ChatGPT Ads Can Find You by Your Prompts and Your Phone Number

BySarah Fraser
A sponsored ad displayed inside an AI chatbot conversation on a smartphone.

If you once gave a shop your email address at checkout, that shop can now upload it to OpenAI and pay to put its ad in front of you inside ChatGPT, while you are typing about the thing it sells. OpenAI collects the money, and there is already a lot of it: ChatGPT ads passed $100 million in annualized revenue within six weeks. The roughly 1 billion people who use ChatGPT each month supply the targeting through their prompts and the contact details tied to their accounts, and most of them don’t know it.

404 Media bought two ad campaigns on ChatGPT to see what an advertiser can actually select (summary here). The ads promoted 404 Media’s own reporting that humans review ChatGPT chats. A newsroom paid OpenAI to tell ChatGPT users that their chats get read, and OpenAI ran the ads.

The tests turned up two controls, and any advertiser can use both. The first is a written description of the conversations an ad should appear in. The second is a list of emails, phone numbers or Android advertising IDs that OpenAI matches against its users. Turning off “ads personalization” leaves the first one running. ChatGPT’s own settings text says “Ads may still be based on your current chat.”

404 Media calls the list-matching “somewhat standard practice across the advertising industry”. The other control is the new part. ChatGPT reads what you type to decide which ad fits. Users may assume those prompts are private, and 404 Media has previously shown that humans can review them. They were already leakier than most people think, as the browser extensions scraping ChatGPT conversations showed.

Advertisers write context hints: topics, keywords or plain descriptions of a conversation. According to a summary of 404 Media’s tests, those hints “guide matching rather than act as exact-match rules.” OpenAI decides which of your chats count.

The lists are the second control. Gizmodo’s breakdown of what an advertiser can upload:

  • email addresses, raw or SHA-256 hashed (scrambled into a fixed-length code)
  • phone numbers, raw or hashed
  • Google Advertising IDs, the tracking number Android phones carry for ads

Advertisers may have collected those details “in any number of ways,” Gizmodo notes. The feature was first spotted on May 14. Audience bid adjustments followed in early July. Advertisers can now include an audience, exclude it, or pay more to reach it, campaign by campaign.

Data flows from advertisers to OpenAI for audience matching, from ChatGPT users through their prompts, and from advertiser websites via the obi cookie to OpenAI's collector.

OpenAI has built in limits. Each one answers a narrower question than it seems to.

A list must match at least 25,000 ChatGPT users before it can run. OpenAI recommends 100,000 and accepts up to 5 million identifiers per file. The floor stops an advertiser from singling out one person. It does not stop an advertiser from aiming at 25,000 people whose details it already holds.

“Expect to match a portion of your list, not all of it.”, Craig Graham, CEO of Grayvault Consulting, to MediaPost

OpenAI says “being on an advertiser’s list does not, by itself, cause an ad to be shown.” The advertiser can also bid more to reach that list. That bid adjustment exists so that being on the list raises your odds of seeing the ad.

Uploaded files are deleted “usually within 24 hours”. The file goes. The matched audience built from it stays available for campaigns.

Advertisers cannot see which individuals matched. Neither can you. Zach Edwards, co-founder of DecryptAds, who was not involved in the tests, says advertisers handing over personal data this way should “register as data brokers and give people a clear removal process.” OpenAI also did not tell 404 Media whether it hashes raw emails and phone numbers after receiving them, Gizmodo reports.

OpenAI says its self-serve ad system works “without sharing conversations or personal details with advertisers”, and that it does not sell user data. Both claims can be true. The personal details flow into OpenAI, not out of it. OpenAI isn’t selling the data. It is selling access to the people the data describes.

The lists are not the only data flowing in. Independent researcher Buchodi found a ChatGPT-linked cookie, __obi, that lasts up to a year and is sent from advertiser websites to an OpenAI collector called “Bazaar.” The researcher counted 936 OpenAI pixels, snippets of tracking code on a web page, across 1,029 hostnames.

Buchodi logged 23,929 URLs with their paths intact. The paths are the point. They record which pages you looked at on Chewy or Wayfair, not just that you visited.

OpenAI isn’t selling the data. It is selling access to the people the data describes.

What the off switch leaves on

The control sits under Settings > Ad Controls. With personalization on, ads can draw on your memory and recent chats. Turning it off stops that. The current chat still feeds the ad, and deleted ads data is kept for up to 30 days.

Berlin’s data-protection commissioner, Meike Kamp, warned on October 2 that even the ads OpenAI calls “generic” use the contents of the current chat. Her office’s advice was to use Temporary Chat, opt out and clear your history.

OpenAI’s January principles promise no ads near health, mental health or politics. They also promise no ads for users who say they are under 18 or are predicted to be. That rule covers where an ad appears. It does not cover what an earlier conversation fed into memory.

Senator Ed Markey asked that question on January 22. He wrote that OpenAI’s stated safeguards left unanswered whether sensitive conversations could inform later ads, and he warned against repurposing “personal thoughts, health questions, family issues, and other sensitive information” for targeting. Eight months later, Berlin’s commissioner says planned personalized ads could draw on earlier chats. The question he asked in January is the feature regulators are warning about in October.

The money behind the ads

ChatGPT started showing test ads on February 9. Zoë Hitzig, an OpenAI researcher, resigned the same day, saying she feared the safeguards would weaken. She called users’ conversations “an archive of human candor that has no precedent”. People treat the chatbot as a confidant, the habit behind Meredith Whittaker’s warning that AI chatbots are not your friends. Hitzig warned:

“the company is building an economic engine that creates strong incentives to override its own rules.”, Zoë Hitzig, via SiliconANGLE

OpenAI headquarters in San Francisco.

The engine has grown fast. According to PPC Land, the price per thousand views fell from $60 to as low as $25 after launch. Target and Ford were among the first buyers. OpenAI then opened a self-serve Ads Manager to advertisers of any size. By May 5, the minimum spend had dropped from $200,000-$250,000 to zero.

OpenAI’s second-quarter 2026 revenue was $6.7 billion, against an operating loss of $12.3 billion, and Anthropic outsold it for the first time. That one quarter’s loss is about 120 times the $100 million a year the ad business was bringing in at six weeks. A July presentation projected $278 billion in negative free cash flow through 2030.

In eight months, the ad product went from a closed test to open self-serve, then to uploaded contact lists, then to bidding on audiences. Each step added a new way to aim. That is the engine Hitzig described on her way out.

OpenAI’s principles list the versions of ChatGPT that carry no ads: Plus, Pro, Business and Enterprise. Go is a paid tier, and it carries ads. In February, a paying ChatGPT Go subscriber posted that ads appearing in their conversations had them trying Claude, Gemini and Grok. That was around the time the Cancel ChatGPT movement was gathering.

So keeping your chats out of the ad system means paying for Plus or higher. The only independent audit shows who doesn’t. Researchers presenting at AIES 2026 ran 91 fake accounts through 335 prompts between February 6 and May 20 and collected more than 3,000 ads from 186 advertisers. Accounts placed in lower-income ZIP codes received more ads. The researchers found no significant link to race.

The people least able to pay for Plus are the ones shown the most ads. The data those ads draw on is set to grow. Berlin’s commissioner says planned personalized ads could add device information and usage data, and Buchodi’s logs show which pages people browse on Chewy and Wayfair already reaching OpenAI.

Further Reading