OpenAI sets cross-site __obi cookie via ChatGPT advertiser pixels

A researcher reproduced how OpenAI's ad collector at bzr.openai.com sets a one-year __obi cookie with SameSite=None tied to a ChatGPT account, which is then sent back to OpenAI from ordinary sites running advertiser pixels. The check covered 936 pixels across 1,029 hostnames; the cookie also worked for logged-out users, and refusing marketing cookies did not stop it.

• __obi lasts one year, uses SameSite=None and is scoped to .openai.com
• 936 pixels across 1,029 hostnames checked; 12 of 30 __obi values appeared under multiple advertisers
• 736 of 932 sync tokens were account-bound, 196 anonymous
• Refusing marketing cookies did not help: all tokens carried analytics_allowed