ChatGPT Now Serves Targeted Ads — and Advertisers Can Aim at You by Your Prompts, Email, and Phone Number
404 Media bought real ads inside ChatGPT to expose that advertisers can target users by prompt context, uploaded email lists, and phone numbers — with an 'off' switch that doesn't fully stop it. The Neuron reports this affects roughly one billion monthly ChatGPT users who largely don't know the system exists.
If you assumed that typing a question into ChatGPT was more private than typing it into Google Search, a recent investigation by 404 Media should make you rethink that assumption — fast. As reported by The Neuron, the publication actually purchased and ran ads inside ChatGPT to demonstrate, in practical terms, exactly how granularly advertisers can target you inside the world’s most popular AI assistant.
The Stunt That Made the Point
Reporter Joseph Cox at 404 Media ran two ads inside ChatGPT. Both carried the same message: “ChatGPT isn’t private. OpenAI hires humans to read users’ chats. Learn more.” The ads were deliberately aimed at users asking about privacy and AI — which is itself a demonstration of the targeting capability being criticized. It is the kind of recursive move that cuts through abstraction: rather than writing about the ad system, 404 Media used the ad system.
But as The Neuron correctly points out, the stunt matters less than the underlying mechanics it exposed. The investigation revealed two distinct ways advertisers can reach you inside ChatGPT, and understanding both is essential if you use the platform for anything sensitive.
Two Targeting Methods You Should Know About
Method One: Prompt-Context Targeting
The first approach works similarly to keyword advertising on search engines, but with an important difference. Advertisers describe topics or keywords, and OpenAI uses these to match ads to users whose conversations are relevant. OpenAI itself says these inputs “guide matching but aren’t exact-match targeting rules” — meaning it is a probabilistic, AI-mediated match rather than a literal keyword trigger.
In plain terms: if you are asking ChatGPT about health insurance options, a health insurance company’s ad could appear. If you are asking about home loans, a bank might be waiting in the wings. The conversation you are having — even one you consider private — is being read, at least in aggregate, to serve you commercially relevant content.
Method Two: Customer List Uploads
The second method is more direct and, arguably, more unsettling. Advertisers can upload lists of emails, phone numbers, or Android advertising IDs, and OpenAI matches these against real ChatGPT user accounts. According to the 404 Media investigation, lists of more than 25,000 entries can be used to actively target specific individuals. Smaller lists — those under that threshold — can only be used to exclude people from seeing an ad.
This is standard practice across digital advertising. Meta, Google, and virtually every major ad platform offer similar customer-match functionality. But the context here is different: this is not a social media feed or a search results page. This is a conversational interface that many users approach with a degree of trust, often sharing professional details, health concerns, legal questions, or financial situations that they would never type into a public search bar.
The Hashing Question OpenAI Has Not Answered
One of the most pointed details in the 404 Media report concerns what happens to those uploaded contact lists. Advertisers can submit them in two forms: raw (meaning the email addresses and phone numbers are plainly readable) or hashed (meaning they have been scrambled into anonymised codes before upload). OpenAI says files are deleted after processing, typically within 24 hours, and that advertisers cannot see which specific individuals matched.
Here is the problem: as of the investigation, OpenAI had not confirmed whether it hashes raw uploads before processing them. Meta, by comparison, explicitly does. Whether OpenAI applies the same protection to plaintext data before it is matched against user accounts is a straightforward question with significant privacy implications — and it remains unanswered.
The “Off” Switch That Is Not Really Off
OpenAI does offer users an “ads personalisation” toggle they can switch off. The 404 Media investigation found, however, that turning this off does not stop ads from appearing, nor does it stop tracking entirely. According to their reporting, the setting itself acknowledges that ads “may still be based on your current chat.”
That is a meaningful distinction. If you turn off ads personalisation expecting a clean, ad-free, untracked experience, the reality is more nuanced: what you are getting is less personalisation, not none. Your current conversation can still inform the ads you see, even with the setting disabled.
Why This Matters at Scale
Zach Edwards of DecryptAds, quoted in the 404 Media piece, describes the dynamic as “boiling the frog” — a gradual normalisation of surveillance practices inside a product that users do not instinctively think of as an ad platform. The estimate in the article is that most of ChatGPT’s roughly one billion monthly users have no awareness that any of this targeting infrastructure exists.
To put that number in context: one billion monthly users is a larger audience than most national television networks reach in a year. The shift of advertising into conversational AI interfaces represents something qualitatively new, not just quantitatively large. When you search Google for “best credit card for travel,” you know you are in an environment built around ads. When you ask ChatGPT the same question in a back-and-forth conversation about your upcoming trip to Goa, the experience feels different — more personal, more advisory, less commercial. That perception gap is exactly where the privacy risk lives.
What This Means for Indian Users
For users in India — where ChatGPT’s user base has grown rapidly and where the platform is increasingly used for professional, educational, and financial queries — the implications deserve specific attention. Many users turn to ChatGPT for questions about tax filings, job applications, medical symptoms, and business planning. These are precisely the categories that are most valuable to advertisers and most sensitive from a personal privacy standpoint.
Customer list targeting using phone numbers is particularly relevant in the Indian context, where mobile numbers function as universal identifiers tied to Aadhaar, bank accounts, and government services. If an advertiser uploads a list of phone numbers and OpenAI matches those against ChatGPT accounts, the targeting can be highly specific — directed at people whose real-world identity and financial profile may already be known to the advertiser.
Two Questions to Watch
The 404 Media investigation, as summarised by The Neuron, leaves two open questions that will determine how this story develops.
First: will OpenAI clarify whether it hashes raw contact data before using it for matching? The answer determines whether plaintext emails and phone numbers are ever stored or processed in readable form on OpenAI’s infrastructure.
Second: will OpenAI modify the “off” setting so that disabling ads personalisation also removes the ability to target users based on their current conversation? Right now, that is not the case — and the gap between what users expect the toggle to do and what it actually does is significant.
What You Can Do Right Now
Until those questions are resolved, there are practical steps worth taking.
- Treat any ChatGPT conversation the same way you would treat a search query on a commercial search engine: assume it is being read and may inform what is shown to you.
- Review your ChatGPT privacy settings, including the ads personalisation toggle, but do so with the understanding that “off” reduces rather than eliminates prompt-based targeting.
- For genuinely sensitive questions — legal, medical, financial — consider whether an AI assistant with stricter data commitments, or a local model running on your own device, is more appropriate.
- Be aware that your email address or phone number, if known to an advertiser, may already be enough to make you a specific target inside ChatGPT.
The Bigger Picture
The broader arc here is familiar. A technology product launches with a clean, utility-focused experience. It grows to enormous scale. It introduces advertising to monetise that scale. Users discover that the ad infrastructure is more detailed than they realised. Calls for transparency follow.
ChatGPT is moving through that arc faster than most platforms before it, partly because the conversational format creates an unusually intimate data signal and partly because OpenAI is under commercial pressure to demonstrate a path to revenue that justifies its valuation. The ad system 404 Media exposed is not a bug or a breach — it is a feature, built deliberately, and now documented in public. What changes next depends on whether users, regulators, and advertisers treat that documentation as consequential.
For now, the safest mental model is the one The Neuron’s summary offers: treat a ChatGPT conversation like a search box that can show ads. That reframe alone shifts how you decide what to type.
