On October 16, 404 Media published an investigation into how OpenAI actually configures ad targeting inside ChatGPT. It turns out advertisers can upload lists of customer identifiers — email addresses, phone numbers, device advertising IDs (including Android IDs) — either raw or hashed. OpenAI matches these lists against ChatGPT accounts, and matched users become eligible to see that advertiser's ads. The advertiser itself never learns whether a specific person matched: the minimum upload threshold is 25,000 entries, so a single email can't be used to target one individual. Separately, OpenAI confirmed to the outlet that ads "may still be based on your current chat" — meaning what the user is typing right now.
Why the 25,000-entry floor doesn't solve the real problem
At first glance, the 25,000-entry threshold looks like a reasonable safeguard against tracking one specific person. For businesses, though, it's more a marker of scale than a privacy guarantee. Any company with a customer database that size is no longer a niche local brand — it's a retail chain, a telecom operator, or a large online school. Those are exactly the businesses that can now match their CRM against ChatGPT's user base and show ads to people who, say, told the bot a month ago about a divorce, a diagnosis, or financial trouble — simply because their phone number matched one on the uploaded list. 404 Media states plainly that it could not confirm whether OpenAI hashes raw uploaded data in every case, which means the risk of a leak or misuse of the list before deletion (OpenAI promises to delete files within 24 hours) rests largely on the advertiser's good faith, not just the platform's.
Personalization can be turned off in ChatGPT's settings, but not entirely: per the investigation, the opt-out blocks targeting based on chat history and preferences, but not on the content of the current conversation. That means someone who just asked the bot about anxiety symptoms could, in theory, still see a related ad even with every available privacy setting switched on.
What this already changes in media planning
Picture a small Portuguese cosmetic dentistry clinic that buys ads on Google and Meta. If it holds a list of 30,000 email addresses from current and former patients — built up over five years through its CRM — it can technically upload that list to ChatGPT's ad account right now and show ads to anyone who has asked the bot about dental work, dentures, or fear of the dentist. For an agency, this means ChatGPT stops being just "another traffic source for the website" and becomes a full advertising channel with its own attribution logic — one that needs its own line in the media plan, not a leftover-budget experiment.
There's honest room for skepticism here, too: OpenAI hasn't disclosed how effective this targeting actually is compared with standard Google Ads or Meta Ads, and there's no independent conversion data yet — the market is simply too young. A business that decides to test this channel should budget for it as a hypothesis test, not a proven lead source, and should always cross-check attribution numbers against its own analytics rather than trusting the platform's reports alone.
It's worth comparing this with how targeting already works on Google and Meta. Uploading customer lists (Customer Match, Custom Audiences) has existed for roughly a decade, and businesses have long treated it as a routine part of media planning. The difference is that in a Google search or a Meta feed, a person isn't speaking a personal problem out loud — they're searching for a product or scrolling content. In ChatGPT, users often describe their situation literally: "my tooth hurts and I'm scared of the dentist," "I don't know how to tell my partner we're in debt." Matching that kind of text against an ad profile is a qualitatively different level of data sensitivity, and European regulators — including in Portugal, under GDPR — will almost certainly notice that difference faster than they ever scrutinized ordinary Customer Match lists.
For companies building automated advertising funnels, this news matters for another reason: it shows personalization moving from browser cookies into the conversational interface, and analytics systems still wired only to classic pixels risk missing a meaningful share of the customer journey. At Dayava, we set up end-to-end analytics and marketing automation with exactly this kind of shift in mind — so a business sees the full picture instead of losing data in the blind spots of new channels.
If a similar solution interests you for your business, leave a request at dayava.pt/contactos/.
Source: Gizmodo, "Here's How ChatGPT Is Targeting You With Ads"