On September 20, a researcher known as Buchodi published findings indicating that advertising code associated with OpenAI can cause partner online stores to send browsing and purchase information back to OpenAI, tagged to individual ChatGPT accounts. The demonstration showed that such data packets arrive at an OpenAI endpoint, while not establishing what OpenAI retains or how it processes those data.
What the researcher presented
- Buchodi reported that partner merchants’ reports about what users viewed and purchased can be linked to ChatGPT accounts.
- In his demonstration he proved that the data arrive at an OpenAI address or endpoint. He did not demonstrate which of those data OpenAI stores or how long they are kept.
How this differs from traditional ad tech
Traditional ad networks, such as those run by Google and Meta, usually infer interests from browsing activity and then show targeted ads based on that inference. The mechanism Buchodi describes goes further by reporting concrete browsing and purchase events from partner stores back to OpenAI, and by associating those events with ChatGPT accounts.
What was and was not proven
The presentation established that data transmissions reach OpenAI. It did not provide evidence about internal retention policies, the details of internal processing, or whether OpenAI sells or otherwise commercializes those data. The distinction between proving data arrival and proving data storage or use is key.
Why this matters
If the described flows are accurate, they raise questions about the richness of profiles that could be constructed. Beyond knowing what a user bought, richer signals could reveal context: motivations, concerns, or alternatives considered. Such details deepen privacy and ethical considerations compared with standard ad targeting, but Buchodi’s work stops short of proving the full downstream use of the data.
Next steps and open questions
Further independent analysis is needed to determine:
- which specific fields are transmitted;
- how long any received data are retained in OpenAI systems;
- what internal processing or profiling occurs; and
- whether any data are sold, shared with advertisers, or combined with other datasets.
Until OpenAI or partner merchants publish detailed documentation or independent audits clarify these points, demonstrations like Buchodi’s serve as an entry point for discussion about transparency, data practices, and regulatory scrutiny.
