Ads in ChatGPT: your email address or phone number may be enough to target you

On October 15, 2026, the US investigative outlet 404 Media published an account of a simple experiment: it became an advertiser. It bought two ad campaigns in ChatGPT and looked at what OpenAI's targeting tool allows.

It allows a lot. According to its journalists, any advertiser can show ads to a specific group of people by supplying their email addresses, phone numbers or Android advertising IDs. Targeting also draws on what the user writes to the chatbot.

How contact-list targeting works

Gizmodo detailed the mechanism on October 16. The advertiser uploads a list of contact details, in plain text or hashed. OpenAI matches it against its ChatGPT accounts, and recognized users can then see the ad. This is the principle of the "custom audiences" already offered by Meta and Google.

OpenAI has put safeguards in place, according to its documentation cited by Gizmodo. The advertiser does not know which accounts were matched, so it is impossible to check whether a given person uses ChatGPT. An audience must contain at least 25,000 entries, and a single person cannot be targeted. Uploaded files are deleted within 24 hours of processing. One unknown remains: OpenAI does not say whether it hashes contact details it receives in plain text.

Turning off personalization is not enough

ChatGPT's settings let users opt out of personalized ads. According to OpenAI's wording as reported by Gizmodo, this opt-out covers ads chosen based on past conversations, activity and preferences. But OpenAI also states that "ads may still depend on the current conversation." Gizmodo wonders whether the opt-out really prevents targeting by email address or phone number. The site had not received a reply from OpenAI at the time of publication.

The issue is not trivial. 404 Media notes that ChatGPT claims one billion monthly active users, a figure reported by Reuters. The same outlet had already shown that humans can review some conversations.

And in Europe?

Ads arrived in ChatGPT on August 24 in 31 European countries, including France, according to Digiday. The trade outlet points out that the GDPR in principle requires explicit consent for targeted advertising. We could not establish whether contact-list targeting is open to European advertisers: neither 404 Media nor Gizmodo mentions it, and OpenAI has not stated it publicly.

What you can do

• In ChatGPT's settings, turn off ad personalization, knowing that it does not block targeting based on the current conversation.
• Do not write to the chatbot what you would not tell an ad agency.
• At work, prefer business plans, which ads do not apply to according to the information published at launch.

The approach echoes Meta's new terms, under which it will be able, from October 30, to train its AI on advertisers' websites. For ChatGPT, it remains to be seen how OpenAI will respond, and whether data protection authorities will take an interest in this targeting.