According to the source, OpenAI’s ad collector at bzr.openai.com creates an identifier called __obi that is tied to a ChatGPT account. When a user visits chatgpt.com, the client generates 16 random bytes and requests a signed JWT from the endpoint /backend-api/bazaar/obi/sync-token (or /backend-anon/ when signed out). The JWT contains the account subject (sub) and the identifier (obi), expires after 60 seconds, and is signed with RS256. The client then posts this JWT to bzr.openai.com/v1/obi/sync, which responds with a Set‑Cookie header that sets __obi on the .openai.com domain with a one‑year Max‑Age, SameSite=None and Secure flags, allowing the cookie to be sent on cross‑site requests. Advertisers that run ads on ChatGPT embed a small piece of OpenAI code on their own sites, similar to Meta or Google tracking pixels. When that code loads, the browser automatically attaches the __obi cookie to requests made to OpenAI’s hosts, including the SDK script load (GET bzrcdn.openai.com/sdk/oaiq.min.js), conversion‑event POSTs (POST bzr.openai.com/v1/sdk/eventswithobref), and a “no credentials” POST path (POST bzr.openai.com/v1/sdk/events). The source notes that the script‑load request itself carries the cookie because browsers attach cookies to