Full Breakdown
OpenAI’s ChatGPT Ad Targeting Raises Privacy Concerns
By Drooid · · How we work
Core Event: Advertisers Can Target Users by Email, Phone, Device ID, and Prompts
OpenAI’s advertising platform lets any advertiser upload lists of email addresses, phone numbers, hashed equivalents, or Android advertising IDs to build a custom “audience.” When the uploaded list matches at least 25,000 real ChatGPT accounts, the audience becomes eligible for inclusion campaigns that can display sponsor cards beneath the chatbot’s answers. In addition, advertisers may supply “context hints” that align ads with specific user queries or topics, allowing promotions to appear in response to particular prompts. The system was first rolled out in the United States in February and has since expanded to other regions.
Background & Context
ChatGPT introduced paid advertising for free-tier and lower-cost “Go” users as a new revenue stream. The model mirrors practices used by major social-media platforms: advertisers can target audiences based on personally identifiable information (PII) and on the content of users’ real-time prompts. The platform also permits advertisers to upload raw contact data; OpenAI says uploaded files are deleted after processing, typically within 24 hours.
Data & Statistics
- Audience creation requires a minimum of 25,000 matched users; smaller lists can only be used for exclusion.
- The third-party “ChatGPT Ad Library” has recorded at least 43,410 ads across 415,289 placements by entering realistic consumer prompts and logging the resulting sponsor cards.
- OpenAI’s ad placements appear both after textual answers and alongside image-generation results, expanding the surface area for sponsored content.
Official Statements & Responses
Regarding user controls, OpenAI notes that users may opt out of “ads personalization,” but the setting only disables use of past chats, activity, and preferences; ads may still be based on the current conversation. When asked for details about whether raw data is hashed before processing, OpenAI declined to comment and reiterated that both raw and hashed data can be uploaded. Gizmodo’s request for additional clarification received no response.
Conflicting Reports & Gaps
- Hashing of uploaded data: OpenAI’s documentation does not specify whether raw email addresses and phone numbers are hashed before matching, and the company has not answered media inquiries on the matter.
- Response to inquiries: Gizmodo reported that OpenAI did not reply to a request for further details about its targeting mechanisms, leaving a gap in publicly available information about data-handling safeguards.
Verbatim Quotes
- “We need to strengthen data broker laws so that advertisers sharing sensitive PII [personally identifiable information] with ad tech companies like OpenAI are required to register as data brokers and give people a clear process for removing their data from these systems.” — DecryptAds, co-founder