ChatGPT ads can target you by email, phone and chat prompts

Most people who see an ad in ChatGPT probably assume it is a blunt product placement: something roughly related to the topic they just typed. That is only half true. According to tests by 404 Media, OpenAI also lets advertisers hunt for specific people by uploading lists of emails, phone numbers and Android advertising IDs. The same tools let an advertiser describe the kinds of conversations where an ad should appear. In other words, your prompt can become a targeting signal, and your contact details can put you on a list that decides whether you are included or excluded from a campaign.

Joseph Cox of 404 Media published the findings on 15 October 2026. Gizmodo and The Neuron picked the story up on 16 October. OpenAI's own Custom Audiences documentation matches the core mechanics: raw and hashed emails and phones, Android GAIDs, a planning threshold of 25,000 matched users for inclusion and bid adjustments, and small audiences that can still be used for exclusion. This article walks through what 404 Media actually ran, what the docs confirm, what remains unclear about hashing of raw uploads, and what the personalization toggle really does.

This is a product and privacy story, not the strongest security headline of the day. The FTC's civil investigative demands to OpenAI and Anthropic over AI agent incidents remain the harder enforcement angle (we covered that separately). Still, ChatGPT ad targeting matters for anyone who treats the chat window as a private notebook. It also matters for companies that may soon buy or sell these audiences.

What 404 Media actually tested

OpenAI first rolled out ChatGPT ads in the United States in February 2026, then expanded them. Free and Go users often see a related advertisement under an answer. This month, OpenAI also started placing ads next to image generation results. The company has been building the commercial stack in public view: formats, measurement partners and brand suitability pilots. What most users did not see, until Cox bought inventory himself, is how finely an advertiser can aim.

404 Media created two ads inside ChatGPT. Both used the same blunt message: "ChatGPT isn't private. OpenAI hires humans to read users' chats. Learn more." The creative linked to 404 Media's earlier reporting on Project Lily, the contractor review of real user prompts. The point of the test was not the slogan. It was the targeting controls around it.

When an advertiser builds a campaign, OpenAI offers context hints: short descriptions of conversations, topics or keywords where the product might be relevant. OpenAI's own copy says those hints guide matching and are not exact match rules. 404 Media fed hints about people searching for privacy topics, the privacy of ChatGPT chats themselves, or current technology and AI subjects. The ads then showed up in sessions that matched that flavor of chat.

Separately, OpenAI lets an advertiser create an audience: a list of ChatGPT users the advertiser wants to include or exclude. That is where email, phone and device identifiers enter the picture. Cox stresses a simple but important point: anyone with a few minutes and some budget can inject ads into ChatGPT sessions. The advertiser does not have to be a household brand. It can be a newsroom running a demonstration, or a company with a customer file.

Zach Edwards, co-founder of DecryptAds, told 404 Media that OpenAI's advertising products look like the usual path large platforms take when they start monetizing audiences: expand targeting first, hope users notice the privacy tradeoffs later. That quote is opinion, but the product surface Cox documented is concrete.

The targeting toolkit: lists plus conversation hints

OpenAI's Custom Audiences docs list five identifier types advertisers can upload:

• email: a normal address; the API trims it and lowercases it.
• phone: an E.164 number with country code.
• email_sha256 and phone_number_sha256: 64-character hex digests of the normalized values.
• gaid: a nonzero, hyphenated Google Advertising ID. The API normalizes and hashes GAID values itself; advertisers must not pre-hash them.

Files can be UTF-8 CSV or TXT, up to 500 MB. A mixed CSV can combine columns if the advertiser sets automatic identifier resolution. Create, add, remove, replace and merge operations are asynchronous. Matched counts come back as privacy-preserving ranges such as `under_25k` or `25k_100k`, not as exact headcounts, and advertisers never see which individuals matched.

404 Media describes the same menu in plainer language: upload raw emails and phones, or hashed versions, or Android advertising IDs. OpenAI then checks whether those identifiers correspond to real ChatGPT users. If they do, the advertiser can target that audience. Context hints sit beside that list machinery. They do not replace it. One path is "people who look like this conversation." The other is "people whose contact data is on this file."

Custom audiences are not supported for campaigns targeting the European Economic Area or Switzerland in the current docs, where personalized ads are not yet available. That geographic limit is important for European readers, but it does not change the US product Cox tested.

OpenAI also tells advertisers to upload only first-party data they have the right to use for ads, and not to upload broker-sourced data. That policy line is about advertiser compliance. It does not, by itself, tell a ChatGPT user whether their email ended up in someone else's file.

The 25,000 matched user threshold

Size rules are where ChatGPT ads look most like Meta-style custom audiences, with a hard floor that blocks microtargeting of a handful of people.

According to both 404 Media and OpenAI's docs:

• Inclusion (show ads to people on the list) and bid adjustments (raise or lower bids for them) need enough matched users. OpenAI's public planning threshold is 25,000 matched users.
• Exclusion (keep people on the list out of a campaign) can use small or even empty ready audiences. No minimum matched size is required for exclusion alone.
• Being on an advertiser's list does not by itself cause an ad to be shown. The list is a filter and a bidding tool, not a guaranteed delivery switch.
• Uploading 25,000 identifiers does not guarantee 25,000 matches. Privacy safeguards can affect the exact boundary. Advertisers cannot select specific people inside an audience or see who matched.

That design stops the cartoon version of abuse in which someone uploads a single ex-partner's phone number and force-feeds them an ad. It does not stop large advertisers, political campaigns, or data-rich brands from using customer files at scale. A list that is too small for inclusion can still be used to carve people out of a campaign. A list that clears the threshold can be used to aim spend at known customers, known prospects, or known lookalikes depending on how the advertiser built the file.

Cox also notes that Meta hashes raw emails and phones on upload in its comparable flow. OpenAI, asked whether it does the same for raw uploads, did not give a clear yes. A spokesperson told 404 Media that uploaded files are deleted after processing, usually within 24 hours. The company reiterated that advertisers can submit both raw and hashed data. Whether raw values are hashed internally before matching remains unclear from OpenAI's public answers.

What "ads personalization" actually turns off

ChatGPT has a setting that sounds like an escape hatch. The label is about ads personalization. The help text, as quoted by 404 Media, says roughly: allow ChatGPT to use your past chats, activity and preferences to select ads. Then comes the catch: "Ads may still be based on your current chat."

So opting out removes a history-based personalization layer. It does not create an ad-free experience. It does not promise that the live conversation is ignored. It also does not claim to block custom audience matching based on email, phone or GAID. Those are different levers. Users who flip the toggle and expect silence will still see ads, and those ads can still be shaped by what they just typed.

That design choice is easy to miss in a settings menu. Privacy language often collapses several ideas into one switch: tracking, personalization, first-party lists, contextual placement. OpenAI's wording separates past activity from the current session. Contextual ads that follow the live prompt survive the opt-out. List targeting lives in the advertiser tools, not in that toggle.

For Free and Go users who already accept ads as the price of the product, the practical question is narrower: do you understand that the chat you are having right now can steer the sponsored card under the answer, even after you turn personalization off? Cox's reporting says yes.

Why prompts as targeting signals feel different

Ad networks have used keywords and topics for decades. Search ads are built on queries. Social ads are built on interests and lookalikes. ChatGPT's novelty is that the "query" is often a long, intimate, multi-turn conversation. People paste medical notes, legal drafts, job fears, relationship problems and company secrets into chatbots. Even when they know humans may review some chats for safety, many still treat the box as closer to a diary than to a Google search bar.

404 Media previously reported that contractors can read real user prompts in some review programs. The new ads story does not claim that advertisers get raw transcripts. Context hints are advertiser-written descriptions, not a dump of your history. Still, the matching layer means the content of a session can decide which paid message appears underneath the model reply. That is a different social contract than "we show a generic banner because you are on the free tier."

There is already a cottage industry around observing those placements. Sites such as ChatGPT Ad Library probe ChatGPT with consumer-style prompts and record which sponsored cards come back. 404 Media cites figures from that project on the order of tens of thousands of ads across hundreds of thousands of placements in their captured sample. Those numbers are the scraper's sample, not OpenAI's internal inventory. They do show that prompt-to-ad mapping is real enough for third parties to catalog.

Edwards from DecryptAds argued that stronger data broker laws are needed so advertisers who share sensitive personal data with ad tech companies register and give people a clear removal path. Whether lawmakers follow that advice is outside the product facts. The product fact is that OpenAI already accepts first-party audience files and conversation-shaped hints inside ChatGPT.

What OpenAI says the system is not

OpenAI's public posture, pieced together from the spokesperson lines in 404 Media and from the developer docs, stresses limits:

• List membership alone does not force an ad to appear.
• Inclusion and bid multipliers need a large matched audience.
• Advertisers do not get a roster of which users matched.
• Uploaded audience files are deleted after processing, usually within a day.
• Ads are labeled and, in OpenAI's product claims elsewhere, supposed to stay separate from model answers.
• Personalized ads and custom audiences are not yet available for EEA and Switzerland campaign targeting in the docs Cox's story sits beside.

Those are real constraints. They do not erase the core surprise for many users: someone can buy ChatGPT inventory and aim it with a customer email file or with a description of privacy-anxious chats. The frog-boiling metaphor Edwards used is about expectations, not about whether every safeguard is fake.

OpenAI did not clearly answer whether raw email and phone uploads are hashed the way Meta's upload flow hashes them. Until that is documented, privacy reviewers will keep treating raw upload as a higher trust ask than hashed upload. Deleting the file in 24 hours reduces long-term storage risk. It does not explain the in-memory matching step.

How this fits the wider OpenAI ads push

Earlier in October, OpenAI talked up a more visual ad format and a longer list of measurement partners, including conversion and attribution vendors. Digiday and others covered advertiser demands for better formats and better measurement after months of a simpler text-heavy unit. Image-adjacent ads and partner measurement are about making the channel sellable to brands. Custom audiences and context hints are about making the channel precise.

Precision is usually what platforms sell next, after they prove that ads can appear at all. ChatGPT already has enormous prompt volume. Chowdhury of Zeno Group, quoted in Digiday's earlier coverage of the visual ads push, compared billions of daily prompts to Google's search volume and noted that ChatGPT still has fewer ad slots per session. Scarce inventory plus rich session context is exactly the kind of environment where list targeting and contextual hints become valuable to buyers.

For publishers and privacy advocates, the same combination is the worry. A scarce slot under a trusted answer can feel more like a recommendation than a banner. If that slot can also be reserved for people whose phones are on a file, the recommendation is no longer generic.

Practical takeaways for users and teams

If you use ChatGPT Free or Go in a region with ads: assume the current chat can influence which ad you see, even if ads personalization is off. Assume that an email or phone number tied to your account could, in principle, match an advertiser audience if that advertiser already has your data from elsewhere. You cannot see when a match happens. You can only decide how much you care.

If you run marketing that might buy ChatGPT ads: treat custom audiences like any other large-platform list product. Prefer hashed uploads when you can. Stay inside first-party rights. Remember the 25,000 matched-user planning line for inclusion. Do not confuse OpenAI's "ready" status with eligibility for every use. Check intended use filters for exclusion versus inclusion versus bid multipliers.

If you advise companies on AI policy: separate three risks that often get mixed together. One is human review of chats for safety. One is contextual ads based on the live prompt. One is offline list matching via email, phone or GAID. Cox's piece is mainly about the second and third. Users hear "ChatGPT ads" and often think only of the first.

If you are in the EEA or Switzerland: the current custom audience docs say those personalized campaign targets are not supported yet. That is a pause, not a permanent guarantee that the product will never arrive.

What to watch next

1. Clearer hashing answers. OpenAI still needs a plain statement on whether raw uploads are hashed internally the way hashed columns already are. 2. EEA expansion. If personalized ads and custom audiences reach Europe, the regulatory fight will be sharper under GDPR and the DMA. 3. User interface honesty. A personalization toggle that still allows current-chat ads should say so in large type, not only in a subordinate sentence. 4. Third-party ad libraries. As scrapers map prompt-to-ad pairs, journalists and researchers will keep stress-testing what kinds of sensitive chats trigger commercial cards. 5. Enforcement interest. Consumer protection agencies that already care about AI safety claims may eventually care about how chatbot ads use personal data and session context. That is speculation about attention, not a filed case.

Dany's take

I do not think ChatGPT ads are shocking because list targeting exists. Email and phone audiences are standard across Meta, Google and retail media. What feels different is the container. People type things into ChatGPT that they would never put in a search box, and they do it in a UI that still looks like a private assistant. Selling context hints on top of that, while telling users that turning off personalization does not stop current-chat ads, is a clarity problem as much as a technology problem. OpenAI should say, in one short sentence on the settings page: ads can still follow this conversation, and advertisers can still match accounts from lists they already have. If the product needs that sentence to be honest, the product needs that sentence.

I also think the 25,000 matched-user floor is a meaningful consumer protection compared with true one-to-one stalking via ads. Credit where it is due. The open question on raw-data hashing is the opposite: until OpenAI answers it cleanly, every privacy review will assume the weaker case. Delete-in-24-hours helps. It does not replace hashing.

The bottom line

404 Media showed that ChatGPT ads can be aimed with uploaded emails, phone numbers and Android advertising IDs, and steered with context hints about the kinds of chats where an ad should appear. OpenAI's Custom Audiences docs confirm the identifier types and the 25,000 matched user planning threshold for inclusion and bid adjustments, while smaller audiences can still be used for exclusion. Uploaded files are deleted after processing, usually within 24 hours, but OpenAI did not clearly say whether raw values are hashed internally. Turning off ads personalization does not stop ads, and ads may still be based on the current chat. If you treat ChatGPT as a private notebook, update that mental model: the commercial layer can read the room, and it can recognize you from a list.

Sources: 404 Media: How ChatGPT Targets Ads To You Based On Your Prompts, Phone Number, and Email (Joseph Cox, 15 Oct 2026), 404 Media newsletter item on the same tests, OpenAI developers: Custom Audiences, Gizmodo: Here's How ChatGPT Is Targeting You With Ads (AJ Dellinger, 16 Oct 2026), The Neuron Daily, 16 Oct 2026. Secondary context on the broader ads product push: OpenAI: Building advertising for the way people use AI (5 Oct 2026), Digiday on visual ads and measurement.