ChatGPT now knows what you do on other websites via ad collector

ChatGPT can now track your browsing activity on other websites, linking it to your account.

OpenAI has implemented a system that allows ChatGPT to collect data on user activity across other websites through its ad platform. This mechanism involves setting a cookie named '__obi' on users' browsers when they interact with ChatGPT. Websites that purchase ads on ChatGPT, or that have OpenAI's ad code installed, can then send this '__obi' cookie back to OpenAI along with browsing data. This data includes information about products users search for, articles they read, and purchase behaviors. OpenAI can then associate this off-site activity with a user's ChatGPT account, even when the user is logged out, by using a persistent anonymous identifier. The system collects scraped data from websites, including email addresses and browsing paths that may reveal sensitive information, although certain fields like passwords and medical history are excluded from collection. While OpenAI classifies '__obi' as an analytics cookie, its cross-site tracking functionality raises privacy concerns, especially given that users who disable marketing cookies might still receive it.

This development signals a significant expansion of AI models into adtech, leveraging conversational interfaces as a new vector for user data collection. By integrating ad tracking into ChatGPT, OpenAI is blurring the lines between AI assistance and targeted advertising, potentially creating a more unified profile of user behavior than previously possible through standalone web browsing or social media. The ability to link on-site activity within ChatGPT with off-site browsing data presents a powerful, albeit privacy-invasive, capability for advertisers aiming to reach users with highly personalized messaging.

The implications extend to how users interact with AI and their privacy expectations. Users may unknowingly consent to extensive data collection by merely using ChatGPT, especially if the classification of the '__obi' cookie as solely for 'analytics' is misleading. The cross-site tracking mechanism, similar to established adtech practices but applied to an AI context, means that sensitive information gleaned from user queries and subsequent browsing could be synthesized into comprehensive user profiles without explicit, granular consent for each data point. This raises questions about regulatory oversight and the future of privacy in AI-driven services.