “is still very lively in EU” and that a decade of privacy work has produced “modest at best” gains, linking two studies. Both are commenter assessments, not measurements.
  • One subthread attacks the essay rather than the tracking: duhhhhh1212 linked a Pangram result claiming the post reads as AI-generated and asked the author to “use your own words”; handoflixue and abhis3798 pushed back, the latter noting the post is informative regardless. The detection claim is unverified here and the piece is a first-person packet-capture writeup.

On reading comments as evidence: HN handles are pseudonymous, the site publishes no per-comment scores, so the ordering above is HN’s own ranking and not a vote. The tracker counts, the EU assessments and the AI-detection claim are commenter claims, quoted as claims. This is a slice of a 320-comment thread, not a consensus.