OpenAI's __obi Cookie Fires Under Analytics Consent. Your CMP Probably Doesn't Know That.

A cookie classified as "analytics" that behaves like ad-measurement infrastructure. That's the finding from independent researcher Buchodi, who examined traffic across 936 advertiser pixels and 1,029 hostnames and found that OpenAI's __obi cookie, set during ChatGPT use, can travel to participating advertiser sites running OpenAI's measurement pixel. The cookie persists for about a year, is scoped to .openai.com with SameSite=None; Secure, and can accompany cross-site requests depending on browser behavior.

For demand gen operators evaluating ChatGPT ads as a pipeline channel, the attribution mechanics look familiar. The privacy governance gap does not.

What the Research Shows (and What It Doesn't)

ChatGPT exchanges an identifier with bzr.openai.com, which sets __obi. When a browser later visits a site running OpenAI's ad-measurement pixel, pixel events can include that persistent identifier alongside page and conversion data. Buchodi reportedly observed a short-lived signed token associated with an account identifier during the exchange for logged-in users.

But MarTech's coverage flags a critical limitation: the research did not observe the final server-side step of linking off-site activity to a specific ChatGPT account. OpenAI's own Help Center states advertisers receive aggregated performance information (total views, clicks) and do not get access to conversations, chat history, memories, or personal details. The mechanism is limited to sites implementing OpenAI's measurement pixel, and Safari/WebKit protections may block or limit parts of the flow entirely.

The Consent Classification Problem

OpenAI reportedly classifies __obi as an analytics cookie. Buchodi found the cookie could be set when analytics consent was allowed, even if a user had declined marketing cookies.

That distinction matters for your consent management platform. If your CMP categorizes OpenAI's pixel under "analytics" because that's how the vendor labels the cookie, but the cookie's actual function supports cross-site advertising attribution, you've got a mismatch between consent categories and processing purpose. For B2B SaaS companies operating under GDPR or state privacy laws, that's a tag governance audit waiting to happen.

The trade-off you're accepting: better conversion measurement from a new channel, with a consent-category gap that could surface in a regulator inquiry or a customer complaint.

What OpenAI's Official Measurement Stack Looks Like

Separate from the __obi research, OpenAI's documented measurement approach is standard ad-tech plumbing. An ad click adds a click reference (oppref) to the landing-page URL. The OpenAI Pixel captures it and stores it in a first-party cookie so later conversion events can be attributed back to the click.

When oppref isn't available, Automatic Advanced Matching can detect supported customer information from forms, normalize it, and hash it in-browser using SHA-256 before including it with conversion events. If you're sending conversions via both the Pixel and the Conversions API, deduplication happens through event IDs.

Three things matter for accurate measurement: redirect hygiene (does oppref survive your marketing site, auth flow, and app?), first-party cookie behavior across browsers, and event ID discipline so you don't double-count.

The Diagnostic Before You Deploy

CMP audit. Pull your consent category mapping for OpenAI's pixel. Does it fire under "analytics," "marketing," or both? If the cookie supports ad measurement but fires under analytics consent, document the gap and get a legal opinion before your next campaign flight.

Browser-by-browser QA. Test your conversion flow on Chrome, Safari, and Firefox. Safari's WebKit protections may block cross-site cookie transmission, meaning your attribution data could skew heavily toward Chrome users. Quantify the gap before you trust the numbers.

Redirect preservation. Trace oppref through every redirect in your funnel. OpenAI's click reference may not survive all setups. If it drops, your Pixel falls back to Advanced Matching or modeled measurement, and attribution confidence drops with it.

Event ID deduplication. If you're running both the Pixel and Conversions API, set matching event IDs. Without them, you'll double-count conversions and inflate reported ROAS.

Where This Leaves Channel-Mix Decisions

ChatGPT ads are still early. The measurement infrastructure is evolving, and the privacy questions around __obi aren't resolved. OpenAI's official position constrains advertiser access to aggregated data, but the gap between cookie classification and actual function creates compliance risk your competitors may not be pricing in.

The hypothesis worth testing: if you run ChatGPT ads with a clean oppref flow and server-side Conversions API, you can get directional attribution without relying on the __obi cross-site mechanism at all. Measurement signal with less consent exposure. If the attribution holds, scale. If it doesn't, you'll know exactly which link in the chain broke, because you audited the plumbing before you turned on the spend.

Knowing a platform can measure more has never been the same as knowing your customers understand how. That gap is where the real risk lives.