OpenAI has added an “analytics cookie” to ChatGPT that can track user activity across other websites, according to findings from cybersecurity researcher Buchodi.
Buchodi monitored the tracking mechanism over several months across thousands of websites. The research indicated that searches, pages viewed and purchases made on a merchant’s website could be linked to a user’s ChatGPT account.
Cookies work by storing small pieces of data in a web browser when someone visits a website. The website can later access the stored information to remember details such as login information and shopping preferences.
Advertisers commonly use cookies to monitor online activity and deliver more relevant advertising based on users’ browsing behaviour.
Similar advertising data collection tools have been widely used by other technology companies, including Google and Meta. However, Buchodi said this was the first time they had observed such a mechanism being used on an AI application.
“The mechanism is standard adtech. What has no precedent is running it on an AI chat product,” Buchodi noted in a breakdown of the ad tracking software published on their blog.
“People tell these products things they would not put on a social network, and these products increasingly act on their behalf.”
OpenAI began testing advertising in ChatGPT for users in the US earlier this year and has since expanded its advertising pilot to the UK, Mexico, Brazil, Japan and South Korea.
Despite the cookie’s tracking function, OpenAI lists the tracker, identified as “__obi”, under the Analytics section of its cookie policy rather than under Marketing.
“These cookies help us understand how our Services perform and are used, such as the number of users, and how they interact with our Services,” the policy states.
After Buchodi contacted the company about the findings, OpenAI Support said the information would be shared internally for review.
The tracking mechanism was observed on the Chrome browser for Android and appears to be present only on free versions of ChatGPT.
