OpenAI’s advertising platform, codenamed "Bazaar," utilizes a tracking mechanism to link user activity on third-party websites directly to specific ChatGPT accounts. The process begins on chatgpt.com, where the client generates a 16-byte identifier that is exchanged via a POST request to a backend API for an RS256 JWT. This token binds the user's account to a 22-character identifier stored in a cookie named `__obi`. Crucially, this cookie is configured with `SameSite=none; Secure`, allowing it to be transmitted during cross-site requests, whereas other OpenAI cookies are blocked by modern browser security policies. When users visit advertiser sites containing OpenAI’s tracking SDK, the `__obi` cookie is sent to `bzr.openai.com`. The SDK scrapes data from form fields, page text, and tag managers, transmitting SHA-256 hashed emails and phone numbers alongside unhashed geographic data and URL paths. Research involving 936 advertiser pixels across 1,029 hostnames confirmed that this mechanism works even for logged-out users via anonymous identifiers. While the data is intended for analytics, the SDK's ability to scrape sensitive information—such as medical conditions or litigation details from URL paths—enables OpenAI to build highly granular user profiles by resolving off-site conversions to specific ChatGPT identities.