Advertisers can now use the email addresses and phone numbers they already hold to reach people on ChatGPT. A 404 Media investigation published October 15, as summarized by Gizmodo and others, found that ChatGPT ad targeting reaches well beyond what users type. The ad system is roughly eight months old, and several of its mechanics remain unexplained.
How ChatGPT ad targeting uses your contact details
Advertisers can upload a list of email addresses, phone numbers, or Google and Android advertising IDs, in raw or hashed form. According to Neoteo, hashed uploads use SHA-256. OpenAI checks each list against ChatGPT accounts, and matched people become eligible to see that advertiser's ads.
Customer-list targeting is common across digital advertising, and 404 Media itself says so, as MobileSyrup reported. What makes ChatGPT different is the setting. The matched users are people in ChatGPT conversations, and those conversations often touch sensitive subjects.
Experts quoted in the coverage argue that an advertiser holding a person's email from another platform can use it to define a ChatGPT audience, Yahoo Tech reported. The platform has roughly one billion monthly users, according to 404 Media's estimate as relayed by MobileSyrup. Even a narrow matching rule can reach a very large pool of people.
What 404 Media's test ads revealed
404 Media ran two paid ChatGPT ads to test how advertiser controls work. Its tests found that advertisers can steer ads using conversation topics, and that they can upload contact lists to reach specific users, according to Gizmodo.
The two test ads read “ChatGPT isn't private. OpenAI hires humans to read users' chats.” Each linked to 404 Media's earlier reporting on contractors who read user prompts. The copy was pointed, and it made the test as much a provocation as an audit.
A tracking project called ChatGPT Ad Library says it captured 43,410 ads across 415,289 placements, per Superpower Daily. Those figures do not come from OpenAI, so treat them as a third-party sample rather than a platform total.
Zach Edwards, co-founder of DecryptAds, an ad-data research firm, told 404 Media that OpenAI is “boiling the frog and hoping their users won't notice the privacy implications.” That line reaches readers through secondary coverage, so the wording here follows beSpacific's quotation.
Which ChatGPT users see ads, and which do not
Ads run only for Free and Go accounts. Accounts on Plus, Pro, Business, Enterprise and Edu plans see none, and OpenAI excludes accounts it identifies as belonging to minors, according to Jolt Journal.
| Plan | Sees ChatGPT ads |
|---|---|
| Free | Yes |
| Go | Yes |
| Plus | No |
| Pro | No |
| Business | No |
| Enterprise | No |
| Edu | No |
That leaves the free tier as the group most directly exposed. Ad testing began in the US on February 9, 2026, and ads are rolling out in select regions, per Neoteo.
The matching also reaches people who have never used the chatbot. Someone who shares an email or phone number with a company that advertises on ChatGPT could see that company's ads there, even without a prior ChatGPT history.
What OpenAI says advertisers can and cannot see
OpenAI says advertisers never see chats, history, memories, names, emails, precise location or IP addresses. They receive aggregated numbers such as views and clicks. OpenAI also says ads will not run near health, mental health or political conversations.
The thresholds matter as much as the promises. Advertisers need at least 25,000 matched users before they can use inclusion targeting or bid adjustments. OpenAI recommends lists of 100,000 or more, so that match losses and opt-outs still leave a usable audience, according to TechCity.
Those numbers favor advertisers with large customer databases. A small shop with a few hundred contacts would fall well below the floor. The practical effect is that ChatGPT targeting looks built for big brands, which can afford to match at scale.
OpenAI's ad-setup site describes context hints as guiding matching but not acting as exact-match targeting rules. That phrasing leaves readers with little detail on how matches are actually made. Uploaded files are usually deleted within 24 hours, according to OpenAI as relayed by Gizmodo and others.
Personal data shaping prices and offers has drawn scrutiny elsewhere too. Instacart halted its AI pricing tests as anger over grocery prices grew.
How to limit ChatGPT ad personalization
These steps reduce personalization, but they do not turn off every form of ad targeting.
- Open ChatGPT, go to Settings, then Ad Controls, and switch off “Personalize ads.” According to TechCity, this stops ad selection from using past chats, activity and interests.
- Know what the switch leaves alone. It does not remove ads, and ads can still draw on the current conversation.
- Keep sensitive health, financial and personal details out of free-tier chats. This is a suggestion based on the reported mechanics, not an OpenAI instruction.
- If you want no ads at all, OpenAI offers an ad-free option for Free users. It comes with lower usage limits and loses features such as image generation and deep research, per TechCity.
Privacy trade-offs with always-on consumer devices follow a similar pattern. Our guide to Amazon's Bee AI wearables and what buyers should know covers how to weigh them.
Open questions and what to watch next
Several questions remain open. OpenAI has not answered whether it hashes raw email and phone uploads after receiving them, according to 404 Media as relayed by Gizmodo and others. Meta does hash uploads, per The Neuron Daily's comparison.
It is also unclear whether the personalization opt-out stops list-based matching. OpenAI's documentation does not clearly say, according to Jolt Journal. OpenAI has not disclosed how many advertisers use custom audiences, and it has offered no full timeline for expansion beyond select regions.
USA 24 found no federal or state regulatory action specific to this feature in the sources reviewed. This story relies on coverage that quotes 404 Media's investigation, and we have not reviewed the original report directly.
The next signals will come from whether OpenAI answers the hashing and opt-out questions in its own help materials. Watch also whether the 25,000-user threshold or the recommended list size changes, and whether privacy regulators ask the company for details on how uploaded contacts are handled.
