OpenAI’s ad pixel fires before consent on 224 of 341 shops

Of 341 retail sites running OpenAI’s ChatGPT ad pixel, 224 sent a measurement event to OpenAI before the visitor had agreed to anything, according to a Ciphercue scan run on October 22. Only 104 held the pixel back until consent.

Ciphercue started from about 112,000 sites whose served markup it holds and found 341 loading OpenAI’s pixel on October 20. Most of them are European. Two days later it opened each one in headless Chrome with a fresh profile and no stored cookies, left any consent banner alone, and logged every request. A site counted as firing if the log held a request to bzr.openai.com/v1/sdk/events. That leaves 13 sites outside the main figures: 3 downloaded the SDK but sent no event, and 10 gave an indeterminate capture. Both groups were counted as not measuring. The scan covers one homepage load per site, from one location, on one day.

Who fires, and who waits

Of the 224 firing sites, 95 had a recognised consent-management platform loaded on the page and 129 had none. So on about 42% of the shops that fire, the request goes out while a banner is still asking the visitor to choose. On the sites Ciphercue opened by hand, that banner showed a visible Accept and Reject choice.

Nearly three-quarters of the firing sites are on continental-European domains. Poland has the largest single share, followed by Germany, the Netherlands, France, Italy and Spain. Germany is the outlier: barely a third of German sites fire before consent, against three-quarters in Poland and the UK. Countries are assigned by domain and registered entity, not by where a site actually operates, so Ciphercue calls these splits indicative.

These shops already run ad tracking. Of the 339 sites with technology fingerprints on file, three-quarters run Google Analytics and a third run Meta’s pixel. Five pixel IDs are shared, which means a few multi-country operators show up as more than one site. One cycling retailer uses the same ID across its French, German and Italian sites, and its init call still carries debug:true, a flag developers usually remove once setup is done.

The pixel is spreading as fast as the ads are. ChatGPT ads reached 31 European countries in August, and OpenAI expanded advertising to more than 60 countries in late September. Per CNBC, the ad business hit a $1 billion annualized run rate in August, up from $100 million in March.

Why the pixel fires first

The pixel is a JavaScript loader called oaiq. A site loads it from bzrcdn.openai.com/sdk/oaiq.min.js and calls oaiq("init", { pixelId: "..." }). OpenAI’s own documentation says the pixel “initializes consent to true by default unless you set it to false or the Pixel finds a stored denial.” The copy-paste snippet under “Install the Measurement Pixel” stops at that init call and includes nothing about consent. To hold the pixel back, a site has to call oaiq("consent", false) before init and grant consent only after the visitor accepts. That step is documented in a separate section, “Control measurement consent”, further down the page. So the setup that obeys EU consent rules is the one that takes extra reading to find.

Ciphercue also checked that the control itself works. It loaded SDK version 0.1.93 in a local test page and ran three runs each in headless and normal Chrome. With consent set to false before init, every run sent zero measurement events. The pixel-config fetch was skipped, no attribution cookie was written, and a stored denial carried over into a fresh session. One diagnostic request per session still goes out, carrying "consent": false and no identifiers. It tells OpenAI that a visit without consent happened, but it carries no measurement.

One shop, step by step

Ciphercue walked through one example by hand: a Dutch travel retailer that uses Cookiebot. The site is anonymised while a three-working-day disclosure window runs. On first load, the banner offers “accept all” or “only necessary”. With the banner untouched, the network panel already shows the OpenAI SDK, the pixel config and a measurement event. Cookies are set as well: an __obref attribution cookie on the shop’s own domain, plus cookies on openai.com, bzr.openai.com and bzrcdn.openai.com.

Clicking “Only necessary cookies” and moving to another page sends a fresh event to OpenAI. Throughout, Cookiebot.consent.marketing returns false. The two systems disagree because they are not connected: Cookiebot controls the shop’s other marketing tags, but the OpenAI pixel sits outside it as a plain script with the default left on. This after-decline behaviour comes from that one site only. The 341-site scan never clicked a banner.

Fines for the same sequence

In the EU and UK, storing or reading non-essential data on a visitor’s device needs prior consent under the ePrivacy rules (Article 5(3) of Directive 2002/58/EC), and GDPR sets the standard for what counts as valid consent. The UK ICO and the Irish Data Protection Commission both name ad conversion tracking as a use that needs consent. Ciphercue makes no finding about whether any specific site broke the rules.

The French regulator, the CNIL, has already fined companies for this pattern. In September 2025 it fined the operator of shein.com €150 million because advertising cookies were placed when visitors arrived, before they touched the banner, and were still read after “Refuse all”. In November 2025 it fined American Express €1.5 million for cookies placed before any choice, cookies placed despite a refusal, and cookies read after consent was withdrawn. Under French rules, a cookie fine can reach €10 million or 2% of worldwide turnover. In the UK, the ICO’s ceiling is rising from £500,000 to £17.5 million, or 4% of global turnover, under the Data Use and Access Act 2025.

How to check a site

Open the browser’s developer tools, filter the network tab for openai, and load the page without touching the banner. A site that holds the pixel back shows no request to OpenAI. On weck.de, a German houseware shop that gets this right, the oaiq block is served as <script type='text/plain' data-cookieconsent='marketing'>, which the browser does not run. Cookiebot turns it into live JavaScript only after the visitor accepts marketing cookies, so nothing reaches OpenAI before then.