The Mechanism Behind the Identifier
OpenAI operates an ad collector at bzr.openai.com that sets an identifier called __obi, which is scoped to .openai.com. The backend returns an RS256 JWT containing the account subject and the __obi identifier to bind user activity across domains, effectively replicating the surveillance playbooks pioneered by Meta and Google.
"The bottom line is that OpenAI can connect what you do on those sites to your ChatGPT account."
Because this synchronization token binds the account and identifier, is scoped to the collector, and expires in 60 seconds, it establishes a direct connection between session states. OpenAI's cookie policy lists the __obi cookie under Analytics cookies with a duration of one year, and the Max-Age configuration for the __obi cookie is set to one year.
Cross-Domain Tracking and Compliance Nightmares
Companies buying ads on ChatGPT install a small piece of OpenAI code on their own sites, triggering form harvesting and behavioral profiling based on queries, purchases, and dialogues. The __obi identifier is configured with SameSite=none and Secure to allow transmission on cross-site requests, ensuring that the __obi cookie value is sent to OpenAI from ordinary websites visited by users. For enterprise users and corporate compliance officers, this infrastructure introduces critical risks of confidential data leakage, severe GDPR and CCPA violations, and inevitable regulatory fines. Audit your internal web properties and tag management containers immediately for scripts loading from bzr.openai.com or bzrcdn.openai.com to map any unintended outbound disclosures before regulators do it for you.