Researcher Buchodi has detailed the operation of an advertising tracking platform within ChatGPT, internally codenamed bazaar. The system utilizes domains bzr.openai.com and bzrcdn.openai.com to collect data from commercial websites that have integrated OpenAI advertising pixels.
The analysis of the tracking mechanism revealed 936 pixels across 1,029 hosts, with 23,929 requests recorded without URL query strings. The tool captures information from page content, forms, and tag management systems, including conversion events and user geolocation data such as zip codes.
According to the report, the system transmits email addresses and phone numbers in a hashed format using the SHA-256 algorithm. While some data is encrypted, location details like country, region, and city are transmitted in plain text. The researcher noted that the tracking affects both logged-in and anonymous users.
Out of the 932 decoded sync tokens analyzed, 736 belonged to registered users, while 196 were linked to anonymous visitors. The researcher compared this data collection practice to the advertising technologies employed by Meta and Google, highlighting its integration into AI-based chat products.
