404 Media says ChatGPT ads can use prompts and uploaded customer lists

On 15 October 2026, Joseph Cox reported in 404 Media that the outlet had tested ChatGPT’s advertising tools. The page’s published time is 13:25 UTC. He writes that advertisers can aim ads using an email address, a phone number, or a unique identifier on a phone, and that targeting also uses the prompts people type. A same-day newsletter note says he made his own ChatGPT ad “without using peoples’ personal data.”

What 404 Media says it ran

404 Media says it ran two advertisements inside ChatGPT. Both read: “ChatGPT isn’t private. OpenAI hires humans to read users’ chats. Learn more,” with a link to a 404 Media article about contractors reading prompts. Cox writes that setup includes “context hints,” and he quotes this line from OpenAI’s site: “Describe the conversations, topics, or keywords where your products or services may be relevant; these hints guide matching but aren’t exact-match targeting rules.” The hint 404 Media says it entered was: “people searching for topics that discuss privacy, or the privacy of ChatGPT chats themselves, or people who are asking about current technology and AI topics.”

OpenAI’s basics page says those hints “help guide ad matching, but they are not exact-match keywords and do not guarantee delivery in specific conversations.” A report here covers OpenAI’s account of labeled visual ads during image generation in the US. Cox writes that OpenAI also placed ads alongside image results this month.

Customer lists

404 Media writes that an advertiser can upload raw email addresses and phone numbers, hashed versions of those, or Android advertising IDs. OpenAI’s custom-audience help lists email addresses, phone numbers, hashed email addresses, hashed phone numbers, or Google Advertising IDs (GAID). The developer page says: “Only upload first-party audience data that you have the right to use for ads. Don’t upload broker-sourced data.” It also says custom audiences are not supported for European Economic Area or Switzerland campaigns.

The help page says inclusion and bid adjustments require at least 25,000 matched users, and that smaller audiences “can be used for exclusions.” Ads Manager “does not show individual matched users or let you select specific people from an audience.” Uploaded rows can differ from the matched size. “Uploaded audience files are deleted after processing, usually no later than 24 hours after upload.”

Cox’s article says in one place that the uploaded list “must be more than 25,000 entries long,” or those people “can only be marked for exclusion.” A spokesperson quoted later in the same piece uses the matched-user threshold. Cox also writes that OpenAI did not say whether it hashes raw emails and phone numbers on receipt, and said advertisers can upload both raw and hashed values.

The spokesperson told 404 Media: “Being on an advertiser’s list does not, by itself, cause an ad to be shown. Inclusion filters and audience bid adjustments require at least 25,000 matched users, and advertisers cannot see which individuals matched or select specific people within an audience.” On retention, the spokesperson said files “are deleted after processing, which is usually within 24 hours of upload.”

The ads FAQ says advertisers do not receive chats, memories, or personal details, only aggregated figures such as views or clicks. Another answer says they never receive “your chats, chat history, memories, name, email, precise location, IP address, or sensitive information.” The FAQ also says selection uses “the context and intent of your current conversation” and, when personalization is on, signals from the broader ChatGPT experience.

What OpenAI says a user can change

The ads FAQ puts controls in Settings, under Ad Controls: turn off personalization, dismiss an ad, see why it was shown, and clear ads data. If personalization is off, “you will still see ads based on the context of your current chat thread,” and other threads, ads history, and topics are not used. Controls are for Free and Go users where ads are available or soon will be. Personalized ads are not initially available in the European Economic Area or Switzerland. Plus, Pro, Business, Enterprise, and Edu accounts “will not have ads.” Accounts identified as under 18 are not shown ads. Temporary Chats “will not show ads.” The Free plan has an Ads-Free option that removes ads and lowers limits. Cox quotes the setting as: “Allow ChatGPT to use your past chats, activity, and preferences to select ads. Ads may still be based on your current chat.”

Zach Edwards, co-founder of DecryptAds, told 404 Media the products are “boiling the frog and hoping their users won’t notice the privacy implications from their new ads.”