OpenAI __obi cookie links ChatGPT accounts to 1,029 advertiser domains via bzr.openai.com

The tracking flow begins on chatgpt.com where a 16-byte random value is signed into an RS256 JWT at POST /backend-api/bazaar/obi/sync-token. The token carries the account subject and obi identifier, then posts cross-site to bzr.openai.com/v1/obi/sync, which sets the HttpOnly SameSite=none cookie. Any site loading bzrcdn.openai.com/sdk/oaiq.min.js or posting to bzr.openai.com/v1/sdk/events forwards the cookie plus scraped identity fields. The SDK hooks window.dataLayer.push and Adobe layers to harvest emails and phones at 685 events versus 255 advertiser-supplied values. Observed payloads reduce URLs to origin-plus-path and hash PII before transmission while sending postal codes in clear text. This matches the pattern of Meta and Google pixels yet binds directly to authenticated ChatGPT accounts rather than browser-local identifiers. Data from 23,929 events shows paths survive intact, enabling product and article-level correlation without query strings. Operationally the system gives OpenAI first-party visibility into conversion events on advertiser domains without requiring login on those sites. The scope narrowed after 27 August when version 0.1.31 dropped name and geography collection. Regulators reviewing cross-site cookie practices under GDPR or CCPA now have a documented JWT-to-cookie binding and explicit dataLayer interception to evaluate consent flows.