ChatGPT Ad Collector: What It Means [How to Limit]

On some devices, yes – OpenAI can associate activity on advertiser sites with a ChatGPT identity through an ad-collector cookie called __obi. Not every session, not every phone, and not because your prompts get shipped to brands. The path is measurement pixels on the open web plus a cross-site cookie that starts on OpenAI’s domain.

This is ordinary ad measurement sitting on an AI chat product. That placement is what makes people flinch.

Why the usual privacy toggles fall short

Marketing Privacy off. Ad personalization off. Good hygiene for how OpenAI promotes itself on partner properties and for ranking sponsored units inside chat. Wrong primary lever for the collector.

Per OpenAI’s cookie policy (updated September 10, 2026), __obi is listed under Analytics, not Marketing – one-year lifetime on chatgpt.com / openai.com domains. Independent decoding of sync tokens (Buchodi’s write-up) showed consent_decision: analytics_allowed even when marketing consent was refused. Grant analytics, refuse marketing, and the collector cookie can still sync.

OpenAI’s separate claim still stands in the Ads in ChatGPT help article: conversations are not shared with advertisers. Free and Go may see ads; Plus, Pro, Business, Enterprise, and Edu are ad-free. The collector question is what happens after you leave chat and hit a site running their measurement code.

How the collector links you

Flow, from the public teardown plus OpenAI’s Measurement Pixel docs:

1. On chatgpt.com the client requests a short-lived JWT binding your account subject – or an anonymous device subject – to an obi value.
2. That value is stored as __obi on .openai.com with HttpOnly, SameSite=None, Secure, Path=/, Max-Age=31536000 (one year). Those flags are why the browser may attach it on cross-site calls.
3. Advertisers install the pixel SDK from https://bzrcdn.openai.com/sdk/oaiq.min.js. Events post to bzr.openai.com. Turns out loading the script alone is enough for the browser to send __obi on that GET – before SDK logic runs – so “credentials omitted” paths are not a full shield.
4. Page views and conversions can include path data; when advanced matching is on, email/phone/name go out hashed (SHA-256) while country/region/city/postal can go clear. Docs describe automatic scraping from forms/dataLayer and a denylist aimed at passwords, cards, SSN, and medical-diagnosis fields.

Install shape from the official docs:

(function (w, d, s, u) {
 if (w.oaiq) return;
 var q = function () { q.q.push(arguments); };
 q.q = [];
 w.oaiq = q;
 var js = d.createElement(s);
 js.async = true;
 js.src = u;
 var f = d.getElementsByTagName(s)[0];
 f.parentNode.insertBefore(js, f);
})(window, document, "script", "https://bzrcdn.openai.com/sdk/oaiq.min.js");

oaiq("init", { pixelId: "<YOUR-PIXEL-ID>" });

In one observed device trace, a single __obi value showed up across a handful of commerce hosts (pets, home goods, tickets, meal kits, courses, and similar). Passive capture in that same research pass counted on the order of 936 distinct advertiser pixels across about 1,029 hostnames – figures from that write-up, not an OpenAI transparency report, so treat them as a snapshot. Advertisers do not read __obi; it stays on OpenAI’s domain. They only dropped a tag.

Gating mattered in practice: only roughly one in five ChatGPT sessions in that testing produced a sync token. Mobile web can show ads without a sync. If you inspect cookies and find nothing, you may simply be outside the gated path – not proof the feature is off globally.

Anonymous subject_type tokens showed up too (on the order of ~196 of 932 decoded tokens in that set) and some persisted at least 27 days in observations. Logged-out does not always mean unlinkable forever.

Pro tip: If you block only two hosts, use bzr.openai.com and bzrcdn.openai.com. That cuts collector endpoints and SDK load without blocking chatgpt.com.

What you can do today

Three approaches. None is complete. Ranking for a Free or Go user who still wants the product:

1. Browser + cookie hygiene (fastest on desktop / Android Chrome)

• chatgpt.com → DevTools → Application → Cookies → find __obi under openai.com / chatgpt.com-related hosts → delete.
• Footer Manage Cookies / Your Privacy Choices (logged-out) or in-product cookie preferences: refuse analytics when the UI offers it. Re-check next session – sync can return.
• uBlock Origin (My filters) or similar: ||bzr.openai.com^ and ||bzrcdn.openai.com^.

The catch is platform-level: the chain was reproduced on Chrome for Android. Safari ITP and WebKit-based browsers on iOS block this third-party cookie path, so the same cross-site ride does not operate there. Desktop Chrome was not fully exercised in that research – check your own jar after a session instead of assuming.

2. Account controls (needed, still incomplete)

• Settings → Data Controls → Marketing Privacy – opt out of targeted promotion of OpenAI on third-party properties (official how-to).
• Settings → Ad Controls – turn off personalized ads and clear ads data if you use Free/Go and see sponsored units.

Those toggles still do not reclassify __obi away from Analytics. Marketing off ≠ collector off.

3. Plan and device strategy

Plus and Pro remove in-chat ads for your account. That kills the main reason you personally are the audience for those units. It does not uninstall pixels from the rest of the web. Browse a tagged retailer in a profile that still holds __obi from an older free session – cookie can ride until you delete it or the one-year max-age ends.

Separate browser profile (or a Firefox container) only for ChatGPT is the boring fix that keeps working: chat in one jar, shopping and news in another.

A real afternoon, mapped

You ask for weekend trip ideas. Under the reply, Free/Go in an eligible region, a ticket or meal-kit unit appears. You ignore it. Later a friend drops a retailer link; you open it in the same mobile browser. If that site runs the OpenAI pixel and __obi is still present, the collector can accept the event with your identifier attached. Same pattern on furniture, classes, pet supplies – nothing exotic in the observed set.

Is every hit joined server-side to your full chat history? JWT design (sub + obi) implies OpenAI can join. Public research confirmed 202 acceptance of events with the cookie – not the final backend join. Capability: treat as real. Retention and join rules: still thinly documented.

People tell chatbots things they never type into a checkout form. Same pipes as a lot of adtech; different diary.

Five-minute checklist

1. Note plan (Free/Go vs Plus/Pro) and open Ad Controls + Marketing Privacy.
2. Search cookies for __obi and delete.
3. Block bzr.openai.com / bzrcdn.openai.com on desktop blockers.
4. Android Chrome and privacy-sensitive shopping? Prefer a WebKit browser, Firefox Focus, or an iOS device for those tabs.
5. Expect gaps: no cookie after a session can mean gating (~1 in 5 sync rate in one test series), not permanent safety.

HN and social replies split between “classic adtech” shrugs and “not beside my AI diary.” Both fit. The steps above are what you can do without waiting on a policy rewrite.

Open settings now. Set Marketing Privacy and ad personalization where you want them. Add the two domain blocks before the next shopping tab. That pairing beats another teardown you never act on.

FAQ

Does opting out of Marketing Privacy stop the __obi collector?

No. __obi is an Analytics cookie in OpenAI’s September 10, 2026 policy, and decoded sync tokens still showed analytics-allowed when marketing was refused. Clear the cookie or block the pixel hosts.

I’m on iPhone – am I exposed the same way?

Not via this third-party cookie path. Reproduction was on Chrome for Android; WebKit on iOS blocks it. After any ChatGPT use on another device or desktop browser, still glance at cookies – profiles do not share a single fate.

If I upgrade to Plus, does OpenAI stop linking my off-site browsing?

Plus/Pro stop in-chat ads on your account. That is the cleanest way off the sponsored-unit treadmill. It is not a pixel uninstaller for the open web, and it will not vaporize an __obi already sitting in a shared profile (policy max-age: one year). Upgrade plus delete-cookie plus domain blocks is the tight practical stack. Chat content not going to advertisers remains OpenAI’s stated line; this FAQ is about measurement identity on tagged sites, not brands receiving your prompts.