In February, OpenAI put ads into ChatGPT’s free tier. Eight months later, the company has quietly built a standard ad-tech targeting stack on top of those chats: advertisers can upload raw emails, raw phone numbers, hashed versions of either, or Android ad IDs, and decide which ChatGPT users see their sponsored cards based on the topics users are typing. 404 Media confirmed all of this by running its own test ads through OpenAI’s system, per Joseph Cox’s investigation at 404 Media.
The implications go past the “ChatGPT now has ads” story OpenAI told in February. Audiences built from contact lists - the same lists that show up in every CRM, every data broker’s database, and most major-app account tables - can now be matched against ChatGPT’s roughly one billion monthly active users. That is the basic move behind Facebook, Google, and TikTok’s audience businesses, and ChatGPT is replicating it inside the place where many users type the most private questions they ask all week.
How the matching works
According to 404 Media’s reporting, OpenAI’s ad platform accepts five classes of input from advertisers:
- Raw email addresses uploaded directly from a CRM or list.
- Hashed email addresses.
- Raw phone numbers.
- Hashed phone numbers.
- Android advertising IDs, the unique-per-device identifier Google issues for ad tracking on Android.
Advertisers then describe “context hints” - topics, keywords, or themes where they want their sponsored card to appear. OpenAI’s own copy describes context hints this way: “Describe the conversations, topics, or keywords where your products or services may be relevant; these hints guide matching but aren’t exact-match targeting rules.” Advertisers do not get exact-phrase matching; they describe what they are fishing for, and OpenAI decides which prompts are close enough.
A custom audience with at least 25,000 matched ChatGPT users can be used to include them in ad campaigns. Smaller lists can only exclude people - a campaign cannot pick out a small group, but it can carve one out.
What 404 Media actually tested
To confirm the system works as advertised, Joseph Cox ran his own test campaign using the ads tool. The test creative read “ChatGPT isn’t private. OpenAI hires humans to read users’ chats. Learn more,” and pointed to 404 Media’s earlier reporting on OpenAI’s “Project Lily” program, in which hundreds of contractors read real users’ prompts to train and evaluate ChatGPT. The context target was built around “people searching for topics that discuss privacy, or the privacy of ChatGPT chats themselves, or people who are asking about current technology and AI topics” - build an audience most likely to care about the warning, and show them the warning.
In the September Project Lily piece, one of the contractors told 404 Media that, when asked whether ChatGPT users understand a human is reading their conversations, they answered no. “I don’t think they would imagine some contractor somewhere […] is analyzing the conversations,” the contractor said.
In 404 Media’s separate targeting tests, ordinary consumer questions also surfaced sponsored cards. Asking “which AI moderator is best” returned an ad for a harmful-content removal firm; “free ai video generator with sound” returned an ad for an AI video editing tool; “best tools to monitor reviews before they damage app rankings” returned the same content-moderation company.
What OpenAI says, and what the docs do not
An OpenAI spokesperson told 404 Media that “being on an advertiser’s list does not, by itself, cause an ad to be shown. Inclusion filters and audience bid adjustments require at least 25,000 matched users, and advertisers cannot see which individuals matched or select specific people within an audience.” The same spokesperson said uploaded customer files are “deleted after processing, which is usually within 24 hours of upload.”
Two things the OpenAI help site does not state, and the spokesperson did not answer. First, whether uploaded raw emails or phone numbers are hashed before they leave the advertiser’s computer, or whether OpenAI stores them in cleartext long enough to do the matching. A third-party blog 404 Media cites about Meta’s system describes how Meta’s ad platform hashes contact data on the advertiser’s machine before it is uploaded; OpenAI’s own docs do not describe a comparable step. Second, whether opt-out applies to the audience-match step at all. The opt-out toggle in ChatGPT’s settings is labeled: “Allow ChatGPT to use your past chats, activity, and preferences to select ads. Ads may still be based on your current chat.” Toggling it off does not say “stop using my prompts”; it says “stop using my past chats.” Current conversations are still fair.
Ads appear for Free and Go tier users and are now inserted alongside ChatGPT’s image-generation results as well as at the end of text answers, per 404 Media’s snapshots. The third-party ChatGPT Ad Library, which scrapes and indexes every sponsored card it can elicit, counted at least 43,410 ads across 415,289 placements. The Library describes its own methodology this way: “We probe ChatGPT with realistic consumer prompts and record every sponsored card it returns - the creative, the advertiser, and the triggering prompt. Figures reflect our captured sample, not OpenAI’s internal data.”
What This Means
Two privacy beats are merging here. On the targeting side, a list of phone numbers or emails that any business already holds - a gym, a hospital, a political campaign, a small SaaS startup - can be matched against an audience of roughly a billion users, with the matched half told to see one ad and the unmatched half told to see another. That is the model Facebook and Google have run for years; the difference is that here the audience is reading and writing in a chatbot that has been trained to sound like a confidant. That changes which kinds of conversations end up in the room where the ad is shown.
On the human-review side, the prompts ChatGPT users type are not as private as the product name suggests, because OpenAI’s “Project Lily” contractor program - documented earlier in our write-up of 404 Media’s Project Lily reporting - puts hundreds of human readers between the user and the model. The targeting system reads those prompts to decide which ad to show. The contractor program reads them to train the next model. Two different reasons to keep the data, and they reinforce each other.
Zach Edwards, co-founder of the ad-fraud research firm DecryptAds, told 404 Media that “OpenAI’s advertising products are operating just like most other massive companies which start to monetize their audiences - they are boiling the frog and hoping their users won’t notice the privacy implications from their new ads,” and called for stronger data-broker rules that would force ad-tech operators to register and offer removal paths.
The Bottom Line
ChatGPT’s ad system matches users the way Facebook’s used to: upload contacts, describe topics, set a minimum audience size, and watch the ad land inside a conversation you do not see. The opt-out you can find in ChatGPT settings does not cover the matching step, and the help docs do not say whether raw contact data is hashed before it is uploaded. For anyone who treats ChatGPT as a place to think out loud, the practical fix is the same one that already works for Google and Meta: stop using the free and Go tiers for sensitive work, and either pay for the product, switch to a hosted provider that publishes a no-train policy, or run a local model. See our roundup of ChatGPT alternatives that respect your privacy and our recent guide to deleting your data from AI assistants for the practical steps.