ChatGPT advertising has introduced a new tracking technology that website owners, marketers and privacy teams need to understand: the ChatGPT Ads Measurement Pixel.

OpenAI’s conversion measurement system allows an advertiser to determine whether somebody who clicked an advertisement inside ChatGPT later visited a page, submitted a lead, registered for an account, started a trial, scheduled an appointment or completed a purchase.

That makes the OpenAI Pixel conceptually similar to conversion technologies operated by Google, Meta, TikTok, LinkedIn and other advertising platforms.

But the implementation has an important privacy consequence.

The OpenAI Pixel can place a first-party attribution cookie on an advertiser’s website, transmit conversion events to OpenAI and, when Automatic Advanced Matching is enabled, detect certain customer information from the website and send hashed identifiers with conversion events.

And OpenAI’s own implementation documentation contains a detail that privacy teams should pay particular attention to:

The Measurement Pixel initializes measurement consent as true by default.

Installing the OpenAI Pixel therefore should not be treated as simply adding another marketing script. Organizations subject to cookie consent requirements, opt-out obligations or other privacy laws need to determine when the technology can load, what information can be transmitted, how consent and opt-out signals affect it, and whether the website’s privacy disclosures accurately describe the processing.

This guide explains the cookies used by ChatGPT and OpenAI, how the ChatGPT Ads Pixel works, what the __oppref cookie does, what Automatic Advanced Matching collects, and how businesses can manage the technology through a consent management platform.

Does ChatGPT Use Cookies?

Yes.

OpenAI uses first-party and third-party cookies across ChatGPT, OpenAI.com, its API platform, authentication services, Ads Manager and related OpenAI properties.

OpenAI divides its published cookie inventory primarily into:

• Necessary cookies
• Analytics cookies
• Marketing-performance cookies

The company also uses similar technologies such as pixels, APIs, local storage, device identifiers and web beacons. OpenAI’s Cookie Policy treats these technologies broadly as cookies for purposes of explaining its tracking practices.

There is an important distinction, however, between cookies placed while somebody is using ChatGPT and cookies associated with ChatGPT advertising on another company’s website.

Those are not the same thing.

Three Different Things People Mean by “ChatGPT Cookies”

A search for “ChatGPT cookies” can refer to at least three different categories.

1. Cookies used by ChatGPT itself

These are cookies on domains such as chatgpt.com, openai.com, auth.openai.com, platform.openai.com and ads.openai.com.

They support functions including login, authentication, security, preferences, localization, account configuration, analytics and marketing measurement.

2. Third-party cookies used on OpenAI properties

OpenAI’s current cookie inventory also identifies technologies associated with companies including Google, LinkedIn, Meta, Reddit, TikTok, Microsoft/Bing, Cloudflare, Stripe, Intercom, Auth0 and Datadog.

Some provide infrastructure or security. Others measure marketing.

3. OpenAI tracking technology placed on advertisers’ websites

This is where the ChatGPT Ads Measurement Pixel enters the picture.

An advertiser can install OpenAI’s JavaScript SDK on its own website and send conversion events back to OpenAI.

The advertiser’s implementation can cause a first-party cookie named:

__oppref

to be stored on the advertiser’s domain.

That distinction matters. The __oppref cookie is not simply another cookie sitting on ChatGPT.com. It is part of OpenAI’s advertiser-side conversion attribution system.

What Is the ChatGPT Ads Measurement Pixel?

OpenAI describes the ChatGPT Ads Measurement Pixel as a browser SDK that measures website events attributable to advertisements displayed in ChatGPT.

The advertiser installs OpenAI’s SDK and initializes it with a Pixel ID.

The script currently loads from:

bzrcdn.openai.com

Measurement events can be transmitted to:

bzr.openai.com

OpenAI supports both browser-side measurement through the Pixel and server-side measurement through its Conversions API.

Supported events include actions such as:

• Page viewed
• Content viewed
• Item added
• Checkout started
• Order created
• Lead created
• Registration completed
• Appointment scheduled
• Subscription created
• Trial started
• Custom conversion events

An ecommerce company might therefore tell OpenAI that a visitor who arrived from a ChatGPT advertisement later completed an order.

A SaaS company could report that the visitor started a trial.

A professional-services company could report a lead form or appointment.

The measurement system provides the feedback loop advertisers expect from modern advertising platforms: ad click → website activity → conversion → attribution.

The oppref Identifier and __oppref Cookie

One of the most important components of ChatGPT Ads attribution is oppref.

When somebody clicks an advertisement in ChatGPT, OpenAI can append an oppref identifier to the advertiser’s landing-page URL.

The Measurement Pixel detects this identifier.

OpenAI’s SDK then stores it in a first-party cookie called:

__oppref

OpenAI says the SDK:

• captures oppref from the landing-page URL;
• stores it in the first-party __oppref cookie;
• reuses it on later page views;
• adds the current page origin as source_url;
• timestamps conversion events; and
• can include hashed Advanced Matching information when that feature is enabled.

This makes __oppref the bridge between the ChatGPT ad click and later activity on the advertiser’s website.

Conceptually, it serves a role similar to advertising click identifiers used elsewhere in the industry.

Is __oppref a first-party or third-party cookie?

It is a first-party cookie on the advertiser’s website.

That does not mean OpenAI has no involvement.

The cookie is created and used by OpenAI’s measurement technology for OpenAI advertising attribution, but it is stored under the advertiser’s domain.

This distinction is increasingly important because browsers have imposed much stricter limitations on traditional third-party cookies.

It is also important from a privacy perspective. A cookie does not become exempt from privacy requirements simply because it is first-party.

Its purpose and subsequent data flows matter.

OpenAI’s Pixel Defaults Consent to True

This is probably the most important implementation issue for privacy teams.

OpenAI provides a consent command for the Pixel:

oaiq("consent", false)

That command can prevent measurement events from being transmitted until consent has been granted.

However, OpenAI states that the Pixel initializes consent to true by default unless the website explicitly sets consent to false or the Pixel finds a stored denial.

When consent is false, measurement-event pings are not sent. If consent later changes to true, future events can be sent, but previously blocked events are not replayed.

That means simply installing the default OpenAI code is not necessarily an adequate consent implementation.

A company operating in a jurisdiction where prior consent is required should not rely on the Pixel to determine that legal requirement automatically.

The site has to impose the correct consent state.

The safer implementation model

Where prior consent is required, the sequence should generally be:

1. Determine the visitor’s applicable privacy regime.
2. Default OpenAI measurement to denied where necessary.
3. Prevent the tracking functionality from transmitting data before permission exists.
4. Present the required disclosure and consent choice.
5. Enable OpenAI measurement only after the appropriate consent.
6. Record the consent decision.
7. Stop future processing when consent is withdrawn.

The important principle is simple:

Installing the OpenAI Pixel is not the same thing as installing it compliantly.

Automatic Advanced Matching Changes the Privacy Analysis

The __oppref cookie is only part of the story.

OpenAI also supports Automatic Advanced Matching.

Advanced Matching is designed to improve attribution when the normal click identifier is unavailable.

When enabled, OpenAI says its Pixel can automatically detect supported customer information from recognizable forms and other sources on the advertiser’s website.

The data is normalized and hashed using SHA-256 in the browser before being included with conversion events.

OpenAI says raw customer information detected through Automatic Advanced Matching is not transmitted through that feature.

Supported matching fields include:

Data field	How OpenAI handles it
Email address	Normalized and SHA-256 hashed
Phone number	Normalized and SHA-256 hashed
External customer ID	SHA-256 hashed
First name	Normalized and SHA-256 hashed
Last name	Normalized and SHA-256 hashed
Country	Can be transmitted
City	Can be transmitted
State / region	Can be transmitted
Postal / ZIP code	Can be transmitted

OpenAI also permits advertisers to provide these identifiers manually through the Pixel’s user object.

This is more consequential than a conventional page-view counter.

The advertiser may be giving an advertising platform signals capable of helping associate a conversion with a particular customer or advertising interaction.

Hashed Does Not Mean Anonymous

Marketers sometimes describe hashed email addresses or phone numbers as anonymous data.

That is usually too simplistic.

Hashing changes the representation of an identifier. It does not necessarily eliminate the ability to associate that information with an individual.

For example, an advertising platform that already knows a person’s normalized email address can hash the same email using the same algorithm and compare the resulting values.

That matching capability is precisely why hashed identifiers are valuable for conversion measurement.

European regulators distinguish pseudonymization from anonymization. The European Data Protection Board states that pseudonymized information remains personal data under the GDPR when it can still be attributed to an individual using additional information.

California takes a similarly contextual approach. The California Privacy Protection Agency has stated that hashed information may still qualify as personal information when it is reasonably capable of being associated with a particular consumer or household.

So:

email@example.com

and

SHA256(email@example.com)

should not automatically be treated as legally equivalent to anonymous statistics.

Hashing is a security and privacy control. It is not a universal exemption from privacy law.

What Information Can the OpenAI Pixel Send?

The exact information depends on configuration and which conversion events the advertiser chooses to implement.

OpenAI’s documentation supports event information involving:

• Page and content views
• Product identifiers
• Product names
• Product quantities
• Order value
• Currency
• Checkout events
• Purchases
• Leads
• Registrations
• Appointments
• Subscriptions
• Trials
• Custom conversion events
• Pixel ID
• Event ID
• Page origin
• OpenAI click reference
• Hashed matching information
• Geographic matching fields

OpenAI can also use browser and server events together. If the same event is reported through the Pixel and Conversions API, advertisers can provide the same event_id so OpenAI can deduplicate it.

OpenAI’s own privacy policy also states that it may receive information from advertisers and other data partners to measure and improve advertising effectiveness and gives purchases as an example of information it could receive.

OpenAI’s Advertising DPA Makes the Advertiser’s Responsibility Clear

OpenAI’s Ad Tools Data Processing Addendum deserves attention from privacy teams implementing the Pixel.

For most processing through OpenAI’s covered advertising tools, OpenAI says that the advertiser and OpenAI operate as independent data controllers rather than one simply acting as the other’s processor.

OpenAI requires the customer to have the notices, rights, permissions, consents and legal bases necessary to provide personal data to OpenAI.

It also requires advertisers to honor opt-outs, objections and withdrawals of consent where those choices require the advertiser to stop providing data to OpenAI.

OpenAI’s DPA expressly contemplates the transfer of categories including:

• Email addresses
• Phone numbers
• Cookies
• Online identifiers
• Device and browser information
• Event data
• Transaction data
• Purchase data
• Related metadata

OpenAI also states that advertisers must not provide prohibited or sensitive categories of personal data through the covered Ad Tools.

That is another reason businesses should not enable conversion tags indiscriminately across every page and form on a website.

Sensitive Pages Require Particular Attention

Consider a website containing pages involving:

• Medical treatment
• Mental health
• Financial hardship
• Legal problems
• Religious activity
• Sexual health
• Immigration
• Political activity
• Children’s information

Even if an advertiser is merely trying to measure a conversion, the event name, URL, page title, product name, custom parameter or form information could reveal something far more sensitive than the advertiser intended.

For example, a custom event called:

depression_treatment_consultation

creates a very different privacy problem from:

appointment_scheduled

Likewise, passing detailed product names could unintentionally reveal health conditions or other sensitive characteristics.

OpenAI itself prohibits customers from providing sensitive categories of personal data through its covered Ad Tools and specifically warns against event names, audience names, parameters and tags that reveal or imply sensitive information.

Privacy review therefore has to cover both the tracker and the event taxonomy.

Does the OpenAI Pixel Send Your ChatGPT Conversations to Advertisers?

No. That is a different data flow.

OpenAI states that advertisers do not receive a person’s ChatGPT conversations, chat history, memories or personal details simply because they advertise in ChatGPT. Advertisers ordinarily receive aggregated performance information about their advertisements.

The Measurement Pixel works in the opposite direction.

A person clicks an advertisement in ChatGPT and visits the advertiser’s website. The advertiser’s website can then send eligible conversion information back to OpenAI.

Those two concepts should not be conflated:

ChatGPT conversation → advertiser

is not the normal measurement flow.

Advertiser website conversion → OpenAI

is.

That distinction is important when writing privacy notices and explaining the technology to users.

Complete ChatGPT and OpenAI Cookie List

OpenAI’s published cookie inventory is extensive, and the exact cookies a user encounters can vary based on region, service, browser and privacy choices.

The following sections organize the cookies OpenAI currently discloses.

OpenAI First-Party and Service Cookies

Cookie	Typical duration	Primary function
_puid	7 days	Service functionality
_uasid	1 day	Service functionality
_account	Session	Service functionality
oai_disallow_onboarding	12 hours	Onboarding
oai_age_verification_token	12 hours	Onboarding
oai-allow-ne	6 months	Cookie consent
oai-sc	1 year	Security
_account_residency_region	90 days	Service functionality
oai-did	1 year	Service functionality
country	1 year	Service functionality
analytics_consent	Varies	Cookie consent
marketing_consent	Varies	Cookie consent
oai-asli	6 hours	Service functionality
oai-av-seen	1 day	Onboarding
oai-cbi	Session	Service functionality
oai-cbs	Session	Service functionality
oai-downgrade-account-enabled	1 day	Service functionality
oai-gn	Session	Service functionality
oai-hlib	1 year	Service functionality
oai-hm	Session	Service functionality
oai-internal-search-settings	2 years	Service functionality
oai-ip-city	Session	Service functionality
oai-ip-country	Session	Service functionality
oai-is-specific-model	Session	Service functionality
oai-last-effort-mode	30 days	Service functionality
oai-last-model	30 days	Service functionality
oai-last-selected-github-repo	Session	Service functionality
oai-ll	30 days	Service functionality
oai-locale	1 year	Service functionality
oai-nav-state	2 years	Service functionality
oai-po-a2a	1 year	Service functionality
oai-thread-sidebar	2 years	Service functionality
signup_redirect_url	3 hours	Service functionality
sonic_desktop_results_tab	Session	Service functionality
temp-oai-compliance	1 month	Service functionality
ui-show-payment-modal	Session	Service functionality
oai-model-sticky-for-new-chats	1 month	Service functionality
locale	Session	Service functionality
oai_consent_analytics	6 months	Cookie consent
oai_consent_marketing	6 months	Cookie consent
auth_provider	10 minutes	Authentication
auth_session_minimized	10 minutes	Authentication
login_session	10 minutes	Authentication
consent	10 minutes	Authentication
oai-client-auth-session	10 minutes	Authentication
oai-disallowed-signup	12 hours	Authentication
next-auth.csrf-token	Session	Authentication
next-auth.callback-url	Session	Authentication
next-auth.session-token	Session	Authentication
_umsid	1 day	Service functionality
oai-consent-csrf_dev_*	30 minutes	Authentication
oai-login-csrf_dev_*	30 minutes	Authentication
rg_context	10 minutes	Authentication
iss_context	10 minutes	Authentication
oai_client_auth_info	30 days	Service functionality
dotcom-did	1 year	Service functionality
oai-sidebar-closed-applied	30 days	Service functionality
oai-sidebar-expanded	30 days	Service functionality
oai_consent_personalization	6 months	Personalized marketing consent
personalized_marketing_consent	6 months	Personalized marketing consent
sofaLastAdAccountId	2 years	Ads Manager functionality
tapestry-theme	1 year	Ads Manager functionality

OpenAI’s published inventory currently lists different durations for certain consent cookies on different properties or implementations, which is why organizations should rely on live scanning rather than assuming a static cookie duration forever.

Infrastructure and Functional Third-Party Cookies

OpenAI also discloses necessary or functional cookies associated with third-party vendors.

Auth0 / Okta

• did
• did_compat
• auth0
• auth0_compat
• _legacy_auth0.*.is.authenticated
• auth0.*.is.authenticated
• _legacy_auth0.app_*.is.authenticated
• auth0.app_*.is.authenticated

These support authentication on OpenAI properties.

Cloudflare

• CF_Authorization
• __cf_bm
• cf_clearance
• _cfuvid
• __cflb

These primarily support security and infrastructure.

Stripe

• __stripe_mid
• __stripe_sid

These support payment functionality.

Intercom

• intercom-device-id-dgkjq2bp
• intercom-device-id-izw1u7l7
• intercom-id-dgkjq2bp

These support customer-service functionality.

Datadog

• _dd_s

Used for error reporting.

Swoogo

• cookieconsent_status
• PHPSESSID
• _csrf
• AWSALB

These appear on OpenAI event properties for consent, session management and security.

Google

• g_state

Used for service functionality.

OpenAI lists these technologies as necessary cookies rather than advertising cookies in its current cookie inventory.

OpenAI Analytics Cookie

OpenAI currently identifies:

__obi

as an analytics cookie used on chatgpt.com and openai.com, with a listed duration of one year.

Marketing Cookies Used Across ChatGPT and OpenAI

OpenAI also publishes a substantial marketing-measurement cookie inventory.

LinkedIn

• li_fat_id
• lidc
• li_gc
• bcookie
• UserMatchHistory
• AnalyticsSyncHistory
• li_sugr

Google

• _gcl_au
• _gcl_aw
• IDE
• ANID
• NID
• gclid
• GBRAID
• WBRAID
• _glc_de
• _glc_dc

Reddit

• rdt_cid
• _rdt_uuid
• rdt_insight
• rdt_id
• lidc
• _reddit_ads_sync
• _reddit_s_event
• _rdt_cid

TikTok

• _ttp
• ttcsid_<pixelID>
• ttclid

Meta

• API
• fbclid
• _fbp
• _fbc
• fr
• datr
• wd
• sb

Microsoft / Bing

• MR
• MSPTC
• MUID
• _uetmsclkid
• _uetvid
• _uetsid
• msclkid

OpenAI classifies these as marketing-performance technologies used to measure the effectiveness of marketing campaigns. Durations range from roughly 24 hours for some click identifiers to more than a year for certain marketing cookies.

Where Does __oppref Fit Into This List?

The __oppref cookie deserves its own category.

It is part of OpenAI’s advertising measurement technology on an advertiser’s website rather than simply a cookie used while somebody is browsing an OpenAI property.

OpenAI’s developer documentation expressly states that the Pixel captures the oppref identifier from the landing URL and stores it in the advertiser’s first-party __oppref cookie for subsequent attribution.

Businesses deploying the Pixel should therefore add this technology to their own cookie and tracker inventory.

Does the ChatGPT Pixel Require Cookie Consent?

There is no universal answer covering every jurisdiction.

The answer depends on where the visitor is located, what information is being stored or accessed, what data is transmitted, what purpose the processing serves and which privacy laws apply.

But several jurisdictions create clear compliance concerns.

European Union: ePrivacy and GDPR

European rules are especially important.

The ePrivacy framework generally requires consent before storing or accessing information on a user’s device unless the technology is strictly necessary for a service requested by the user.

Advertising attribution usually does not fall comfortably within the strictly necessary exception.

The European Data Protection Board states that storing or accessing cookies generally requires the user to receive adequate information and provide consent, except for technically necessary cookies.

The GDPR analysis then applies to the processing of personal data associated with those technologies.

That can involve questions concerning:

• Lawful basis
• Transparency
• Purpose limitation
• Data minimization
• Retention
• Controller relationships
• International transfers
• Data-subject rights
• Withdrawal of consent

The OpenAI Pixel’s default consent = true behavior therefore matters considerably for European implementations.

A CMP or equivalent consent mechanism should establish the appropriate consent state before measurement begins.

United States State Privacy Laws

The United States does not have one general cookie-consent law equivalent to the European framework.

Instead, businesses face a growing patchwork of state privacy laws governing personal data, targeted advertising, sales, sharing, profiling, sensitive information and consumer opt-outs.

Whether OpenAI conversion measurement constitutes a regulated “sale,” “sharing,” “targeted advertising” activity or another regulated disclosure depends on the applicable statute, contracts and actual use of the information.

It should not automatically be assumed either way.

California provides one clear example of why the analysis matters.

The CCPA gives consumers a right to opt out of selling or sharing personal information for cross-context behavioral advertising, and businesses must honor qualifying opt-out preference signals such as Global Privacy Control where required.

An OpenAI Ads implementation therefore belongs in the organization’s data-flow analysis, not merely its marketing-tag list.

CIPA and Website Tracking Litigation

California’s Invasion of Privacy Act presents a separate litigation issue.

Plaintiffs have increasingly attempted to apply CIPA to modern website technologies such as pixels, analytics scripts, session replay, chat tools and other third-party tracking technologies.

One frequently invoked provision is Penal Code Section 631, which concerns certain unauthorized interceptions and attempts to read or learn the contents of communications while they are in transit.

Other claims have involved California’s pen-register and trap-and-trace provisions.

California Penal Code Section 638.51 generally prohibits installing or using a pen register or trap-and-trace device without a court order, subject to enumerated exceptions including circumstances in which the user’s consent has been obtained.

Whether a particular web pixel qualifies under any CIPA theory is a heavily fact-dependent legal question and remains contested.

The existence of the OpenAI Pixel alone does not establish a CIPA violation.

Relevant questions can include:

• What information was transmitted?
• Was it transmitted contemporaneously?
• Was OpenAI acting as a party, third party or service provider?
• Did the information constitute communication “contents”?
• Was consent obtained?
• When was consent obtained?
• What did the user see before transmission occurred?
• What did the website disclose?
• What identifiers were transmitted?
• Did transmission occur before the visitor made a privacy choice?

This is another reason pre-consent blocking and consent logs can matter beyond ordinary regulatory compliance.

They can become evidence.

Federal ECPA / Wiretap Act

The federal Electronic Communications Privacy Act also regulates interception of electronic communications.

The federal Wiretap Act generally prohibits intentionally intercepting electronic communications, subject to exceptions.

One significant distinction from California law is that the federal statute contains a one-party-consent exception in many circumstances.

As with CIPA, pixel litigation under ECPA depends heavily on technical architecture and the specific communications allegedly intercepted.

Businesses should not assume that every marketing pixel violates ECPA.

They also should not assume that calling technology “analytics” or “conversion measurement” eliminates the need to understand its data flows.

Privacy Risks Created by Automatic Advanced Matching

Automatic Advanced Matching deserves separate treatment because it creates several risks that do not exist with simple anonymous traffic measurement.

Unexpected collection

A marketing team may enable Advanced Matching without fully understanding that the Pixel can detect supported customer information from forms and other recognized sources.

Identity resolution

Hashed email and phone information can support matching against identifiers already known to another platform.

That is the feature’s purpose.

Sensitive context

Even ordinary identifiers become more sensitive when associated with a particular page or event.

An email hash combined with a conversion event on a cancer-treatment page presents a very different risk from an email hash associated with purchasing a pair of shoes.

Transparency

A privacy notice stating only that a company uses “cookies for analytics” may not accurately communicate that customer identifiers can be processed for advertising conversion matching.

Data minimization

The fact that OpenAI accepts several matching fields does not mean an advertiser needs to send every available field.

Consent and opt-out propagation

A user who rejects advertising measurement or later withdraws consent should not continue generating matching data where applicable law requires that processing to stop.

OpenAI itself places responsibility on advertisers to stop making affected data available when an opt-out, objection or withdrawal requires it.

How Captain Compliance Can Manage the OpenAI Pixel

The OpenAI Pixel should be treated like any other material advertising technology: discover it, classify it, control it, disclose it and document the user’s choice.

A compliant deployment can involve several layers.

1. Detect OpenAI Tracking

A continuous scanner should identify OpenAI advertising resources such as:

bzrcdn.openai.com

and

bzr.openai.com

as well as the advertiser-side __oppref cookie and related OpenAI measurement behavior.

Static cookie inventories age quickly. Continuous scanning matters because marketing teams frequently add or change tags without updating the privacy team’s records.

2. Classify the Pixel Correctly

The Pixel should normally be evaluated as advertising or conversion-measurement technology rather than simply necessary website infrastructure.

Classification should consider the actual configuration, jurisdiction and processing purpose.

3. Block Measurement Until the Required Consent Exists

Where prior consent is required, Captain Compliance can prevent OpenAI measurement from firing until the visitor provides the appropriate consent.

For direct implementations, that may include forcing:

oaiq("consent", false)

before Pixel initialization and changing the state only after consent.

For Google Tag Manager deployments, the OpenAI tag can also be gated through consent-aware triggering.

The important test is not whether a banner appeared before the Pixel.

It is whether the prohibited data flow was actually prevented.

4. Handle Mid-Session Consent Changes

If somebody initially rejects advertising cookies and later accepts them through the preference center, the OpenAI measurement state can be updated.

Likewise, withdrawal should stop future processing where required.

OpenAI says events blocked while measurement consent is false are not later replayed.

5. Respect Global Privacy Control and Other Opt-Out Signals

For U.S. states requiring recognition of qualifying universal opt-out mechanisms, the user’s signal should feed into the site’s broader advertising and data-sharing controls.

That may require preventing OpenAI measurement or configuring the resulting events appropriately depending on the applicable law and processing purpose.

6. Maintain Evidence

Captain Compliance consent logs can document:

• What consent interface the visitor received
• The visitor’s choice
• Applicable region
• Consent category
• Timestamp
• Subsequent preference changes

For organizations facing privacy demands or litigation, proving what happened is often as important as describing intended configuration.

7. Keep the Cookie Notice Current

When the OpenAI Pixel is deployed, the site’s cookie disclosures should identify the relevant tracking technology and purpose.

The __oppref cookie should not remain undisclosed simply because it is first-party.

8. Scan for Configuration Drift

Marketing stacks change constantly.

A technically correct OpenAI implementation today can become noncompliant after:

• A GTM trigger changes
• A new conversion event is added
• Advanced Matching is enabled
• A form is redesigned
• A new region launches
• A developer bypasses the consent layer
• A server-side event starts transmitting additional information

Continuous scanning and consent testing provide a better control than a one-time implementation checklist.

A Practical OpenAI Pixel Privacy Checklist

Before deploying ChatGPT Ads conversion tracking, organizations should be able to answer these questions:

• Is the OpenAI Pixel included in our tracker inventory?
• Is __oppref disclosed in our cookie information?
• Do we know exactly which OpenAI domains the site contacts?
• Which conversion events are transmitted?
• Have we reviewed every custom event name?
• Are product names or page names capable of revealing sensitive information?
• Is Automatic Advanced Matching enabled?
• Which matching fields can it access?
• Is measurement disabled before consent where required?
• Does the website honor withdrawal of consent?
• Are applicable opt-out preference signals honored?
• Do our privacy disclosures explain advertising measurement?
• Do our contracts and legal analysis support the OpenAI data flow?
• Are we preventing sensitive information from reaching OpenAI?
• Can we produce consent records if challenged?
• Do we continuously test that the implementation remains configured correctly?

If the answer to several of these questions is “we don’t know,” the organization does not yet have meaningful control over the tracker.

Frequently Asked Questions About ChatGPT Cookies

What cookie does the ChatGPT Ads Pixel use?

OpenAI officially documents a first-party advertiser-site cookie named __oppref. It stores the oppref click identifier associated with a ChatGPT advertisement so subsequent activity can be attributed to the original ad click.

What is oppref?

oppref is an OpenAI advertising click reference passed through the advertiser’s landing-page URL. The OpenAI Pixel can capture the identifier and persist it through the __oppref first-party cookie.

Is __oppref a third-party cookie?

No. OpenAI describes it as a first-party cookie on the advertiser’s website.

It is nevertheless used for OpenAI advertising attribution.

Does the OpenAI Pixel track purchases?

It can.

OpenAI supports an order_created conversion event as well as checkout, lead, registration, appointment, subscription and trial events.

Can the OpenAI Pixel collect email addresses?

Automatic Advanced Matching can detect supported customer information including email addresses.

OpenAI says the information is normalized and SHA-256 hashed in the browser before transmission through Automatic Advanced Matching. Raw customer information is not transmitted through that feature.

Can OpenAI receive phone numbers?

The Pixel supports hashed phone numbers as an Advanced Matching identifier.

Does hashing make an email anonymous?

Not necessarily.

Hashed identifiers can remain personal or pseudonymous information when they can still be linked or matched to an individual.

Does the ChatGPT Pixel need consent?

It depends on applicable law.

For EU visitors, non-essential advertising and measurement cookies will commonly require consent before storage or access occurs.

U.S. requirements vary by state, processing purpose and technology.

Does OpenAI’s Pixel automatically wait for consent?

No.

OpenAI states that measurement consent initializes to true by default unless the advertiser explicitly sets it to false or the Pixel finds a stored denial.

That makes CMP integration particularly important.

Does OpenAI receive my ChatGPT conversation when I visit an advertiser?

OpenAI states that advertisers do not receive users’ ChatGPT conversations merely because they advertise on ChatGPT.

Conversion measurement instead allows information about eligible activity on the advertiser’s property to be sent back to OpenAI for attribution.

Can the OpenAI Pixel create CIPA risk?

Potentially, depending on implementation and the legal theory asserted.

Website-tracking technologies have been targeted by CIPA plaintiffs, but installing an OpenAI Pixel does not by itself establish liability.

Consent, timing, data flows, the nature of transmitted information and the role of each party can all matter.

The OpenAI Pixel Is Another Reason Cookie Compliance Cannot Stop at the Banner

The emergence of the ChatGPT Ads Measurement Pixel is a useful reminder of how quickly the advertising technology stack changes.

A year ago, a company’s marketing stack might have revolved around Google, Meta, LinkedIn and TikTok.

Now ChatGPT can sit alongside them.

The privacy problem is not the existence of another logo in a cookie banner.

It is controlling what happens underneath it.

The OpenAI Pixel can preserve an advertising click identifier, transmit conversion events, associate activity with page context and use hashed customer information to improve matching. OpenAI itself tells advertisers that they are responsible for providing the required notices, obtaining necessary legal rights and consents, and honoring applicable opt-outs and consent withdrawals.

For privacy teams, that makes the implementation question straightforward:

Know when the OpenAI Pixel loads. Know what it sends. Block it when the law or user’s choice requires it. Keep disclosures current. Record the consent decision. Continuously verify that the site’s actual behavior matches its stated privacy practices.

That is what modern cookie compliance requires.