The ChatGPT ads pixel assumes consent unless the advertiser says otherwise

The ChatGPT ads pixel assumes consent unless the advertiser says otherwise

21 September 2026 — Businesses buying ads in ChatGPT can measure conversions by installing OpenAI's measurement pixel on their own websites. Its documentation contains a default that is the wrong way round for any site with visitors in the UK or the European Union, and the site owner — not OpenAI — is the one who has to change it.

What the documentation says

The pixel "initializes consent to true by default unless you set it to false or the Pixel finds a stored denial." In other words, unless the site's own code tells it otherwise before it starts, it treats every visitor as having agreed. The documented fix is one line — set consent to false before initialising, and to true only after the visitor grants measurement consent — but it has to be written.

With consent granted it sets two first-party cookies on the advertiser's site: one holding the attribution identifier from the ad click, kept for 30 days, and a randomly generated browser reference kept for 365 days.

The documentation also describes automatic advanced matching. When it is enabled, the pixel "automatically detects supported customer information from your website," normalises it and hashes it with SHA-256 in the browser before sending it with conversion events; OpenAI states that raw customer information is not sent this way. The customer fields the pixel accepts include a hashed email address, phone number and names, and, unhashed, country, city and postal code.

Separately, OpenAI's cookie policy, last updated on 10 September, lists a one-year cookie named __obi, set on OpenAI's own domains, under "Analytics" rather than under "Marketing Performance".

An independent analysis goes further

A security researcher's analysis published on 20 September, based on captured traffic from 936 advertiser pixels, reports that customer details are more often detected from pages and forms than supplied by advertisers, that the __obi identifier links activity on advertiser sites back to ChatGPT accounts, and that it was set for users who had allowed analytics but refused marketing. We have not reproduced those findings, and OpenAI had not answered the researcher's specific questions by the time of publication. They are reported claims, not established fact.

What it means for a buyer

If your organisation runs, or plans to run, ChatGPT ads, three things are worth doing before the next campaign rather than after a complaint.

Set the pixel's consent to false before it initialises and wire it to the marketing category of your consent banner, not to analytics; under UK and EU cookie rules, advertising measurement is not something a visitor can be assumed to have agreed to.

Decide deliberately whether automatic advanced matching should be on. It reads customer details from your pages, which makes it your processing to disclose, and your privacy notice should name OpenAI as a recipient.

And ask OpenAI, in writing, how the __obi cookie is classified and what it is used for. The answer belongs in your records whichever way it goes.

Sources

• OpenAI Developers, "Measurement Pixel – Ads" (read 21 September 2026) — 21 September 2026
• OpenAI, Cookie policy (last updated 10 September 2026) — 10 September 2026
• Buchodi's Threat Intel, "ChatGPT now knows what you do on other websites via ad collector" — 20 September 2026