OpenAI's Ad Pixel Tracks by Default, and European Shops Aren't Switching It Off

OpenAI's advertising business expanded to more than 60 countries in late September 2026. Its ad-measurement pixel is already turning up on the European sites we track. (OpenAI)

We found OpenAI's ChatGPT advertising pixel in the markup of 341 retail sites, most of them European. To see what each one actually does, we loaded every site in a headless browser with no stored cookies, left any consent banner untouched, and recorded the requests. The 13 sites not counted in the figures above loaded the code without a clear event, or could not be tested.

Most of the firing sites are in the EU: nearly three-quarters are on continental-European domains, with Poland the largest single share, followed by Germany, the Netherlands, France, Italy and Spain.

Germany is the one that stands out in the data. Barely a third of German sites fire the pixel before consent, against three-quarters in Poland and the UK; the rest hold it back.

The common cause is the pixel's default. It ships with tracking switched on, and most of these shops never switched it off.

Why the pixel fires before you choose

The pixel is a JavaScript loader called oaiq. A site loads it from bzrcdn.openai.com/sdk/oaiq.min.js and calls oaiq("init", { pixelId: "..." }). OpenAI's documentation says the pixel "initializes consent to true by default unless you set it to false or the Pixel finds a stored denial." So a shop that installs the pixel and sends a page-view event is tracking from the first load.

Turning that off is a separate, easily-missed step. The copy-paste snippet under "Install the Measurement Pixel" has no consent call in it. Holding the pixel back for European visitors means adding oaiq("consent", false) before init and granting consent only after the visitor accepts, which OpenAI documents under a different heading, "Control measurement consent", lower down the page. Most people never go past that first snippet: it looks complete, so they copy it, paste it, and assume it includes everything they need.

The documented install ends here, before any consent call:

// OpenAI's documented install snippet: init only, no consent call
oaiq("init", { pixelId: "<YOUR-PIXEL-ID>" });

We tested the SDK ourselves to be sure the fault is the default and not a broken control. In a controlled harness, calling oaiq("consent", false) before init suppressed every measurement event across repeated runs, in both headless and normal Chrome; it also stopped the pixel-config fetch and wrote no attribution cookie. The consent control works. One small request still goes out even when consent is false: a diagnostic ping carrying "consent": false and no identifiers, which tells OpenAI a consent-denied visit happened but sends no measurement.

Watch it happen on one site

One of the affected sites is a Dutch travel retailer running Cookiebot. We are not naming it here because it is still inside our disclosure window: we reported what we found to the site before publishing and gave it 3 working days to respond before we attach its name to it.

The example below is anonymised for that reason. The site may be named in a later update, once that window closes.

The behaviour is reproducible in a few seconds, in a fresh browser with no prior visit. Load the homepage and the Cookiebot banner appears, offering a real choice: accept all cookies, or only necessary ones.

Do not touch the banner. Open the browser's developer tools, filter the network panel to openai, and the requests are already there. The pixel has loaded and sent a measurement request to bzr.openai.com/v1/sdk/events, while the consent choice is still on screen.

Cookies have been set too, before the visitor has agreed to anything: an __obref attribution cookie on the site's own domain, and a set of cookies on OpenAI's domains (openai.com, bzr.openai.com, bzrcdn.openai.com), shown below.

Now click "Only necessary cookies", declining marketing, and move to another page on the site. A fresh measurement request goes out to OpenAI again. The decline changed nothing for this pixel.

You can confirm the same thing in the console: Cookiebot reports marketing consent as false throughout, while the page's own request log shows the OpenAI measurement endpoint has been hit.

Cookiebot.consent.marketing            // => false
performance.getEntriesByType('resource')
  .filter(e => e.name.includes('openai.com'))
// => bzrcdn.openai.com/sdk/oaiq.min.js
//    bzrcdn.openai.com/pixel-config/v1/<pixelId>.json
//    bzr.openai.com/v1/sdk/events

The two systems do not agree because they are not connected. Cookiebot manages the site's other marketing tags, but the OpenAI pixel sits outside it as a plain script with no oaiq("consent", ...) call, its default left on. The banner records the visitor's choice, and the pixel measures regardless.

Check it yourself

The test is reproducible in any browser. Open a site's developer tools, go to the network tab, filter for openai, and load the page without clicking the banner. A site that holds the pixel back shows no request to OpenAI. On weck.de, a German houseware shop that does gate it, the oaiq block is served as a non-executing script:

<script type='text/plain' data-cookieconsent='marketing'>
  oaiq('init', { pixelId: "8j2TfLDjxCc7Npt5WuwjjV" })

Cookiebot rewrites that into live JavaScript only after the visitor accepts marketing cookies, so nothing reaches OpenAI until then. On the 224, the request goes out on load.

One pixel ID across several countries

Some of the adopters are multi-country retail operators running one OpenAI pixel ID across their localised domains. One cycling retailer serves the same pixel ID across its French, German and Italian sites. Its init call still carries debug:true, a flag developers usually remove once setup is finished.

What the law requires, and what it costs to ignore

These shops are not new to ad tracking: three-quarters already run Google Analytics and a third run Meta's pixel. OpenAI's pixel needs the same consent gate as those tags, and on 224 of these sites it sends a request to a US company's advertising platform before anyone has consented.

In the EU and UK, the general rule is settled: storing or reading non-essential information on a visitor's device, and the advertising and measurement that rely on it, require prior consent under the ePrivacy rules, with GDPR setting the standard for what valid consent looks like. Advertising conversion tracking is squarely within that; the UK ICO and the Irish Data Protection Commission both name it as a use that needs consent. Whether any particular site has met that obligation is a separate question we do not answer here.

The rule comes from the same EU ePrivacy Directive (2002/58/EC, Article 5(3)) in every member state, implemented through national law and enforced by each country's data-protection authority. For the countries in this dataset:

The implementations differ in detail and in how firmly they are enforced. Spain allows a narrow carve-out for privacy-configured first-party analytics; the core requirement, consent before non-essential tracking, is common to all of them.

The consequences here are real, and the recent fines are for this exact pattern.

In September 2025, France's data-protection regulator, the CNIL, fined the operator of the fast-fashion site shein.com 150 million euros. The reason: advertising cookies were placed on visitors' devices the moment they arrived, before any interaction with the consent banner, and were still read after users clicked "Refuse all". That is the same sequence we recorded: fire before the choice, and keep firing after a decline. (CNIL decision)

In November 2025 the same regulator fined American Express 1.5 million euros for three failures that read like a checklist of what we observed: cookies placed before any choice, cookies placed despite an explicit refusal, and cookies that kept being read after consent was withdrawn. (CNIL decision)

And in September 2025 the CNIL fined Google 325 million euros over how it steered people into advertising cookies. (CNIL decision)

Under the French rules a cookie fine can reach 10 million euros or 2% of worldwide turnover. In the UK the ICO's cookie-penalty ceiling is rising from 500,000 pounds to 17.5 million pounds, or 4% of global turnover, under the Data Use and Access Act 2025. (ICO) A pixel that fires before the banner is answered sits in exactly the territory these fines came from.

×

×

×

×

×