According to an investigative report published by technology media outlet 404 Media on October 16, 2026, OpenAI’s self-service advertising system allows advertisers to precisely target ChatGPT users through three paths: uploading users’ raw email addresses, phone numbers, or SHA-256 hash versions thereof, as well as Android devices’ Google Advertising ID (GAID). After OpenAI matches these identifiers with real accounts on the platform, advertisers can serve ads to specific users. The feature requires targeting lists of no fewer than 25,000 entries; lists below this threshold can only be used for “exclusion,” not “targeting.”
Conversations as Targets: How Prompt Targeting Works
According to 404 Media’s testing, OpenAI’s ad system allows advertisers to provide “context hints”—descriptions of the topic categories the target users are discussing. The triggers for ad delivery include “the content and intent of the current conversation,” “topic descriptions provided by the advertiser,” and, when personalization is enabled, “broader ChatGPT usage signals.”
This means that a user asking “how to deal with workplace harassment” or “how to avoid taxes in family financial planning” may see ads from law firms or financial products in the chat interface—not because the platform has analyzed their historical behavior, but because the input at that moment is participating in ad bidding in real time.
Turning off the “ad personalization” setting does not block this process. According to MobileSyrup, the setting’s explanatory text explicitly states that ads “may still be based on your current conversation.” In other words, the actual effect of “turning it off” is to cut off the influence of historical records, not to cut off the real-time participation of the current session.
“Not Used for Training” ≠ “Not Used”: A Deliberately Created Gray Area
OpenAI’s long-standing public position has been that, unless free users actively consent, their conversation data will not be used to train models. This commitment is an important foundation of user trust in ChatGPT. However, this exposé reveals a carefully designed conceptual separation: not used for training and not used for commercial monetization are two entirely different things.
OpenAI’s official statement is that the platform “does not sell data to advertisers, nor does it share ChatGPT conversation content with advertisers,” that the “information” on which ad selection is based “stays inside ChatGPT,” and that uploaded user identifiers are deleted within 24 hours after processing is complete. But the logical loophole in this statement is obvious: data not being “sold” does not mean it is not being used commercially—real-time prompts participating in ad bidding are themselves a commercial act of exchanging conversation content for advertising revenue.
This kind of precise linguistic separation has ample precedent in the tech industry. Facebook in its early days claimed that it did not “sell” user data, but its advertising system likewise commercialized user data as a targeting tool; the only difference was that, formally, ownership of the data did not change hands. OpenAI’s wording follows the same structure.
Identity Matching: Advertisers Already Know Whom They Are Talking To
Compared with prompt targeting, email and phone number identity matching is in some ways more direct. Advertisers can upload their own customer lists or prospect lists to the OpenAI platform, and the system will identify which of those people have ChatGPT accounts and use that to build custom audiences.
The practical meaning of this capability is: a health insurance company can upload a list of people who inquired over the past 12 months and target ads at ChatGPT users among them; a debt collection agency can upload debtors’ contact information and precisely reach them when they ask “how to deal with a debt dispute.” OpenAI’s only restriction is on list size (at least 25,000 entries), not on substantive review of advertiser identity or intended use.
The intervention of external tools further lowers the threshold. According to reports, a third-party tool called “Chat GPT Ad Library” has standardized the targeting process described above, making this mechanism accessible to ordinary advertisers and no longer requiring deep technical investment.
Enterprise Users: The Overlooked High-Risk Group
OpenAI’s Enterprise and Team products promise not to use conversations for model training and provide stricter data isolation. In reality, however, a large number of corporate employees use personal free accounts or personally paid Plus accounts in their daily work, rather than enterprise versions purchased by their companies.
This phenomenon is widespread globally. When employees use personal ChatGPT accounts, what they input may include draft contracts, financial forecasts, internal dispute-handling plans, or competitor analyses. Under the advertising system architecture of personal accounts, all of this content may become a reference signal for real-time targeting. Their companies do not know, and have no compliance-level controls.
This is fundamentally different from traditional data security risks. The premise of traditional security risks is that “data is stolen by an external attacker,” whereas the risk structure here is that “data is handled according to commercial logic by the platform while the user voluntarily uses the service.” The defense paths for the two are completely different—the latter can hardly be avoided through technical means without switching tools.
OpenAI’s Business Model Turning Point
ChatGPT’s advertising feature officially launched on February 9, 2026, for free and Go tier users. This timing is no coincidence—OpenAI is accelerating toward a profitable model, and a single revenue structure relying on paid subscriptions faces a natural scale ceiling when covering 1 billion monthly active users worldwide.
The introduction of advertising is an expected commercial choice. The problem is not advertising itself, but the particularity of ChatGPT advertising: it is embedded in a tool whose core use case is “private conversation.” Google search users’ psychological expectation is “publicly searching for information”; ChatGPT users’ psychological expectation is “confiding in an assistant that will not repeat what they say.” This expectation gap is the fundamental reason for the strong user reaction.
From an industry landscape perspective, when Meta and Google built their advertising ecosystems, users were never marketed to under the name of a “private assistant.” OpenAI faces a trust premium it created itself, and it is now converting that premium into advertising revenue. Once users realize that “a trustworthy AI assistant” and “a real-time advertising data source” can be the same product, the trust premium begins to depreciate.
Institutional Loopholes: Targeting Capabilities Without Review
This exposé also reveals a regulatory gap: in the existing advertising industry regulatory system, conversation-content targeting is a field with almost no corresponding precedent. Google and Meta base ad targeting on users’ search terms, click behavior, and page visit records, and the nature of such data already has relatively mature legal and regulatory frameworks (such as GDPR rules on “inferred data”).
But how “real-time conversation content” should be characterized legally remains a gray area. Is it “behavioral data” or “communications content”? Under the framework of the EU’s ePrivacy Regulation, there are clear restrictions on commercial use of communications content; but whether input to an AI chatbot constitutes “communications” has not yet been formally adjudicated. OpenAI is rapidly expanding its advertising infrastructure in this regulatory vacuum.
Independent Judgment
OpenAI has not violated any explicit technical commitment—it has indeed not “sold” user data, and it has formally provided an option to turn off personalization. But it has systematically exploited the gap between users’ psychological expectation of a “private AI assistant” and the actual operating logic of its advertising platform.
This is not a question of malice, but a question of trust architecture design. A tool that claims to be a “trustworthy agent” and an advertising platform that connects users’ real-time conversations to an ad bidding system are not functionally incompatible, but they are fundamentally in conflict in terms of user trust logic. OpenAI chose the latter while trying to maintain the former’s brand positioning.
For corporate decision-makers, the conclusion is clear: any work conversation containing customer data, financial information, legal analysis, or strategic discussion should not take place in personally purchased ChatGPT accounts without enterprise procurement. This is not because OpenAI will necessarily misuse such data, but because its system architecture already allows such data to participate in commercial operations in ways that are difficult to trace. At the compliance level, “we don’t know what accounts employees are using” is no longer an acceptable answer.
The longer-term impact lies in reshaping the industry’s pricing logic: if “free but ad-supported” becomes the mainstream model for AI assistants, then the premium users pay for “genuine privacy protection” will no longer be merely a feature premium, but a trust premium. Whoever can honor this commitment at the architectural level rather than the declarative level will determine the outcome of the next round of AI assistant competition.
© 2026 Winzheng.com 赢政天下 | 转载请注明来源并附原文链接