ChatGPT now knows what you do on other websites via ad collector
- ID
- 26640
- Status
- summarized
- Published
- 20 Sep 2026, 11:18 PM
- Fetched
- 23 Sep 2026, 12:47 AM
- Provider
- Hacker News
- Category
- dev-community
- Original URL
- https://www.buchodi.com/chatgpt-now-knows-what-you-do-on-other-websites-via-ad-collector/
- Source URL
- https://hnrss.org/best
Summary
- Score
- 7.0
- Created
- 23 Sep 2026, 12:48 AM
- Tags
- Audience
- developersai_agent_userssaas_founders
What happened
OpenAI's ad collector at bzr.openai.com sets a SameSite=none, HttpOnly cookie called __obi scoped to .openai.com while you use ChatGPT, tied to your account subject ID. Any site that installs OpenAI's ad pixel SDK causes your browser to send __obi back to OpenAI along with page content and purchase behavior, linking your off-platform browsing to your ChatGPT account. The author verified this across 936 advertiser pixels on 1,029 hostnames using two independent capture methods.
Why it matters
If you build sites or apps that embed third-party ad or analytics SDKs, understand that OpenAI's pixel works like Meta/Google tracking and will leak your users' browsing activity back to their ChatGPT identity. Builders shipping ChatGPT-integrated products or considering OpenAI's ads platform should evaluate consent and data-sharing implications before installing the SDK.
Discussion angle
What does this mean for Malaysian SaaS founders who might embed OpenAI's ad pixel or build on ChatGPT — are there PDPA exposure risks when user browsing data gets tied to a ChatGPT account without explicit cross-site consent?