ChatGPT Is Tracking You Across the Web, Here’s What a New Report Found

A security research group says it has found that OpenAI’s ChatGPT advertising system sets a browser cookie that follows signed in users onto other websites, tying their browsing on sites like Wayfair, Chewy, and HelloFresh back to their ChatGPT account. The group, Buchodi’s Threat Intel, disclosed the finding to OpenAI privately on September 14, 2026 and published it publicly on September 20, 2026.

Want to stop it right now? Follow our step-by-step guide on how to turn off ChatGPT ad tracking, which takes less than two minutes.

The tracking sits inside the same ad measurement pixel that OpenAI has been rolling out since ChatGPT Ads launched in the US in February 2026 and later expanded to Europe, the UK, and several other markets. Here is what OpenAI’s own documentation says the pixel is supposed to do, what the researchers say it actually does, who is affected, and how to check your own ChatGPT ad settings today.

Quick Summary

• A researcher group found that OpenAI’s ChatGPT ad measurement pixel sets a cross site cookie tied to a signed in ChatGPT account.
• The cookie was observed reporting back to OpenAI on advertiser sites including Wayfair, Chewy, HelloFresh, Coursera, and SeatGeek, according to the report.
• ChatGPT Ads currently reach Free and Go plan users. Plus, Pro, Business, Enterprise, and Education accounts do not see ads.
• OpenAI’s documentation says personal identifiers are hashed in the browser before reaching its servers and that advertisers do not see your chat history.
• You can review and limit ad personalization in ChatGPT under Settings, or avoid ads entirely on a paid plan.

What Happened?

OpenAI began testing ads inside ChatGPT for logged in Free and Go plan users in the US on February 9, 2026. By May 2026, it opened a self-serve Ads Manager so advertisers could run their own campaigns, and by the end of August it had expanded the ad pixel to 31 European markets plus the UK, Mexico, Brazil, Japan, and South Korea. OpenAI has said the ad business reached a $1 billion annualized run rate within 200 days of the pilot, part of a broader monetization and product push NexPloreInfo has been tracking in its AI Updates coverage.

According to the Buchodi’s Threat Intel report, the pixel that advertisers install on their own sites to measure ChatGPT ad performance is also setting a cookie the researchers refer to as __obi. The group says it observed this cookie active across 13 distinct advertiser pixel IDs on 12 commercial websites, and that it was able to decode 932 signed tokens, 736 of which were tied to a specific ChatGPT account rather than an anonymous browser.

How the Tracking Reportedly Works

The report describes a three-step process. First, ChatGPT generates a random identifier in the browser and requests a signed token from OpenAI’s servers that binds that identifier to the person’s logged in ChatGPT account. Second, that signed token is written into the browser as a cookie with cross-site transmission allowed. Third, when the person later visits any website running OpenAI’s ad measurement pixel, even without clicking a ChatGPT ad first, the browser automatically sends that cookie back to OpenAI along with whatever page data the pixel is set up to capture.

Worth noting: OpenAI’s own public developer documentation for the Measurement Pixel describes two first-party cookies by different names, __oppref (an attribution identifier that expires after 30 days) and __obref (a browser reference that expires after a year), and says the pixel is meant to send only hashed identifiers, not raw personal data. The __obi name comes from the researchers’ report rather than from OpenAI’s documentation, so it is best treated as the research group’s label for what it found rather than an officially documented cookie name. Both OpenAI’s own materials and the outside report agree on the basic shape of the system: a persistent, account-linked identifier that advertiser sites can send back to OpenAI.

The researchers also flagged that consent for this cookie defaults to on. OpenAI’s documentation confirms that its pixel “initializes with consent set to true by default” for measurement purposes, meaning a website has to actively turn it off rather than the visitor having to opt in first. The report adds that OpenAI treats this tracking as analytics rather than marketing, so declining “marketing” cookies on a site does not necessarily stop it.

Who Is Affected?

Ads, and the pixel that measures them, apply to Free and Go plan ChatGPT users who are logged in and over 18. OpenAI’s help center states plainly that accounts identified as belonging to users under 18 are not shown ads. Coverage now spans the US, the UK, 31 European markets, Mexico, Brazil, Japan, and South Korea, though OpenAI has said personalized ad targeting specifically is not yet available in the European Economic Area or Switzerland while it works through consent requirements there.

If you only use ChatGPT on a Plus, Pro, Business, Enterprise, or Edu plan, OpenAI’s documentation says you will not see ads at all, though it has not said the measurement pixel is entirely absent from the ad ecosystem those advertisers use elsewhere on the web.

Ad Plans and Pricing

Nothing about ChatGPT’s core pricing changed with this report. Ads are a Free and Go tier feature, not a paid add-on:

Upgrading off Free or Go removes ads from ChatGPT itself, though it does not retroactively clear any ad data already associated with your account. OpenAI’s ad settings let you do that separately.

Why It Matters

A tracking cookie that follows a browser between an online store and a review site is not new, that is how most of the ad industry has worked for years. What is different here, as the researchers put it, is that “the stakes differ here because people tell a chat assistant things they would not post on a social network.” Tying that kind of account, even indirectly through a hashed or signed identifier, to purchases, health-adjacent shopping, or job searches on other sites raises the bar for what “ad measurement” should be allowed to touch.

OpenAI’s own materials are explicit that advertisers do not receive your chat history, your name, or your exact location, and that sensitive topics like health or politics are excluded from ad targeting. The open question the report raises is not really about what OpenAI intends the pixel to do, but whether a persistent, account-tied identifier flowing to a growing list of advertiser sites, on by default, meets the bar people expect from a tool they use for personal, often unguarded conversations.

Competitor Context

Ad tracking is not universal across AI chatbots. According to a recent comparison of ad practices across major AI platforms, Anthropic’s Claude runs no ads on any plan and has said advertising does not fit its business model, which leans on enterprise and API revenue instead. Google’s Gemini app does not currently run standalone ads either, though Gemini answers that surface inside Google Search still sit alongside standard Google Search ads. Microsoft’s Copilot does not insert ads into its chat interface, monetizing instead through existing Bing search ad inventory. Perplexity, by contrast, has run “Sponsored Questions” style ads since November 2024, predating ChatGPT’s ad launch by about a year and a half.

That makes OpenAI and Perplexity the two mainstream chat assistants actively monetizing consumer conversations with ads today, while Claude and Gemini remain ad-free in their own chat apps for now.

Limitations

A few things are still unclear. The researchers’ sample, 12 advertiser websites and 13 pixel IDs, is a snapshot, not a full account of everywhere OpenAI’s pixel runs, so the true scale could be larger or smaller than what was observed. OpenAI has acknowledged the disclosure, according to the report, but has not yet published a detailed public response addressing the specific cross-site cookie behavior the researchers describe, so at this stage this is a documented independent finding that OpenAI has not fully confirmed or denied in its own words. As with any single research report, it is worth watching for an official OpenAI statement or documentation update before treating every technical detail as final.

What Happens Next?

Expect scrutiny to grow, especially in Europe, where regulators have historically moved quickly on cookie consent and ad-tracking questions, and where OpenAI has already said personalized ad targeting is being held back pending consent work. For everyday users, the practical move is simple: open ChatGPT, go to Settings, look for Ad Controls (or the Data Controls section if Ad Controls has not reached your account yet), and review what is toggled on. You can turn off ad personalization, clear stored ad data, or hide and report individual ads from there, and a step-by-step opt-out walkthrough is available here if you want a visual guide. If you would rather avoid the ad system altogether, moving to a paid ChatGPT plan removes ads entirely, though it is a bigger step than most people need to take just to manage one setting.

FAQs

Does ChatGPT show ads?
Yes, for logged in Free and Go plan users in an expanding list of countries. Plus, Pro, Business, Enterprise, and Edu plans do not show ads.

What is the ChatGPT ad tracking cookie researchers found?
A research group, Buchodi’s Threat Intel, says OpenAI’s ad measurement pixel sets a cookie, which it labels __obi, that carries a signed, account-linked token and is sent back to OpenAI when a user visits advertiser sites running the pixel. OpenAI’s own documentation describes similarly purposed cookies under different names.

How do I stop ChatGPT ads from tracking me?
In the ChatGPT app, go to Settings and look for Ad Controls, where you can turn off ad personalization and clear stored ad data. Upgrading to a paid plan removes ads from ChatGPT itself.

Do Claude or Gemini show ads like ChatGPT does?
No. Claude does not run ads on any plan, and Gemini’s standalone chat app does not currently show ads either, though Gemini results inside Google Search can appear alongside normal Google Search ads.

Is this the same as OpenAI selling my chats to advertisers?
No. OpenAI’s documentation states advertisers do not receive your chat history, memories, or personal details, and receive only aggregated performance data such as clicks and views. The researchers’ concern is about the tracking cookie’s reach across sites, not about chat content being sold directly.