If you use the free version of ChatGPT, there’s a good chance your browser has a cookie named __obi, placed there by OpenAI and valid for one year. A researcher known as Buchodi has studied this cookie and found that it enables OpenAI to track data about the merchant websites you visit. This cookie operates similarly to advertising pixels used by companies like Meta and Google, which allow advertisers to track user activity across the web. The way it works is through a piece of code embedded on merchant websites that use ChatGPT for advertising. When you visit these sites, the code triggers a request to OpenAI, and the __obi cookie is automatically included in that request. This cookie is not anonymous. On chatgpt.com, it is generated with a random identifier and signed by OpenAI's server using a token that also includes your account ID. This combination allows for precise tracking of your activity across different sites. Buchodi found that this cookie was used across 12 different stores, including Wayfair, HelloFresh, and Coursera. OpenAI has publicly documented how this tracking system works. According to their documentation, the system assumes you have given consent by default, and advertisers must explicitly opt out by writing a specific line of code. The pixel automatically collects information such as your email, phone number, and name, which are hashed using SHA-256 encryption in your browser. It also sends your city and postal code in plain text. OpenAI classifies the __obi cookie as an "Analytical Cookie," which is used to understand how their services are used. However, this category is unique in their cookie policy, and the marketing-related cookies listed below include major platforms like Google, Meta, and LinkedIn. Whether or not you are affected by the __obi cookie depends on the browser you use. Safari, which is the default browser on iOS devices, blocks third-party cookies by default, so it prevents the __obi cookie from being set. Firefox has also taken steps to isolate cookies per site since 2022, which prevents tracking across different domains. Chrome, however, has not removed third-party cookies as planned and allows the __obi cookie to be set, especially on Android devices. For users concerned about tracking, there are already effective defenses in place. The EasyPrivacy list, which is included by default in the uBlock Origin browser extension, blocks the domains responsible for placing the __obi cookie. If you use a DNS service like Pi-hole or NextDNS, adding these domains will block the cookie across all devices on your network. However, even if your browser blocks the cookie, some data might still be sent to OpenAI through an API called by the merchant's servers, which cannot be blocked by browser settings. This tracking is not limited to the United States, as ChatGPT Ads has expanded to France and 30 other European countries. If you're using a free account, the cookie may still be active even when you're logged out. To protect yourself, it's worth checking your browser extensions and DNS settings. You can also check for the __obi cookie in your browser's cookies list under the .openai.com domain.