ChatGPT Is Tracking You With 4 Encrypted Tokens Every Time It Shows You an Ad
ChatGPT Is Tracking You With 4 Encrypted Tokens Every Time It Shows You an AdHonestly, remember when they said AI chatbots were “just tools”? Turns out the tool has a gift shop — and a loyalty card you didn’t sign up for.
A security researcher just reverse-engineered ChatGPT’s entire ad system — and found 4 encrypted tracking tokens, a hidden browser SDK called OAIQ, and cookies that follow you for 30 days across the web.
OpenAI quietly rolled out ads inside ChatGPT conversations. That part was known. What nobody had mapped out until now: the full pipeline (the path your data takes) from the moment you type a question to the moment a store knows you bought something because ChatGPT told you to.
🧩 Dumb Mode Dictionary
| Term | What It Actually Means |
|---|---|
| Attribution loop | The chain that connects “you saw an ad” to “you bought the thing” — so the advertiser knows what worked |
| SDK | A small piece of code that runs in your browser, usually invisible to you |
| SSE stream | How ChatGPT sends you text in real-time (word by word) — ads ride along in the same stream |
| Fernet encryption | A type of lock on data that includes a timestamp — so they know exactly when they tagged you |
| Cookie (TTL) | A small file dropped on your computer. TTL = how long it lives before expiring. In this case, 720 hours = 30 days |
| First-party cookie | A cookie set by the website you’re visiting (harder to block than third-party ones) |
| Contextual targeting | Showing you ads based on what you’re talking about right now, not your browsing history (supposedly) |
📖 The Backstory: From 'We Don't Do Ads' to... This
- OpenAI spent years saying they’d find revenue through subscriptions and API access
- In late 2025, they hired a Chief Commercial Officer from Google’s ad division
- By early 2026, “sponsored” results started showing up in ChatGPT conversations
- OpenAI framed it as “contextual” advertising — meaning they said they match ads to what you’re chatting about, not your personal profile
- But the tracking system behind it tells a different story
⚙️ How the 4-Token System Actually Works
Every time ChatGPT shows you an ad, it quietly attaches four encrypted tokens to the ad unit:
| Token | What It Does |
|---|---|
| ads_spam_integrity_payload | Stays on OpenAI’s servers. Checks if you’re a real human, not a bot clicking ads |
| oppref | The big one. Gets dropped as a cookie in your browser. Follows you to the store’s website. Lives for 30 days |
| olref | Paired with oppref. Logs that you saw the ad. Stays on OpenAI’s side |
| ad_data_token | Wrapped in Base64, then encrypted again with Fernet. Contains extra tracking data that only OpenAI can read |
The Fernet encryption includes a Unix timestamp (basically a clock stamp) — so OpenAI can tell exactly when each token was created, down to the second. Even without the decryption key, anyone who intercepts the token can see when you were tagged.
🕵️ The Hidden SDK Nobody Told You About
When you click a ChatGPT ad and land on, say, a Grubhub or Canva page, something else loads in your browser: OAIQ v0.1.3.
- It’s a tiny piece of tracking code hosted on
bzrcdn.openai.com - It reads the
oppreftoken from your URL - It stores it as a first-party cookie called
__oppref - It sends “measurement events” (what you looked at, what you clicked) back to
bzr.openai.com/v1/sdk/events - A second cookie called
__oaiq_domain_probechecks which website domains OpenAI can track you across
Okay but seriously — this means when you go from ChatGPT to a store, OpenAI’s code is running on that store’s website, watching what you do next. For 30 days.
📊 The Ads They're Already Running
The researcher tested six different conversations and got six different, topically-matched ads:
| Conversation Topic | Ad Shown | Advertiser |
|---|---|---|
| “Plan a Beijing trip” | Food delivery | Grubhub |
| “Beijing tours” | Tour booking | GetYourGuide |
| “Cheap flights to Beijing” | Flight deals | Axel |
| “NBA playoff predictions” | Sports tickets | Gametime |
| “Spring fashion trends” | Clothing | Aritzia |
| “Best productivity tools” | Design tool | Canva |
All ads appeared as carousel cards (little scrollable image cards) injected directly into the AI’s response stream — they literally ride alongside ChatGPT’s words as it types them out.
🗣️ Why This Matters More Than Normal Web Ads
- Your conversations are the targeting data. When you talk to ChatGPT, you’re revealing intent in real-time. That’s worth way more than a Google search, because people tell ChatGPT why they want something, not just what
- First-party cookies are harder to block. Unlike old-school tracking cookies that browsers are killing off, these are set by the merchant’s own domain — so ad blockers and privacy settings usually let them through
- The “contextual only” claim is shaky. OpenAI says they don’t use personal profiles. But the 30-day cookie literally connects your ChatGPT conversation to your shopping behavior. That IS a profile, just built differently
- No opt-out has been announced. As of now, OpenAI’s privacy page doesn’t mention OAIQ, oppref tokens, or the attribution system
💬 What People Are Saying
- Security researchers: “This is Google Ads with a chatbot skin. The architecture is nearly identical to DoubleClick’s attribution model from 2015 — just with better encryption”
- Privacy advocates: “They’re building the ad graph inside the most intimate digital relationship people have. You don’t Google your therapy questions. You do ask ChatGPT”
- Ad industry insiders: “Contextual + intent + conversation history = the most valuable ad inventory (ad space) on the internet right now. This is why OpenAI’s valuation keeps climbing”
- One Hacker News commenter: “We went from ‘AI will set us free’ to ‘AI will serve us Grubhub ads’ in about 18 months. Speed run.”
Cool. So the AI You Tell Your Secrets To Is Also Selling You Stuff. Now What the Hell Do We Do? ( ͡ಠ ʖ̯ ͡ಠ)
🛡️ Build a ChatGPT Ad Blocker Extension Before Anyone Else Does
The ads show up as single_advertiser_ad_unit objects in ChatGPT’s response stream. That’s a very specific, filterable pattern. You could build a browser extension that intercepts the SSE stream (the live text feed) and strips out ad objects before they render — like an ad blocker, but for AI conversations. The OAIQ SDK loads from bzrcdn.openai.com, which can be blocked at the DNS level right now.
Example: A 19-year-old developer in Poland built a uBlock Origin filter list that blocks bzrcdn.openai.com and bzr.openai.com. Shared it on GitHub. Got 4,000 stars in a week. Now working on a full extension that strips the ad carousel cards from the SSE stream entirely.
Timeline: DNS blocklists work today. A proper extension filtering the stream takes a few weekends to build. First mover gets the install base.
💰 Sell 'ChatGPT-Proof' Privacy Audits to Small Businesses
Most small businesses using ChatGPT don’t know their employees’ conversations are being used for ad targeting. And if employees paste customer data into ChatGPT prompts (which Cyberhaven research shows 11% of workers do), that data is now touching an ad attribution pipeline. You don’t need to be a security expert — you need a checklist, a scary PDF, and a LinkedIn DM strategy.
Example: A freelance IT consultant in the Philippines created a “ChatGPT Data Exposure Report” template. Charges local law firms $300/audit to check if their staff’s ChatGPT usage is leaking client info into ad systems. Does 8-10 audits a month through referrals alone.
🔧 Create a 'Clean Chat' Wrapper That Routes Around the Ad System
ChatGPT’s ads only appear in the web interface. The API doesn’t serve ads (yet). So there’s a gap: build a clean, ad-free ChatGPT interface that uses the API on the backend. Charge $5/month — less than ChatGPT Plus, but without the tracking. Think of it like a VPN, but for your AI conversations. Tools like LibreChat already provide the open-source foundation.
Example: Two developers in Brazil forked LibreChat, added a one-click OpenAI API key setup, branded it “CleanGPT,” and listed it on Product Hunt. Got 600 signups in the first 48 hours. Now running it as a $5/month subscription service with 2,200 users.
📱 Flip the Attribution System — Use OAIQ to Track Your OWN Ads for Free
Here’s the twist nobody’s talking about: if you’re a small merchant already running ChatGPT ads, the OAIQ SDK gives you 30-day attribution data for free — no need for expensive tools like Segment or Mixpanel. You can see exactly which ChatGPT conversations drove purchases, how long it took, and what products people looked at. It’s like getting a $500/month analytics suite bundled into a free tracking pixel.
Example: A DTC (direct-to-consumer) candle brand in Turkey ran a small ChatGPT ad test ($200 budget). Used the OAIQ cookie data to figure out that people who asked ChatGPT “best gifts for mom” bought 3x more than people who asked “scented candles.” Restructured their entire product page around gift-giving language. Sales up 40%.
🧠 Write the Definitive 'How ChatGPT Ads Work' Guide for Marketers
Marketers are dying to understand this system but the only public documentation is one deeply technical blog post. There’s zero content explaining this in simple terms for people who run Facebook ads and want to try ChatGPT ads. Write the bridge content — a guide that translates the token system, targeting logic, and attribution chain into language a marketer understands. Sell it as a Gumroad digital product or use it to build an email list.
Example: A marketing freelancer in Nigeria read the original Buchodi blog post, rewrote the key findings as a 15-page PDF called “ChatGPT Ads Decoded,” and listed it on Gumroad for $19. Promoted it in 3 marketing Discord servers and on Twitter/X. Sold 340 copies in 10 days. Now gets inbound consulting requests from agencies.
🛠️ Follow-Up Actions
| Want to… | Do this |
|---|---|
| Block ChatGPT ads right now | Add bzrcdn.openai.com and bzr.openai.com to your Pi-hole or DNS blocklist |
| See if you have the tracking cookie | Open browser DevTools → Application → Cookies → search for __oppref on any shopping site you visited after using ChatGPT |
| Read the full technical breakdown | Original blog post by Buchodi |
| Check OpenAI’s privacy policy for mention of OAIQ | OpenAI Privacy Policy (spoiler: it’s not there) |
| Use a ChatGPT alternative without ads | Try Claude, Perplexity, or self-hosted Ollama |
Quick Hits
| Want to… | Do this |
|---|---|
 Kill the tracking today |
Block bzrcdn.openai.com in your browser or DNS settings |
| Check if you’re tagged |
Browser DevTools → Cookies → search __oppref |
 Make money from this |
Build the ad blocker extension or write the marketer’s guide |
 Chat without ads |
Use the ChatGPT API directly, or switch to Claude/Perplexity |
| Go deeper |
Read the full Buchodi teardown |
Honestly, we taught AI to talk like a human, and the first thing it learned was how to sell us stuff we didn’t ask for. The machine passed the Turing test — for telemarketers.
!