Following several months of monitoring thousands of websites and nearly a thousand advertising tracking points, independent researcher Buchodi uncovered that a cookie named __obi can link users' search, browsing, and purchase histories on merchant sites to their ChatGPT accounts. This cookie facilitates the tracking process in three distinct steps:

Firstly, ChatGPT generates a digital token that remains valid for 60 seconds. Secondly, this token is transformed into an __obi cookie, which boasts a validity period of up to one year and enables cross-site data transmission. Finally, merchant websites employ OpenAI's tracking code to relay the cookie along with user browsing data back to OpenAI. Additionally, this code captures user form data, with certain information, such as zip codes, being transmitted in plaintext.

It's worth noting that even if users log out of their ChatGPT accounts, they can still be tracked for up to 27 days via an anonymous ID. Furthermore, turning off ad marketing options does not halt the tracking, as the __obi cookie falls under the data analysis category. However, Apple phone users are immune to this tracking mechanism, which operates solely on the Android version of Chrome and is not activated every time ChatGPT is accessed.

Currently, it has only been confirmed that the data is sent back to OpenAI, and it remains unclear whether this data is linked to user accounts. Although OpenAI is not the pioneer of this type of tracking technology, the integration of users' private AI conversations with external shopping records within the same account represents a novel scenario.