OpenAI Lets Advertisers Target ChatGPT Users by Email, Phone Number, and Prompts

OpenAI Expands Ad Targeting Inside ChatGPT

OpenAI lets advertisers inject ads into ChatGPT users' sessions and target them based on email address, phone number, or a unique identifier on their phone, according to tests conducted by 404 Media. While similar targeting is standard across the advertising industry, the chatbot's one billion monthly active users may not realize they can be singled out with personal data an advertiser has uploaded to OpenAI.

OpenAI first introduced ChatGPT ads in the U.S. in February before expanding to other territories. Free and Go users often see a related advertisement at the bottom of an answer, and this month OpenAI began placing ads alongside image generation results. Targeting can also be based on the prompts users type, which many may assume are private but which 404 Media has previously shown may be reviewed by humans.

"OpenAI's advertising products are operating just like most other massive companies which start to monetize their audiences. They are boiling the frog and hoping their users won't notice the privacy implications from their new ads," said Zach Edwards, co-founder of DecryptAds, a firm that collects online advertising data for research.

How Advertisers Build Audiences

When creating a campaign, OpenAI lets advertisers provide "context hints" describing the conversations, topics, or keywords where a product may be relevant. The company says these hints guide matching but are not exact-match rules. 404 Media used hints about privacy and current technology and AI topics in its test campaign, whose ads read "ChatGPT isn't private. OpenAI hires humans to read users' chats. Learn more" and linked to its Project Lily reporting, in which contractors read real users' prompts.

Advertisers can also create an "audience," a list of specific ChatGPT users to target. OpenAI accepts uploads of raw email addresses and phone numbers and checks whether they correspond to real users. Other options include hashed emails and phone numbers, where the data is digitally obscured before upload, and Android advertising IDs, the unique identifiers issued to every Android phone.

Thresholds and Opt-Outs

For an audience to be eligible for inclusion targeting, an uploaded list must contain more than 25,000 entries; smaller lists can only be used for exclusion. Meta's systems hash uploaded contact data, and OpenAI did not answer when asked whether it does the same, reiterating only that both raw and hashed data can be uploaded. An OpenAI spokesperson said uploaded files are deleted after processing, usually within 24 hours.

"Being on an advertiser's list does not, by itself, cause an ad to be shown. Inclusion filters and audience bid adjustments require at least 25,000 matched users, and advertisers cannot see which individuals matched or select specific people within an audience," the spokesperson added. Users can opt out of "ads personalization," but the setting does not stop ads or tracking entirely. "Ads may still be based on your current chat," the setting reads.

Third Parties Track the Ads Too

ChatGPT Ad Library, a third-party site, lets people search for companies, topics, and the specific prompts that surface particular ads. The site says it enters prompts into ChatGPT and records the sponsored cards returned, and claims to have captured at least 43,410 ads across 415,289 placements. The prompt "free ai video generator with sound," for example, returns an ad for an AI video editing tool.

Edwards argued that data broker laws need strengthening so that advertisers sharing sensitive personally identifiable information with ad tech companies like OpenAI must register as data brokers and give people a clear process for removing their data.

Sources: 404 Media