If you use ChatGPT on your Android phone and you've ever visited Chewy, Wayfair, HelloFresh, or Coursera — you've been sharing more with OpenAI than you probably knew about.

A researcher named Buchodi published findings on September 14 showing that a cookie called __obi was sitting in Android Chrome browsers and pinging back to OpenAI's analytics servers — even when users were completely logged out of ChatGPT. Not "logged in on another tab." Fully logged out. The cookie was stable for at least 27 days. It was present on about a dozen third-party websites. And it was classified as an "analytics" cookie rather than an "advertising" one — which matters, because many consent management systems only ask you about advertising cookies.

What a tracking cookie actually does

Most people hear "tracking cookie" and picture something like a pop-up saying "accept all cookies?" But here's what's actually happening underneath that pop-up, because the mechanics matter.

When you load a website, the site can ask your browser to store a small piece of text — a cookie. Next time you visit (or visit a related site), your browser sends that cookie back. The website (or the third party that set the cookie) now knows it's the same browser. If you've ever noticed that you searched for a couch on Wayfair and then ads for couches followed you around the internet for two weeks, this is the mechanism. The couch company paid a tracking network; the tracking network left a cookie; every partner site the network works with recognized you.

The __obi cookie works like this, except the party receiving the data is OpenAI, not an ad network. It persists across visits to sites you might not associate with ChatGPT at all. And it works regardless of whether you're logged in, because the tracking doesn't require authentication — it only requires that the cookie is in your browser.

Why only Android?

This is the detail that surprised me most. iPhones running Chrome, and desktop browsers on either platform, don't appear to be affected. Android Chrome specifically is.

The likely reason is how different browsers handle third-party cookies — cookies set by a domain other than the one you're visiting. Safari and Firefox have blocked these for years. Chrome on desktop has a long-running, perpetually-delayed plan to phase them out (it's still not done). But Chrome on Android, in certain configurations, is still permissive in a way that allows this to happen.

OpenAI didn't put the cookie there on Android because Android is Android. It's that Android Chrome happens to be the browser where the cookie can persist across third-party sites the way the tracking requires. Your iPhone's Safari sees the same cookie attempt and refuses it.

What this means for you

A few things, plainly stated.

1. This is tracking outside a product you chose to use. There's a meaningful difference between ChatGPT collecting data about your ChatGPT conversations and ChatGPT collecting data about your Wayfair browsing session. The second one is happening in a context most people didn't sign up for.

2. The "analytics" classification is doing a lot of work. When Wayfair or HelloFresh shows you a consent banner about cookies, you're choosing between categories — usually "strictly necessary," "analytics," and "advertising." The __obi cookie was found under "analytics," which many banners either accept by default or describe less prominently than advertising cookies. Calling something "analytics" instead of "advertising" is technically accurate in the sense that it feeds analytics pipelines. It's not exactly what most people picture when they click "accept analytics."

3. OpenAI hasn't explained it. As of this writing, OpenAI has not publicly commented on Buchodi's research. That could mean they're preparing a response. It could mean they believe the behavior is disclosed somewhere in the privacy policy and therefore not something requiring explanation. Either way, the silence doesn't tell us much about the actual intent — only that we don't have their account of it yet.

4. This is not unique to OpenAI. Google, Meta, and nearly every large platform has been caught doing similar things at various points. That doesn't make it acceptable. It means the pattern is industry-wide, which is useful for calibrating your reaction. This is worth paying attention to. It's not a unique betrayal from an otherwise pristine actor.

Source spread

• Buchodi — Original research — skeptic. The disclosure itself: cookie name, affected platforms, third-party sites, persistence duration.
• AI TLDR / Captain Compliance coverage — skeptic. Secondary coverage summarizing the disclosure and noting OpenAI's lack of response.
• AI Cybersecurity Monitor — safety. Frames the issue in the context of AI platform tracking and consent law (GDPR/CCPA).
• FourWeekMBA coverage — builder. Covers the technical cookie mechanism and how third-party cookie deprecation timelines intersect with this.

What's real and what deserves a side-eye

What's real:

• The cookie exists. The tracking appears to happen while logged out. The third-party sites are real. Android Chrome specifically being affected due to its third-party cookie handling is technically coherent.
• Classifying something as "analytics" to avoid the more-scrutinized "advertising" bucket is a common industry practice, and it is technically defensible even when it's not exactly forthright.
• iPhones genuinely are less affected, not because Apple cares about your privacy in some abstract sense, but because Safari's cookie blocking happens to prevent this specific mechanism.

What deserves a side-eye:

• The timing: if this has been active since at least July, that's nearly three months before a researcher found it. How it got there and why it targets third-party sites in the "analytics" category rather than being disclosed more prominently is a fair question.
• The silence: the longer OpenAI goes without a public statement, the more the silence itself becomes part of the story.
• The classification question: a cookie that persists across third-party sites and sends data to OpenAI, while you are logged out of OpenAI, being classified as "analytics" rather than "tracking" reflects a definitional choice someone made.

What to do about it

None of these require technical expertise.

• If you're on Android, switch your default browser to Firefox. Firefox on Android blocks third-party cookies by default. This is the most thorough fix and takes about five minutes to set up and import your bookmarks.
• If you want to stay on Chrome, clear cookies for ChatGPT. In Chrome on Android: Settings → Privacy and security → Clear browsing data → expand "Advanced" → check "Cookies and site data" → tap "See all sites" and specifically clear openai.com. This removes the cookie but won't prevent it from coming back if you visit a site where it's set.
• Read the "analytics" category before accepting. On any website's consent banner: before you click "accept analytics," look at what's actually in that bucket. Most banners let you expand the category. If you see third-party names you don't recognize, that's where to pause.
• If you're on iPhone, you're probably fine — for this specific thing. Safari's cross-site tracking prevention handles this. Keep it on. (Settings → Safari → scroll to Privacy → Cross-Site Tracking should be on.)

Further reading

• Buchodi — Original __obi cookie disclosure — the primary research
• OpenAI Privacy Policy — what they say about cookies in their own words
• Electronic Frontier Foundation — How tracking cookies work — background on the underlying mechanism
• Firefox for Android — the practical fix