Research reveals OpenAI's ChatGPT uses a tracking cookie connecting users to external sites, raising privacy concerns.
A recent investigation reveals that OpenAI has embedded a tracking cookie in ChatGPT, which connects users' online activities to their accounts when they navigate to external websites.
The analysis, conducted by researcher Buchodi, scrutinizes the tracking mechanisms of ChatGPT's advertising platform, referred to as bazaar.
Buchodi described the ad code utilized on websites as functioning similarly to a tracking pixel. When users activate ChatGPT, the system creates a unique identifier, ties it to the user's account, and stores it in a cookie named __obi for the .openai.com domain.
During website visits with installed OpenAI advertising pixels, the browser sends the __obi cookie back to OpenAI's servers automatically. Buchodi replicated this process using Chrome on Android and confirmed the findings through two separate methods, identifying domains such as bzr.openai.com and bzrcdn.openai.com.
His research uncovered 936 tracking pixels across 1,029 different hosts, generating a staggering 23,929 requests without any query strings in the URLs.
Types of Data Shared
The tracking system not only gathers conversion events but may also send encrypted personal information like email addresses, phone numbers, names, and even geolocation data, down to zip codes, through SHA-256 hashing in the browser.
Buchodi found that general data collection occurred in 685 instances, with 255 of those involving additional data. While hashed emails and phone numbers were transmitted securely, location data was sent in plaintext.
Importantly, the mechanism could potentially affect unauthorized users as well; out of 932 decoded sync tokens, 736 were linked to account holders, while 196 belonged to anonymous users. Buchodi noted that this investigation was limited to Chrome on Android, with other browsers like Safari blocking third-party cookies and all iOS browsers utilizing WebKit.
He compared OpenAI's tracking practices to those employed by major tech companies like Meta and Google, emphasizing that while such mechanisms are common in advertising, their implementation in AI chat products is unprecedented. "People disclose information to them that they would not share on social media," Buchodi remarked.
This finding comes on the heels of OpenAI's decision to integrate advertisements into ChatGPT for users on the more affordable Go plan and those without a paid subscription, a move made earlier in February.
