What Cookies Do ChatGPT and OpenAI Ads Use?

TL;DR: OpenAI's own sites (chatgpt.com, openai.com) list 150 cookie entries in its cookie policy: 96 necessary, 1 analytics, and 53 third-party marketing cookies for OpenAI's own marketing. Ads Manager (ads.openai.com) uses a short set of its own plus some of those. The OpenAI Pixel on your website is different: it sets only two first-party cookies, __oppref and __obref, and only when measurement consent is granted.

"What cookies does ChatGPT use?" has three different answers, depending on whose website you mean. There are the cookies OpenAI sets on its own sites, the cookies for ChatGPT Ads Manager (where advertisers log in), and the cookies the OpenAI Pixel stores on an advertiser's website. They come from two different OpenAI documents and they are not the same list. If you run ads, the third one is the one that affects your site.

This article reflects OpenAI's cookie policy as I read the en-GB version, "Last updated: 7 October 2026", and the Measurement Pixel docs as I read them on October 12, 2026. Both can change, so check the live pages before you rely on anything here.

The three meanings of "OpenAI cookies"

What cookies does ChatGPT use?

The cookie policy lists 150 entries for OpenAI's sites in three categories. A few names appear more than once (for example lidc, country and oai-did), so 150 counts entries, not distinct cookie names. The policy also says the specific cookies "may vary depending on your region, the Services you use, and your privacy choices", so what you see in your own browser can differ from the list. The policy defines "cookies" broadly to include pixels, web beacons, device IDs and local storage, not just browser cookies.

Necessary cookies

Of the 96 necessary cookies, 72 come from OpenAI itself. The rest come from vendors: Auth0 (8), Cloudflare (5), Swoogo (4), Intercom (3), Stripe (2), Datadog (1) and Google (1).

By stated purpose, the biggest groups are service functionality (46) and user authentication (21). The rest are cookie consent (9, plus one "Consent cookies" entry from Swoogo), security (8), onboarding (3), customer support (3), payment (2), personalized marketing consent (2) and error reporting (1).

Examples listed for chatgpt.com:

• _puid (7 days)
• _uasid (1 day)
• _account (session)
• oai-did (2 years)
• oai-sc (1 year, security)
• oai-locale (1 year)
• next-auth.session-token (session)

The consent cookies on chatgpt.com and openai.com include oai_consent_analytics, oai_consent_marketing, oai_consent_personalization, oai-allow-ne and oai-logged-out-consent-chosen.

Analytics cookies

Exactly one: __obi, 1 year, on chatgpt.com and openai.com.

Marketing Performance cookies

This is the long list that surprises people. All 53 are third-party, from eight vendors, and durations range from 24 hours to 24 months.

Some examples of the durations: Google IDE is 24 months, Meta datr and sb are 400 days, gclid is 24 hours and TikTok _ttp is 13 months.

These cookies are described as supporting "our marketing efforts", meaning OpenAI's own marketing of its services on its own sites. The policy does not say they are set on advertiser websites. I'm not reproducing all 53 here, so use the policy for the full list.

What cookies does OpenAI use for ads (Ads Manager)?

If by "OpenAI ads cookies" you mean the cookies on the advertiser dashboard at ads.openai.com, the policy lists these:

On top of that, 25 of the 53 marketing performance cookies above are listed as applying to ads.openai.com. The policy does not explain further what each cookie stores, and I won't guess at it.

What cookies does the OpenAI Pixel set on your website?

This is the list that matters for your own site, and it's much shorter. The Measurement Pixel docs say: "When measurement consent is granted, the Pixel uses these first-party cookies on your website."

How the expiry behaves:

• __oppref: each time the Pixel captures a non-empty oppref URL parameter, even the same value again, it resets the expiry to 30 days. Reading the stored cookie on a visit without the parameter does not extend it.
• __obref: the Pixel reuses a valid stored reference without extending its expiry. If it's missing or invalid, the Pixel creates a new one with a new 365-day expiry.

Two caveats from the docs. These are "the lifetimes requested by the Pixel", and "browser restrictions or clearing cookies can shorten them". And "cookie expiry is separate from conversion attribution windows and conversion-data retention", so a 30-day cookie doesn't mean a 30-day attribution window. For what oppref is and how to preserve it through redirects, see my conversion tracking setup guide and the UTM tracking post.

Two related points. Automatic advanced matching, when enabled, detects supported form data, normalizes and hashes it with SHA-256, and includes the hash with conversion events. That's data in the event, not one of the two cookies. And the Conversions API is server-to-server, so the API call itself doesn't set a browser cookie.

Does ChatGPT Ads use third-party cookies?

Two separate answers, one for each place:

• On your website: the Pixel docs name two cookies, __oppref and __obref, and describe both as first-party. They don't list any third-party cookies for the Pixel.
• On OpenAI's own sites: yes. The cookie policy lists 53 third-party marketing performance cookies from Google, Snapchat, Meta, Reddit, LinkedIn, Bing, TikTok and Impact. That is OpenAI measuring its own marketing, not something the policy says is placed on your site.

So the 150 versus 2 comparison is the useful one. The long third-party list is about OpenAI's own site setup. What lands on your domain from the Pixel is two first-party cookies.

What to do about cookies and consent if you advertise on ChatGPT

This is what I'd check, not legal advice. Whether and how you need consent depends on where your visitors are, so confirm your requirements with your privacy counsel.

1. Know the Pixel's default. The docs say the Pixel initializes consent to true by default unless you set it to false or the Pixel finds a stored denial. If your site needs consent before measurement, you have to change that default yourself.

2. Set consent to false before init, and grant it after the visitor agrees. The documented pattern:

oaiq("consent", false);
oaiq("init", { pixelId: "<YOUR-PIXEL-ID>" });

// later, after the visitor accepts in your consent banner
oaiq("consent", true);

When consent is false, the Pixel doesn't send measurement-event pings. Setting it to true allows future measurement events, but blocked events aren't replayed. A visitor who accepts on page three doesn't retroactively send what they did on pages one and two.

3. Disclose the two cookies yourself. __oppref and __obref are first-party cookies on your domain, so your own cookie policy and consent banner are what cover them. List them there with the expiries from the table above.

Which category are they? OpenAI's docs don't label them marketing or analytics. They only call them first-party cookies and gate them on "measurement consent". Going by what they do, I'd put both under marketing: __oppref holds the ad click identifier so a later conversion can be attributed to a ChatGPT ad, and __obref is a random browser reference the Pixel uses to recognize the browser. That is the same job as ad-platform cookies like Google's _gcl_aw or Meta's _fbc and _fbp, and neither gives you site analytics. This is my reading, not an OpenAI statement, so confirm the classification with your privacy counsel.

4. If you use Google Tag Manager, gate the tag on your consent signal. The cleanest approach is to fire the OpenAI tag only once your consent tool reports agreement. The GTM template walkthrough covers installing the tag. I haven't confirmed whether the OpenAI template exposes its own consent setting, so test in GTM Preview that nothing fires, and no __oppref or __obref appears, before a visitor consents.

5. Check your visitors' regions. If you're advertising to European visitors, the self-serve rollout in Europe is worth reading alongside your own consent setup. The cookie policy itself says the cookie list varies by region.

Finally, run a real test. Open your site in a clean browser profile, decline consent, and check the browser's cookie storage. If __oppref or __obref is there, your consent gate isn't working.

Frequently asked questions

What cookies does ChatGPT use? On OpenAI's own sites, the cookie policy lists 150 entries: 96 necessary (authentication, security, consent, payments and similar), 1 analytics cookie (__obi), and 53 third-party marketing performance cookies. The policy says the exact list varies by region, the services you use and your privacy choices.

Does ChatGPT Ads use cookies on my website? Yes, if you install the OpenAI Pixel. Per OpenAI's Measurement Pixel docs, when measurement consent is granted it uses two first-party cookies on your site, __oppref and __obref. The Conversions API is server-to-server and sets no browser cookie.

What are __oppref and __obref? __oppref stores the oppref attribution identifier from the landing page URL and expires 30 days after the Pixel writes it. __obref is a randomly generated browser reference for your website and expires 365 days after creation. Both lifetimes can be shortened by browser restrictions or cleared cookies.

Are __oppref and __obref marketing or analytics cookies? OpenAI doesn't say; its docs call them first-party cookies used when measurement consent is granted. Because __oppref stores the ad click identifier and __obref is a browser reference used for attribution, I'd classify both as marketing (advertising measurement), not analytics. That's my reading, so confirm it with your privacy counsel.

Do I need cookie consent to use the OpenAI Pixel? It depends on where your visitors are, and I can't give legal advice, so confirm with your privacy counsel. Technically, the Pixel defaults to consent true, so if your site requires consent you must set oaiq("consent", false) before init and call oaiq("consent", true) after the visitor agrees.

How do I turn off OpenAI Pixel cookies for visitors who decline? Call oaiq("consent", false) before oaiq("init", ...), and keep it false for visitors who decline. Per the docs, that stops measurement-event pings, and calling it removes both cookies. If a visitor accepts later, oaiq("consent", true) allows future events, but blocked events aren't replayed.

---

For the cookie policy itself, see OpenAI's cookie policy; for the Pixel's cookies and consent behavior, see the Measurement Pixel docs. OpenAI's cookie policy lists a contact for privacy questions: privacy@openai.com.

If you sell products and want the Pixel, the Conversions API and your consent setup wired up correctly, that's what my ChatGPT Ads conversion tracking for ecommerce service covers. If you're a local service business tracking leads, calls and form submissions, see ChatGPT Ads conversion tracking for lead generation.