ChatGPT now knows what you do on other websites via ad collector

ChatGPT 通过广告收集器追踪你在其他网站的行为

OpenAI’s ad collector at bzr.openai.com sets a cookie called __obi, scoped to .openai.com. The value is while you are on ChatGPT and tied to your ChatGPT account. __obi is then sent to OpenAI from ordinary websites you visit. OpenAI 位于 bzr.openai.com 的广告收集器会设置一个名为 __obi 的 Cookie，其作用域为 .openai.com。该值在你使用 ChatGPT 时生成，并与你的 ChatGPT 账户绑定。随后，当你访问普通网站时，__obi 会被发送给 OpenAI。

Any company that buys ads on ChatGPT installs a small piece of OpenAI code on its own site, the same way retailers already install Meta and Google tracking code. Loading that code, sends __obi to OpenAI along with data about the page you are browsing. This includes products you are searching for, articles you are reading, and purchase behaviors. 任何在 ChatGPT 上投放广告的公司都会在其网站上安装一小段 OpenAI 代码，这与零售商安装 Meta 和 Google 追踪代码的方式如出一辙。加载该代码后，系统会将 __obi 以及你正在浏览的页面数据发送给 OpenAI。这些数据包括你搜索的产品、阅读的文章以及购买行为。

The bottom line is that OpenAI can connect what you do on those sites to your ChatGPT account. 简而言之，OpenAI 可以将你在这些网站上的行为与你的 ChatGPT 账户关联起来。

I reproduced the full mechanism on my own phone, verified with two independent capture methods, and cross-checked against several months of observed traffic covering 936 distinct advertiser pixels across 1,029 hostnames. 我在自己的手机上复现了整个机制，通过两种独立的捕获方法进行了验证，并与数月观察到的流量进行了交叉比对，涵盖了 1,029 个主机名下的 936 个不同的广告商像素。

How it works / 工作原理

Step 1. ChatGPT creates an identifier and signs it. 第一步：ChatGPT 创建并签署一个标识符。

On chatgpt.com, the client generates 16 random bytes and calls POST /backend-api/bazaar/obi/sync-token (or /backend-anon/ when signed out). The backend returns an RS256 JWT. sub is the account. obi is the identifier. The token binds them, is scoped to the collector, and expires in 60 seconds. bzr stands for bazaar, OpenAI’s internal name for the ads platform; wadi is the issuing service. 在 chatgpt.com 上，客户端会生成 16 个随机字节，并调用 POST /backend-api/bazaar/obi/sync-token（未登录时为 /backend-anon/）。后端会返回一个 RS256 JWT。其中 sub 代表账户，obi 是标识符。该令牌将两者绑定，作用域限定在收集器，并在 60 秒后过期。bzr 代表 bazaar，即 OpenAI 内部对广告平台的称呼；wadi 是颁发该令牌的服务。

Step 2. The identifier becomes a cookie on OpenAI’s domain. 第二步：该标识符成为 OpenAI 域下的一个 Cookie。

The client POSTs {"token": "«JWT»"} cross-site to bzr.openai.com/v1/obi/sync. The response: Set-Cookie: __obi=«redacted»; Domain=.openai.com; HttpOnly; Max-Age=31536000; Path=/; SameSite=none; Secure. SameSite=none with Secure is the configuration a cookie needs to be sent on cross-site requests. Max-Age is one year. The obi value in the JWT and the value in the cookie are identical. 客户端跨站 POST {"token": "«JWT»"} 到 bzr.openai.com/v1/obi/sync。响应为：Set-Cookie: __obi=«redacted»; Domain=.openai.com; HttpOnly; Max-Age=31536000; Path=/; SameSite=none; Secure。SameSite=none 配合 Secure 是 Cookie 在跨站请求中被发送所需的配置。Max-Age 为一年。JWT 中的 obi 值与 Cookie 中的值完全一致。

Step 3. Advertiser sites send it back. 第三步：广告商网站将其回传。

Three request classes go from an advertiser’s page to OpenAI’s hosts. On a phone with __obi in the jar, all three carried it. The first row is particularly interesting: the pixel SDK has a code path that omits credentials, and it does not help: the browser attaches cookies to the <script src> request that loads the SDK before any of OpenAI’s code runs. By the virtue of loading the tag, the identifier is disclosed. 从广告商页面到 OpenAI 主机的请求分为三类。在存有 __obi 的手机上，所有三类请求都携带了该标识符。第一行尤为引人注目：像素 SDK 有一条省略凭据的代码路径，但这无济于事：在 OpenAI 的任何代码运行之前，浏览器就会在加载 SDK 的 <script src> 请求中附带 Cookie。只要加载了该标签，标识符就会被泄露。

What travels with it / 随之传输的数据

The same SDK also collects identity from the advertiser’s page. The payload separates four sources: in (advertiser-passed), fm, ht, js (scraped from form fields, rendered page text, and the tag-manager bus). In observed traffic, scraped identity outnumbered advertiser-supplied identity 685 events to 255. 同一个 SDK 还会从广告商页面收集身份信息。有效载荷区分了四个来源：in（广告商主动传递）、fm、ht、js（从表单字段、渲染后的页面文本和标签管理器总线中抓取）。在观察到的流量中，抓取的身份信息数量（685 次事件）远超广告商提供的信息（255 次事件）。

Email, phone, first and last name are SHA-256 hashed before transmission. Country, region, city and postal code are sent in the clear. Postal code was the most-harvested form field. URLs are reduced to origin plus path before sending; none of 23,929 observed carried a query string. 电子邮件、电话、姓名在传输前会经过 SHA-256 哈希处理。国家、地区、城市和邮政编码则以明文发送。邮政编码是采集最多的表单字段。URL 在发送前会被简化为“源地址+路径”；在观察到的 23,929 个请求中，没有一个携带查询字符串。

Observed reach / 观察到的覆盖范围

On my device, one __obi value was sent to OpenAI from 12 commercial websites under 13 distinct pixel IDs, including Chewy, Wayfair, ThriftBooks, Eventbrite, HelloFresh, Coursera and SeatGeek. Every request was accepted with 202. 在我的设备上，一个 __obi 值被发送给了 OpenAI，涉及 12 个商业网站下的 13 个不同像素 ID，包括 Chewy、Wayfair、ThriftBooks、Eventbrite、HelloFresh、Coursera 和 SeatGeek。所有请求均以 202 状态码被接受。

It works when you are logged out / 即使注销后依然有效

Across 932 decoded sync tokens, 736 carried subject_type: account_user and 196 carried anonymous. The anonymous subject is as stable as the account subject: one per device, persisting at least 27 days. 在 932 个解码的同步令牌中，736 个携带 subject_type: account_user，196 个携带 anonymous。匿名主体与账户主体一样稳定：每个设备一个，至少持续 27 天。

OpenAI’s cookie policy lists __obi under Analytics cookies, one year, on chatgpt.com and openai.com. It is the only entry in that section. The policy describes analytics cookies as helping OpenAI understand how its services perform and are used. OpenAI 的 Cookie 政策将 __obi 列为分析类 Cookie，有效期一年，适用于 chatgpt.com 和 openai.com。这是该部分唯一的条目。政策称分析类 Cookie 旨在帮助 OpenAI 了解其服务的表现及使用情况。

OpenAI runs analytics and marketing as two separate consent choices, and every sync token I decoded carried consent_decision: analytics_allowed. Someone who allows analytics and refuses marketing gets this. OpenAI 将分析和营销作为两个独立的同意选项，而我解码的每一个同步令牌都携带了 consent_decision: analytics_allowed。这意味着，即使你允许分析但拒绝营销，依然会被追踪。

OpenAI’s response / OpenAI 的回应

I sent the mechanism and two questions to press@openai.com and privacy@openai.com on 14 September: why __obi is classified as an analytics cookie, and whether a… 我于 9 月 14 日向 press@openai.com 和 privacy@openai.com 发送了该机制的说明及两个问题：为什么 __obi 被归类为分析类 Cookie，以及是否……