OpenAI's __obi Cookie Allegedly Tracks Cross-Site Activity, 'Analytics' Classification Questioned
Baca dalam 60 detik
- Investigasi independen mengungkap cookie __obi yang ditanam OpenAI melalui ChatGPT berpotensi menghubungkan aktivitas pengguna di situs pengiklan dengan identitas akun.
- Label 'analitik' pada cookie tersebut dinilai tidak sesuai karena mekanismenya lebih menyerupai pengukuran konversi iklan, memicu pertanyaan soal kepatuhan privasi.
- Otoritas perlindungan data di Eropa dan AS diperkirakan akan menelusuri praktik ini, sementara pengguna disarankan memeriksa ulang preferensi cookie.
An OpenAI cookie named __obi, deployed through its ChatGPT service, is reportedly capable of linking user activity on third-party advertiser sites with ChatGPT account identities. This finding stems from an independent technical investigation published on September 20–21, 2026, following OpenAI's cookie policy update on September 10, 2026, which still categorizes the cookie as 'analytics'.
The revealed mechanism involves a token exchange: ChatGPT generates a short-lived token, sends it to the bzr.openai.com domain, and then receives a signed token that subsequently sets the __obi cookie. This cookie is persistent, valid for one year, and possesses the attributes SameSite=None, Secure, and HttpOnly—a configuration that allows it to be included in cross-site requests. However, this inclusion only occurs if the advertiser's site has loaded an OpenAI measurement pixel and initiated a cross-origin request to OpenAI's servers.
Advertiser sites utilizing this pixel reportedly load a script from bzrcdn.openai.com/sdk/oaiq.min.js. Subsequently, the site sends conversion events to bzr.openai.com/v1/sdk/events, and this request can carry the __obi cookie back to OpenAI along with page data, identity signals from forms, and conversion activities. This pattern resembles techniques previously uncovered in cases of covert surveillance applications.
Independent investigator Buchodi also observed anonymous tokens in the exchange, indicating that a logged-in ChatGPT account might not be necessary for the cookie to appear. Nevertheless, Buchodi acknowledged that server-side identity merging was not directly observed. The complete chain linking off-platform behavior to a specific ChatGPT identity remains an inference from the reported mechanism, rather than a confirmed fact.
OpenAI refers to __obi as an analytics cookie that helps the company understand the effectiveness of its services and marketing efforts. However, Buchodi's findings suggest that this cookie functions more like an advertising conversion measurement tool. This categorical distinction is crucial because, under privacy frameworks like GDPR, the principle of purpose limitation requires that data collected for one purpose not be diverted to another. Whether OpenAI's classification passes this test remains an open question.
"'Analytics' and 'advertising conversion measurement' are not the same categories in most privacy frameworks," states the core finding of the investigation, emphasizing the importance of purpose limitation.
OpenAI did not provide a direct answer to why __obi carries the analytics label or whether analytics consent alone was indeed intended to cover this usage. According to the report, the company acknowledged the questions and stated it would conduct an internal review.
For users in Indonesia, this issue directly impacts daily habits. Many ChatGPT users in the country access the service via Android phones and may have consented to analytics cookies without realizing the implications. Indonesia has a Personal Data Protection Law (UU PDP) that comes into full effect in October 2024, with similar principles regarding consent and purpose limitation. If a similar mechanism is implemented in Indonesian territory, users have the right to know whether their analytics consent also covers cross-site tracking for advertising purposes. Data protection authorities in Europe and the United States are reportedly intensifying their scrutiny of such practices, and this wave of oversight could extend to Southeast Asia, including Indonesia.
For now, users can review or change cookie preferences through ChatGPT settings, under the Data Controls menu. If this option is not available in certain regions, OpenAI's privacy request form serves as an alternative route. This step is crucial because the seemingly simple choice—accepting analytics cookies but rejecting marketing cookies—might not be as straightforward as imagined.
Moving forward, the big question is not just about one cookie, but to what extent the 'analytics' label can still be justified when its mechanism extends to off-platform behavior. Regulators in various jurisdictions, including Indonesia, are urged not to rely solely on company disclosures but also to conduct independent technical audits. Without such audits, user consent risks becoming a mere formality.
