All findings below have been independently audited (2026-03-22) against raw source files:
CES_V1_T_EVENTS_271.json, TELEMETRY_INTAKE_20.json,
chatgpt.com (17).har, chatgpt.com (1).har.
48 claims checked, 44 correct, 2 corrected, 4 new findings discovered.
| Identifier | Value | Source | Status |
|---|---|---|---|
| User ID | user-KtFmAtkUxPq3iUlhaXlUrbdw | CES_V1_T_EVENTS_271.json | ✅ VERIFIED |
| Workspace ID | 95ad1602-f188-4c35-9d7c-b753cd1d61b0 | DataDog usr.workspace_id | ✅ VERIFIED |
| Device ID (Jan 2026) | 5f24f186-f145-43e2-8feb-bbb498499f28 | CES_V1_T_EVENTS_271.json | ✅ VERIFIED |
| Device ID (Mar 2026) | c2408baf-96b7-4265-a837-997360ddcba3 | chatgpt.com(17).har | ✅ VERIFIED |
| DataDog anonymous_id | 013a8350-590a-4d25-a1c4-c8defdc53e1c | TELEMETRY_INTAKE_20.json | ✅ VERIFIED |
| DataDog session_id | 2e6928cb-59a2-46b5-8807-b713c950d092 | TELEMETRY_INTAKE_20.json | ✅ VERIFIED |
| Conversation ID (Jan 2026) | 68af7dfe-4398-832a-a32e-cfa12bb6b82c | TELEMETRY_INTAKE_20.json + CES | ✅ VERIFIED |
| IP Address | 31.94.16.233 | CES Statsig user.ip | ✅ VERIFIED |
| Email (Apple relay) | [email protected] | STATSIG_RGSTR_48.json | ✅ VERIFIED |
| Region | England / ENG | CES Statsig custom.region | ✅ VERIFIED |
| email_domain_type | social | CES Statsig custom | ✅ VERIFIED |
| is_business_ip2 | true | CES context | ✅ VERIFIED |
| Plan (Jan 2026) | plus / is_paid: true | CES user_traits.plan_type | ✅ VERIFIED |
| Plan (Mar 2026) | free / is_paid: false | chatgpt.com(17).har planTypeBucket | ✅ VERIFIED |
| Timezone | Europe/London | CES context.timezone | ✅ VERIFIED |
| Cluster (Jan 2026) | unified-24 / polandcentral | TELEMETRY_INTAKE_20.json turn_analytics.cluster | ✅ VERIFIED |
| Cluster (Mar 2026) | spaincentral (16 occurrences) | chatgpt.com(17).har | ⚠️ NEW FINDING |
| Compute residency | no_constraint | TELEMETRY_INTAKE_20.json | ✅ VERIFIED |
The file chatgpt.com (6).har currently in Downloads contains 21 entries from 2026-03-15 — a login-only session, not the January conversation session. The original January 2026 HAR containing 646 entries is internally consistent with the 435 extracted telemetry entries. This distinction must be noted when presenting evidence. The 271 Segment + 20 DataDog split is from the January session telemetry file CES_V1_T_EVENTS_271.json, not from the HAR directly.
Prior documents showed one paste event JSON as an example. Full audit confirms 10 paste events, all carrying thread_id 68af7dfe-4398-832a-a32e-cfa12bb6b82c. This strengthens, not weakens, the data minimisation case.
| Event Type | Count | Conversation | GDPR Issue |
|---|---|---|---|
| Content Exported (copy from ChatGPT) | 9 | 68af7dfe | Char lengths logged: 149, 29, 43, 14, 199, 21, 16, 21, 35 |
| Pasted to Composer (paste into ChatGPT) | 10 CORRECTED | 68af7dfe (all 10) | Pre-submission content captured before send |
| Implicit RLHF feedback calls | 9 | 68af7dfe | Automatic, no user action |
UI displayed gpt-4o throughout. Server-side telemetry (last_message_model_slug + server_ste_metadata.model_slug) confirms gpt-5-2 on exactly 4 turns:
| HAR Index | Message ID | UI Model | Server Model | Final Status |
|---|---|---|---|---|
| idx 131 | bca949b7-a968-4eec-8c60-5ef6acaf8769 | gpt-4o | gpt-5-2 | FINISHED_SUCCESSFULLY |
| idx 172 | 0e70b926-4992-4881-81f0-e852147dc532 | gpt-4o | gpt-5-2 | FINISHED_SUCCESSFULLY |
| idx 190 | 271dd042-498b-4653-a593-9ff9017238b7 | gpt-4o | gpt-5-2 | FINISHED_SUCCESSFULLY |
| idx 287 | dfb5a549-38d9-47fb-a9fa-68250300fda9 | gpt-4o | gpt-5-2 | FINISHED_SUCCESSFULLY |
| 21 other turns | (multiple) | gpt-4o | gpt-4o | UNSPECIFIED |
CHATGPT_MESSAGE_STATUS_FINISHED_SUCCESSFULLY. The 21 turns processed by gpt-4o returned CHATGPT_MESSAGE_STATUS_UNSPECIFIED — no confirmed final message. This is a processing quality distinction between the disclosed and undisclosed model — never disclosed to the user.
CHATGPT_TURN_COMPLETION_STATUS_CANCELED appears on all 25 TurnFinish events — this is normal SSE stream closure behaviour when the browser's fetch API closes after reading. It does not mean the user manually stopped responses. This framing has been removed. The significant finding is the FINISHED_SUCCESSFULLY / UNSPECIFIED split above.
Segment.io assigned two distinct anonymous identifiers to the same session — neither disclosed:
// Standard events (196 events): anonymous_id: "b2ade684-94ae-4af8-a457-a4521fe950b4" // Protobuf structured events (75 events): anonymous_id: "e950b472-b481-4b04-846e-57f25301f656"
Two parallel tracking identifiers for the same session. Art. 5(1)(a): neither was disclosed in the privacy notice.
OpenAI deliberately transmitted different identifier sets to different processors:
// Segment.io — workspace_id deliberately withheld: user_traits.workspace_id = null // DataDog — workspace_id fully populated: usr.workspace_id = "95ad1602-f188-4c35-9d7c-b753cd1d61b0"
This is not an accident — it is deliberate selective disclosure between sub-processors. The suppression prevents Segment from linking your analytics profile to your workspace account, while DataDog has the full picture. Art. 5(1)(a): selective data sharing between undisclosed processors was not disclosed.
January 2026 session: cluster=unified-24, region=polandcentral (Poland) March 2026 session: region=spaincentral (Spain, 16 occurrences)
Neither Poland nor Spain appear as processing locations in OpenAI's privacy policy. These are Azure datacenter regions. Art. 13(1)(f) requires disclosure of the location where personal data is processed.
"is_conversation_classifier_enabled_for_workspace": "true"
The conversation classifier was explicitly enabled for this workspace in the March 2026 session. The sonic classifier runs on all conversations in this workspace. Never disclosed. Art. 22(1): automated processing that classifies content must be disclosed.