OpenAI Faces Class-Action Lawsuit Over Alleged Privacy Violations via Facebook Pixel and Google Analytics OpenAI is the target of a new class-action lawsuit filed in the Southern District of California, accusing the company of secretly sharing sensitive ChatGPT user conversations with Meta and Google through embedded tracking tools. The complaint, brought by California resident Amargo Couture on behalf of U.S. users, alleges that OpenAI violated federal and state privacy laws by transmitting chat topics, identifiers, and contact details to third-party ad platforms without user consent. The lawsuit claims that ChatGPT users who often discuss confidential matters such as finances, health, and legal issues had a reasonable expectation of privacy, only for their interactions to be funneled to Meta’s Facebook Pixel and Google Analytics. According to the complaint, the Facebook Pixel embedded in ChatGPT’s web interface sends real-time HTTP requests to Meta’s servers, including browser tab titles (e.g., "Super Bowl 2005 Winner") and cookies tied to users’ Facebook accounts. This data is then allegedly used for targeted advertising across Meta’s platforms. Similarly, Google Analytics is accused of capturing hashed email addresses, device identifiers, and Google Signals cookies, enabling cross-device tracking and remarketing based on ChatGPT activity. The suit argues that these practices constitute unlawful interception under the Electronic Communications Privacy Act (ECPA) and violate California’s Invasion of Privacy Act (CIPA), which prohibits the use of devices to eavesdrop on confidential communications without consent. The proposed nationwide class seeks damages for all U.S. users whose data was shared, with a California subclass pursuing statutory penalties of up to $5,000 per violation. Plaintiffs are also demanding injunctive relief to compel OpenAI to remove or redesign its tracking integrations and halt further disclosures to ad tech partners. The case emerges amid growing legal scrutiny of generative AI’s data practices, following previous lawsuits over OpenAI’s training data collection. If successful, it could set a precedent treating AI chat tracking as equivalent to prohibited surveillance methods, such as unauthorized health-site pixels or session-replay scripts. The complaint’s technical evidence including network traces of tab titles and cookie values highlights how plaintiffs are now examining AI platforms for covert data flows to third-party domains.

Magecart Group Exploits Google Tag Manager in Sophisticated Credit Card Skimming Campaign A notorious Magecart threat group has weaponized Google Tag Manager (GTM) to deploy credit card skimmers on e-commerce sites, turning a trusted analytics tool into a vehicle for digital skimming. The campaign, linked to the ATMZOW skimmer, has evolved since its emergence in 2015, with attackers now leveraging highly obfuscated GTM containers to evade detection. In early 2023, the group used GTM-WJ6S9J6 to inject malicious scripts disguised as legitimate analytics services. After Google removed the container, attackers pivoted to GTM-TVKQ79ZS, introducing a new layer of obfuscation that breaks if even a single character is altered frustrating security analysis. More recently, they deployed GTM-NTV2JTB4 and GTM-MX7L8F2M as replacements. To further evade detection, the attackers registered 40 new domains with deceptive naming patterns (e.g., cdn.sketchinsightswatch[.]com, cdn.visualartinsights[.]com), blending into normal web traffic. The skimmer randomly selects two domains per victim, storing them in local storage to limit exposure of the full infrastructure. Initially, these domains were hidden behind Cloudflare, but researchers later uncovered their Hostinger-based IP addresses after the firewall provider blocked malicious traffic. The campaign highlights the group’s adaptability, combining GTM abuse, domain obfuscation, and selective payload delivery to prolong its operations. Indicators of compromise include the identified GTM containers and fake analytics domains, such as gtm-statistlc[.]com and gooqle-analytics[.]com.