Developers have confirmed with concrete evidence that OpenAI's ads are collecting your behavioral information across sites.

The thing that people have been worrying about has finally happened.

As we get increasingly accustomed to delegating problems to AI, our chat records, work content, interest preferences, and even some details that were originally private to us are constantly entering the field of vision of large models.

Worse still, developers have confirmed with solid evidence that OpenAI may also access your browsing behavior on other websites through some rather inconspicuous methods. That means even if you never say those things in ChatGPT, some of your actions on webpages will become another clue for it to learn about you.

Once this incident was disclosed, it immediately climbed to the 3rd place on the HackerNews hot list.

Security researcher buchodi recently published a detailed technical investigation report, which reversed the full tracking chain of OpenAI's advertising platform (internal code name "bazaar"). The conclusion shows that OpenAI has implanted a cookie named __obi in ChatGPT, which can associate your browsing behavior back to your ChatGPT account when you visit third-party websites installed with OpenAI's advertising pixels.

Blog link: https://www.buchodi.com/chatgpt-now-knows-what-you-do-on-other-websites-via-ad-collector/

The Journey of a Single Cookie

The entire tracking mechanism is completed in three steps.

Step 1, when a user opens ChatGPT, the client generates a 16-byte random identifier, and obtains an RS256-signed JWT through the POST /backend-api/bazaar/obi/sync-token interface. This token binds the random identifier to the user account, with a valid period of 60 seconds.

Step 2, the client sends the JWT cross-site to bzr.openai.com/v1/obi/sync, and the server returns a cookie: __obi. This cookie is set with SameSite=None; Secure, and is valid for one year. This means it is explicitly designed to be sent in cross-site requests.

Step 3, when a user visits a commercial website installed with OpenAI's advertising pixels, the browser will automatically carry the __obi in the request and send it back to the OpenAI server. Researchers found three types of requests carrying this cookie in actual packet capture, the most notable of which is: the <script src> request for the browser to load the advertising pixel SDK will come with the cookie by itself, and the identifier has been transmitted back even before any OpenAI code is executed.

In short: As long as you open a webpage installed with OpenAI's advertising code, OpenAI will already know that you are visiting.

The tracking does not stop at identity recognition. OpenAI's advertising pixel SDK will also proactively collect user information from the advertiser's page.

In the traffic observed by researchers, the SDK collects data through four channels, which are distinguished by OpenAI with labels: in (data actively passed in by advertisers), fm (data captured from form fields), ht (data captured from page rendered text), and js (data obtained from the tag manager data layer). Among them, the amount of data automatically captured by the SDK far exceeds the data actively provided by advertisers: in the observed traffic, the former generated 685 events, while the latter only 255.

The SDK's data layer interception is particularly aggressive. The current version will extract email addresses and phone numbers from it. And in the version 0.1.31 before August 27, it would also capture the user's name and geographic location. Email addresses, phone numbers, and names will be processed with SHA-256 hashing before transmission. However, the country, region, city and zip code are sent in plain text. The zip code is the most collected form field, which generated 100 collection events on 28 websites.

The URL is truncated to the domain name plus path before being sent, without query parameters. But researchers found in 23929 observed records that the path itself has exposed sensitive information, including a medical condition page, a debt solution process page, and a litigation acceptance form.

Researchers have fully reproduced the process on their own devices, cross-verified it with two independent packet capture methods, and analyzed the traffic over several months at the same time, covering 936 different advertiser pixels and 1029 host names.

On the researcher's own mobile phone, one __obi value was sent to the OpenAI server from 12 commercial websites, involving 13 different pixel IDs. These websites include pet e-commerce platform Chewy, home furnishing platform Wayfair, second-hand book dealer ThriftBooks, event platform Eventbrite, fresh food subscription service HelloFresh, online education platform Coursera and ticketing website SeatGeek. All requests returned a 202 status code, meaning the server confirmed receipt.

In a larger sample of traffic, 12 of the 30 different __obi values appeared in requests from multiple advertisers, and one of the values was sent by 10 different advertisers.

In addition, researchers decoded 932 sync tokens, of which 736 carry subject_type: account_user (logged-in user) and 196 carry anonymous (anonymous user). But anonymous identifiers are as stable as account identifiers: one per device, which remains unchanged for at least 27 days.

This means that even if the user does not log in to ChatGPT, OpenAI can still continuously track their behavior on websites installed with advertising pixels through this anonymous but stable identifier.

OpenAI and Advertising Data

The researchers themselves also pointed out that Meta built a system with exactly the same structure many years ago: logged-in accounts, third-party cookies, pixel triggers, and off-site behavior traced back to user profiles. This mechanism is standard advertising technology.

What is unprecedented is that this system runs on an AI chat product.

The things people tell AI are what they will not post on social networks. And these AI products are increasingly performing operations on behalf of users.

This is why OpenAI's ad tracking issue has sparked far more controversy than traditional adtech. On May 1 this year, OpenAI updated its privacy policy, announcing that it would start using cookies to promote its own products on other websites. On May 13, California users filed a class-action lawsuit against OpenAI, accusing it of embedding Meta Pixel and Google Analytics in ChatGPT.com, and sending users' conversation topics, hashed emails and device identifiers to Meta and Google.

The direction of this mechanism is completely opposite: OpenAI itself is the advertising giant. It has built its own tracking infrastructure, allowing advertiser websites to send user data back to OpenAI.

On February 9 this year, ChatGPT ads were officially launched for free US users and Go-tier users, with about 60 dollars per thousand impressions and a minimum placement threshold of 200,000 dollars. By May, OpenAI had expanded its advertising system to 31 European countries, with tens of thousands of advertisers. According to Wired reports, marketing cookies for free users have been enabled by default.

For an AI that we actively tell a large amount of information every day and which is gradually accessing the entire Internet on our behalf, is more knowledge necessarily a good thing?

This article is from WeChat Official Account "Machine Heart", author: Leng Mao, published with authorization from 36Kr.