Architectural Mechanism: How the '__obi' Cookie and Bazaar Infrastructure Operate
A security and privacy teardown released on September 20, 2026, by threat intelligence researchers at Buchodi has revealed that OpenAI has deployed an ad-tracking cookie infrastructure. The mechanism functions through bzr.openai.com, an internal service endpoint designated as 'bazaar.' Following a responsible disclosure notice submitted on September 14, 2026, technical audits verified that the infrastructure actively coordinates cross-site user telemetry.
The underlying technical architecture operates via specific client routines executed on chatgpt.com. The client logic initiates a request to the endpoint /backend-api/bazaar/obi/sync-token to generate an RS256-signed JSON Web Token (JWT). This cryptographic token binds a randomly generated 16-byte identifier directly to the logged-in user's subject identifier, designated internally as 'account_user.'
This signed JWT is then transmitted via a cross-site post request to bzr.openai.com/v1/obi/sync. In response, the server assigns the '__obi' cookie scoped broadly to .openai.com. The cookie is configured with modern persistence flags including HttpOnly, SameSite=None, Secure, and a Max-Age lifespan of exactly one year. These parameters allow the cookie to be accessed across third-party browsing sessions whenever an OpenAI client script or tracking beacon is executed.
Captured Traffic Evidence: Integration with Commercial Advertiser Pixels
Empirical traffic analysis confirmed that commercial websites embedding OpenAI's advertiser pixels transmit the '__obi' cookie back to OpenAI infrastructure during normal browsing. Along with the unique cookie value, the pixel transmits deep browsing telemetry, including visited URL paths, query parameters, specific product interactions, and conversion actions performed by the visitor on the third-party storefront.
An independent evaluation capturing network traffic across 936 advertiser pixels verified that automatic data matching was enabled on 638 out of 881 visibly configured deployments. Furthermore, among 932 decoded sync tokens examined during the investigation, 736 tokens were tied directly to authentic account users rather than anonymous guest sessions.
Crucially, the empirical evidence currently confirms only the joining of account user identifiers with external clickstream and navigation logs. Technical teardowns have not found conclusive proof that conversational prompts or private workspace queries are merged server-side with this external telemetry. OpenAI Support acknowledged receipt of the technical inquiry but did not contest the documented architectural findings.
Consent Workarounds: Classifying Cross-Site Trackers Under Analytics
The most contentious architectural detail centers on OpenAI's consent governance. Within the cookie policy documentation published on both chatgpt.com and openai.com, the organization categorizes '__obi' as an 'Analytics cookie' rather than a 'Marketing cookie.'
This classification produces a notable compliance loophole: end-users who explicitly reject marketing and advertising trackers on cookie consent banners still receive the '__obi' tracking cookie if they allow analytics cookies. Consequently, cross-site telemetry synchronization proceeds unabated for a substantial segment of users who believe they opted out of commercial targeting.
While independent observers argue this configuration circumvents standard consent frameworks mandated under the EU ePrivacy Directive and GDPR, these specific motives remain community inferences. OpenAI's public documentation has not officially commented on the rationale behind grouping cross-site advertiser beacons under general analytical telemetry.
Practitioner Sentiment: Industry Pushback Against AdTech Convergence
The disclosure prompted immediate pushback across the technical, engineering, and cybersecurity communities. Practitioners expressed acute concern over a premier artificial intelligence provider embracing surveillance-style AdTech methodologies historically associated with legacy social platforms.
Privacy engineers and data protection practitioners highlighted that generative AI workloads carry far more sensitive contextual data than standard search engines or social media feeds. Users regularly trust conversational interfaces with proprietary source code, internal strategic drafts, and sensitive personal inquiries. Establishing persistent cross-site tracking ties to these specific user identities represents an unacceptable vector of behavioral profiling in the view of many practitioners.
European legal and technical analysts further observed that combining cross-site behavioral telemetry with account-level synchronization without explicit, unbundled marketing consent presents acute legal vulnerabilities. Several specialists noted that these mechanisms invite formal regulatory scrutiny under both the General Data Protection Regulation and the Digital Services Act.
Implications for Thai Enterprises and Corporate Governance
For enterprise technology leaders and Chief Information Security Officers in Thailand, the emergence of '__obi' tracking introduces critical operational governance questions. Many Thai organizations currently permit employees to utilize commercial ChatGPT accounts on corporate endpoints without realizing that outbound web sessions can be tied back to identifiable accounts.
Under Thailand's Personal Data Protection Act (PDPA B.E. 2562), companies that embed third-party analytics or advertising pixels are strictly accountable for lawful basis and consent mechanisms regarding cross-border transfers and user profiling. If Thai commercial websites deploy OpenAI pixels that quietly synchronize account tokens under analytics categories without explicit consent, they face statutory non-compliance liabilities under PDPA enforcement frameworks.
Consequently, Thai IT departments must evaluate strict network egress controls and browser management policies. Enterprise security teams should consider blacklisting bzr.openai.com at the gateway level or migrating corporate workflows exclusively to dedicated enterprise tiers and direct API integrations where contractual data processing agreements prohibit behavioral ad tracking and third-party data synchronization.
This development marks a significant transition of generative AI providers into legacy AdTech tracking mechanisms, challenging corporate privacy assumptions and triggering severe compliance risks under GDPR and Thailand's PDPA.