Which cookies ChatGPT sets and what its ads changed

ChatGPT sets three groups of cookies on chatgpt.com: necessary cookies for sign-in, security and your settings, one first-party analytics cookie, and marketing performance cookies from eight advertising platforms, including Google, Meta, LinkedIn and Microsoft. The last two groups need your opt-in in the EU and the UK. That is the picture in OpenAI's cookie policy as last updated on 7 October 2026.

The cookie footprint of ChatGPT has grown since its 2022 launch, and 2026 added ads inside ChatGPT for Free and Go users. A logged-out visit to chatgpt.com on 16 October 2026 showed a banner with Accept all, Reject non-essential and Manage, while the page's scripts could already read three cookies: oai-did, oai-sc and oai-mweb-origin. If you run a website that integrates with OpenAI's services, or redirects users to chatgpt.com, the consent rules behind those choices are worth knowing.

The cookies ChatGPT sets, group by group

OpenAI groups its cookies into three categories, mirroring the standard classification used across most cookie categories in the industry. The OpenAI cookie policy names them Necessary, Analytics and Marketing Performance, and lists every cookie with its duration and domain. It is a separate document from OpenAI's privacy policy: the cookie policy says what is stored in your browser, while the Europe version of the privacy policy (updated 24 August 2026, for the EEA, the UK and Switzerland) covers everything OpenAI does with personal data, including your chats.

Necessary cookies

These are the cookies ChatGPT cannot function without. Block them and you lose the ability to log in, keep a session or remember your settings. The policy labels each one by purpose. Examples from the October 2026 list:

Under both the GDPR and the ePrivacy Directive, strictly necessary cookies are exempt from consent requirements. Article 5(3) of the ePrivacy Directive permits cookies that are essential for a service explicitly requested by the user. Logging into ChatGPT qualifies.

That said, the line between "necessary" and "functional" is not always obvious. A cookie like oai-locale stores your language preference for a year: useful, but arguably not essential to the core chat functionality. Different data protection authorities may classify it differently.

Analytics cookies on ChatGPT

OpenAI uses analytics cookies to understand how people interact with ChatGPT: which features see the most use, where users encounter friction, and how the platform performs. The October 2026 policy lists one first-party analytics cookie, __obi, kept for a year on chatgpt.com and openai.com. It helps OpenAI improve the product, but ChatGPT works without it.

In jurisdictions that follow the GDPR model, analytics cookies require prior opt-in consent. They fall outside the "strictly necessary" exemption because they serve the platform operator's interests, not the user's immediate request. The French CNIL has been particularly firm on consent, fining Google EUR 325 million in September 2025 over ads shown between Gmail emails without consent and over the consent it collected for ad cookies when people created a Google account.

OpenAI's cookie policy says that, where the law gives you the choice, you can change cookie settings directly on each of its sites, and that the settings are stored per device and per browser. Logged out, the banner's Manage button opens them. Your browser's own cookie settings work as a second route.

Marketing performance cookies

This is where things get more complex. ChatGPT sets marketing cookies from eight third-party platforms: Google, LinkedIn, Meta, Reddit, TikTok, Microsoft Bing, Snapchat and Impact. These cookies help OpenAI measure the advertising campaigns that bring people to ChatGPT. Examples from the October 2026 policy:

All of these fall under the same opt-in rule as analytics cookies in the EU and the UK. "Reject non-essential" on the banner refuses both groups at once.

Ads inside ChatGPT changed the picture in 2026

OpenAI began testing ads inside ChatGPT with a US pilot in February 2026, then brought them to 31 European markets, including Germany, France, Spain, Italy and the Netherlands, as announced on 18 August 2026. OpenAI's European ads announcement adds that self-service buying through Ads Manager opened in those markets on 31 August 2026. Ads appear only on the Free and Go plans. ChatGPT Go launched in India in August 2025 and worldwide on 16 January 2026, at USD 8 per month in the US.

OpenAI says it keeps conversations private from advertisers and never sells customer data. The ad platform itself has grown well beyond contextual ads: advertisers can now use geo-targeting, custom audiences and conversion optimisation, and they measure results through the OpenAI Pixel and a Conversions API. For a European user, the consent question sits in two places. OpenAI's Europe privacy policy says ads are personalised with your consent, that past chats make ads more relevant when ad personalisation is on, and that Free and Go users control it in account settings. The cookie policy records that choice in its own cookies, oai_consent_personalization and personalized_marketing_consent, each kept for 6 months. How the ChatGPT advertising programme uses cookies has its own explainer on this blog.

ChatGPT Plus sets the same cookies, without the ads

OpenAI's cookie policy does not split its cookie list by plan. A Plus subscriber gets the same necessary cookies as everyone else, and the analytics and marketing performance cookies still depend on the choice made in the cookie banner, not on the subscription. What Plus changes is advertising: OpenAI's January 2026 Go announcement says Plus, Pro, Business and Enterprise stay ad-free. The ad personalisation setting and its consent cookies therefore matter only on the Free and Go plans.

The GDPR and ChatGPT: a regulatory timeline

OpenAI's relationship with European data protection authorities has been anything but smooth. In March 2023, Italy's Garante temporarily banned ChatGPT after a data breach exposed chat histories and partial payment details of a small number of ChatGPT Plus subscribers. The ban lasted roughly a month before OpenAI implemented measures to address the Garante's concerns.

The investigation continued. In December 2024, the Garante fined OpenAI EUR 15 million for multiple GDPR violations, including training ChatGPT on personal data without an adequate legal basis, failing to notify the authority of the March 2023 breach, and lacking proper age verification for users under 13. OpenAI was also ordered to run a six-month public awareness campaign across Italian media. The decision did not last: on 18 March 2026 the Court of Rome upheld OpenAI's challenge (judgment no. 4153/2026), and the Garante took the decision off its website.

OpenAI has since established its European headquarters in Ireland, activating the GDPR's one-stop-shop mechanism. Primary supervisory authority now sits with the Irish Data Protection Commission.

The CNIL's September 2025 fines against SHEIN (EUR 150 million for cookie and consent breaches) and Google (EUR 325 million over Gmail ads and consent at account creation) show a broader trend: European regulators enforce cookie consent rules against the largest platforms, and AI platforms are not exempt.

What this means if your website uses ChatGPT

Your obligations depend on how your website interacts with OpenAI's services.

API integration (server-to-server)

If your website integrates with OpenAI's services through the API to power chatbots, content generation or internal tools, OpenAI does not place any cookies on your users' browsers. The API operates server-to-server: your users never interact directly with chatgpt.com. No cookies from OpenAI, no additional consent obligations related to those cookies.

Your own cookies still apply, of course. If you use Google Analytics or marketing pixels alongside your ChatGPT-powered features, those require their own consent flows.

Redirecting users to chatgpt.com

If your website links to or redirects users to chatgpt.com, OpenAI controls the cookies set during that interaction. Your responsibility is limited, but you should inform users in your privacy policy that they may be redirected to a third-party service with its own cookie and data practices.

Advertising on ChatGPT with the OpenAI Pixel

If you buy ChatGPT ads and add the OpenAI Pixel to your own site to measure conversions, that pixel is a marketing tracker on your domain. It belongs in your consent banner's marketing category and should load only after a visitor accepts that category, like any other advertising pixel. A server-side Conversions API call does not set a cookie, but it still sends visitor data to OpenAI, so your privacy policy needs to say so.

Embedding third-party ChatGPT widgets

This is the grey area. If you use a third-party chatbot widget that relies on OpenAI but runs on your domain, any cookies that widget sets, whether analytics, functional or marketing, may become your responsibility. Under the controller-processor framework, the entity that determines the purposes and means of data processing bears the primary responsibility. If the widget sets cookies on your domain, that entity is likely you.

Run a cookie scan after installing any ChatGPT-based widget. You need to know exactly what cookies appear and categorise them correctly in your consent banner.

Managing cookie consent for AI-powered services

The rules for AI platform cookies are no different from the rules for any other website cookie. The core GDPR principles still apply: lawfulness, transparency, purpose limitation and data minimisation.

For website owners, the practical steps are clear. Audit your site to identify every cookie, including those set by third-party AI integrations. Classify each cookie correctly. Block non-essential cookies until the user gives informed, affirmative consent: pre-ticked boxes and implied consent through continued browsing do not meet the GDPR standard.

If you operate in the United States, the CCPA and CPRA use an opt-out model rather than opt-in. The opt-out requirements still demand a clear mechanism, and several US state laws require businesses to honour Global Privacy Control signals. Brazil's LGPD takes a consent-centric approach similar to the GDPR, while Canada's PIPEDA requires meaningful consent proportional to data sensitivity.

The bigger picture: AI, advertising and cookie law

OpenAI presents ads as the way to keep free and low-cost access to ChatGPT going. Advertising brings marketing cookies from Google, LinkedIn, Meta and other ad networks into the ChatGPT experience, and with the OpenAI Pixel it now reaches advertisers' own websites too.

The European Commission's 19 November 2025 Digital Omnibus proposal would move the cookie rules from the ePrivacy Directive into the GDPR. As of October 2026, it is still at the committee stage in the European Parliament, so none of it applies yet.

For now, non-essential cookies, including the analytics and marketing cookies ChatGPT uses, require prior opt-in consent in the EU and the UK. Google Consent Mode v2 has become the industry standard for passing consent signals to advertising platforms.

Short answers about ChatGPT cookies

Check what your AI integrations set before visitors do

If your website integrates with ChatGPT, embeds an AI chat widget or runs the OpenAI Pixel, the first step is knowing which cookies appear on your own domain. Kukie.io's Cookie scanner lists every cookie a page sets and the category it belongs in, so you can see what needs consent before you adjust your banner.