OpenAI lets anyone inject ads into ChatGPT users’ sessions, targeting specific groups of people based on their email address, phone number, or a unique identifier on their phone, according to 404 Media’s own tests of ChatGPT’s advertising ecosystem.
While the ad targeting available in ChatGPT is somewhat standard practice across the advertising industry, the chatbot’s one billion monthly active users may not understand they, in some cases, are being specifically targeted because of their personal data the advertiser has uploaded to OpenAI. ChatGPT’s ad targeting is also novel in that it is also based on the prompts users enter into the chatbot, prompts that users may assume are private but which, as 404 Media has previously shown, may be reviewed by humans. Or in this case, used for ad targeting purposes.
“OpenAI’s advertising products are operating just like most other massive companies which start to monetize their audiences — they are boiling the frog and hoping their users won’t notice the privacy implications from their new ads,” Zach Edwards, co-founder of DecryptAds, a company that collects online advertising data for research purposes, told 404 Media.
OpenAI first introduced ChatGPT ads in the U.S. in February, before steadily expanding to other territories. When a Free or Go user types a prompt into ChatGPT, the chatbot will often display a related advertisement at the bottom of its answer. This month, OpenAI went a step further and pushed ads alongside image generation results.
To get a better understanding of how exactly ChatGPT’s ad targeting works, 404 Media ran two advertisements inside ChatGPT. Both of them read, “ChatGPT isn’t private. OpenAI hires humans to read users’ chats. Learn more,” and included a link to 404 Media’s recent article revealing Project Lily, in which contractors read real users’ ChatGPT prompts. When creating an ad campaign, OpenAI lets advertisers provide “context hints” which can better target the advertisement to people using ChatGPT for certain things.
“Describe the conversations, topics, or keywords where your products or services may be relevant; these hints guide matching but aren’t exact-match targeting rules,” OpenAI’s site says. 404 Media added the context “people searching for topics that discuss privacy, or the privacy of ChatGPT chats themselves, or people who are asking about current technology and AI topics.”
OpenAI also lets an advertiser, which can be a big business or essentially a random person, create what it calls an “audience.” This is a list of specific ChatGPT users the advertiser wants to target. OpenAI offers a few options to build this audience, including uploading “raw” email addresses and phone numbers. OpenAI then checks if these pieces of personal data correspond to a real ChatGPT user, and if so, the advertiser can target those people with its adverts.
Other options are hashed emails and phone numbers, hashed meaning the advertiser is uploading digitally obscured versions of peoples’ emails and phone numbers rather than the raw data; and Android advertising IDs. These are unique identifiers issued to every Android phone.
There are some caveats: to make an audience ready for “inclusion” to be targeted, the uploaded list must be more than 25,000 entries long. Otherwise those ChatGPT users can only be marked for “exclusion,” meaning that the audience explicitly won’t be targeted by the ad. Other advertising systems, like Meta’s, hash the data when someone uploads a list of peoples’ raw email addresses and phone numbers. OpenAI did not provide an answer when asked if it did the same, and instead reiterated that advertisers can upload both raw personal data and hashed versions. An OpenAI spokesperson told 404 Media the uploaded files are deleted after processing, which is usually within 24 hours of upload. “Being on an advertiser’s list does not, by itself, cause an ad to be shown. Inclusion filters and audience bid adjustments require at least 25,000 matched users, and advertisers cannot see which individuals matched or select specific people within an audience,” the spokesperson added.
ChatGPT users can opt-out of “ads personalization,” but that doesn’t stop ads or tracking entirely. “Allow ChatGPT to use your past chats, activity, and preferences to select ads. Ads may still be based on your current chat,” the setting reads.
Companies even exist to surface other peoples’ ChatGPT ads now. ChatGPT Ad Library, for example, lets people search for particular companies to see what ads they are running, or search for certain topics, or even see which specific prompts are surfacing which ads. The prompt “free ai video generator with sound” returns an ad for an AI video editing tool; “which AI moderator is best,” returns a company that says it will remove harmful content from the web; and “best tools to monitor reviews before they damage app rankings” returned another ad from the same company.
ChatGPT Ad Library says it does this by entering prompts into ChatGPT and recording what ads come back. The site says it has captured at least 43,410 ads across 415,289 placements. “We probe ChatGPT with realistic consumer prompts and record every sponsored card it returns — the creative, the advertiser, and the triggering prompt. Figures reflect our captured sample, not OpenAI’s internal data,” its site reads.
Edwards from DecryptAds added, “We need to strengthen data broker laws so that advertisers sharing sensitive PII [personally identifiable information] with ad tech companies like OpenAI are required to register as data brokers and give people a clear process for removing their data from these systems.”
