This week’s buchodi writeup made the rounds on Hacker News for good reason: OpenAI’s ad collector at bzr.openai.com sets a cookie called __obi, scoped to .openai.com, bound to your ChatGPT account. Any retailer that buys ads in ChatGPT also pastes a small piece of OpenAI code into its own storefront — the same way it already hosts Meta’s pixel — and that code quietly ships __obi back to OpenAI along with the page you’re reading and what you’re putting in the cart. OpenAI can now join the two halves of your life: the questions you ask a chatbot and the purchases you make elsewhere.

OpenAI’s published answer is that advertisers never see your chats, chat history, memories, or personal details — only aggregate performance numbers. Which is true. And which is exactly the problem.

The Aggregate Dashboard Is the Whole Product

Start with what the cookie actually does. __obi is a match key. It lets OpenAI say, with confidence, that the person who asked about a refrigerator on Tuesday bought a refrigerator on Friday. That’s not targeting. That’s attribution — the accounting layer that turns a hunch into an invoice.

Now look at what OpenAI has been building since it opened its self-serve Ads Manager on July 22. Early campaigns ran for Best Buy, Lowe’s, and VistaPrint. The targeting isn’t keyword-based; OpenAI sells placement against conversational context — the moment a user is comparing options and working toward a decision. That’s the pitch, and it’s a good one, because it’s the one moment in commerce when a person is genuinely undecided.

The privacy crowd thinks the danger is a dossier. The dossier is the boring half. The valuable half is that an aggregate dashboard tells a marketer which phrasing of a recommendation converts. You don’t need to read someone’s chat to learn that. You need a click-through rate and a purchase count, and OpenAI hands those over as a courtesy.

An agency media buyer I spoke with, halfway through a Q4 pacing call with a retail client, put it more bluntly than her employer would like: “I don’t need to know what she typed. I need to know which sentence I paid for.” That is the entire ad business in one line, and it has nothing to do with cookies.

The Retailers Owe You an Explanation, Not OpenAI

The anger is aimed at the wrong defendant. Best Buy, Lowe’s, and VistaPrint are the ones who spent a decade pasting “We value your privacy” banners over their storefronts and then, this summer, voluntarily re-inserted a third-party identifier into their own checkout flow. Nobody made them. They did the math and decided your click was worth more than the banner.

The Federal Trade Commission’s core consumer-protection authority runs on deception — on promises made and not kept. The promise is on the retailer’s homepage. The cookie is disclosed, however grudgingly, in OpenAI’s documentation. If a privacy lawyer wants a clean Section 5 case, it is sitting in a Fortune 500 retailer’s terms of service, not in San Francisco.

That case is not being filed, because a cookie is a small thing, and everyone involved prefers a headline about OpenAI.

And here is where my own side should squirm. The instinct on the right is to say the market will sort this out. The market is sorting it out. It is sorting it out by putting a price on the assistant’s recommendation and letting the highest bidder discover the phrasing that works. Consumers are the product, the transaction is voluntary, and the disclosure regime everyone is demanding would change almost nothing about the outcome.

Nobody Has a Rule for an Advertisement Made of Grammar

Last week’s coverage of the broader ChatGPT ad rollout framed the arrival of advertising in AI assistants as a familiar story — the free tier pays, the search box gets a competitor, brands adapt. That framing assumes ads are separable things. A box on a page. A label reading “Sponsored.” Something you can point at.

The FTC’s endorsement guides exist precisely because a paid recommendation has to be identified as paid. That rule works when the ad is a discrete object. It stops working when the ad is a subordinate clause in a paragraph of fluent prose that the reader has no reason to distrust. There is no label you can put on a sentence that is doing two jobs at once and doing them in the same voice.

The __obi cookie is, weirdly, the most honest artifact in this entire business. It is inspectable. It is documented. It can be blocked, litigated, or regulated, and it will be, because it looks like every privacy story we already know how to have.

The part nobody has a doctrine for is quieter: a model that answers your question and, on the way, learns from aggregate dashboards that a slightly different ordering of the same facts performs better. That isn’t surveillance. It’s editing. And there is no cookie for it, no banner that catches it, and no agency in Washington currently tasked with noticing it.

Regulate the cookie if it makes you feel better. Just don’t mistake visibility for importance.

Sources