An independent analysis by Buchodi, documented on September 20, 2026, found that a cookie called __obi on the openai.com domain links ChatGPT users' browsers to sites of advertisers that installed OpenAI's advertising pixel, including people not logged in, and that OpenAI classifies it among analytics cookies. OpenAI, contacted on September 14, did not respond on the substance. The flow begins inside ChatGPT, where the client generates 16 random bytes and sends them to the endpoint /backend-api/bazaar/obi/sync-token, which replies with a JWT token signed with RS256 containing the account identifier, a 22-character code called obi and a 60-second expiry. The token is sent to bzr.openai.com/v1/obi/sync, and the server sets the __obi cookie on the .openai.com domain with SameSite=None; Secure, the HttpOnly flag and a Max-Age of 31,536,000 seconds, exactly one year. On advertiser sites, the page loads bzrcdn.openai.com/sdk/oaiq.min.js and sends events to bzr.openai.com/v1/sdk/events, with the browser attaching __obi so OpenAI receives the identifier with what the pixel read. Buchodi reconstructed the flow from network traffic of a personal device and confirmed it with two independent capture methods, citing 12 sites and 1 identifier; OpenAI has not confirmed or denied the mechanism.