On October 15, 404 Media published an account of an experiment its reporter, Joseph Cox, ran inside ChatGPT’s advertising console. He uploaded a file of email addresses and phone numbers, built two campaigns against it, and wrote ad copy that said, in as many words, that ChatGPT is not private.
The ads ran. That result is what makes the test worth reading for advertisers, privacy regulators and anyone who has treated a chatbot conversation as closer to a diary than to a search query.
OpenAI’s ad system, which began appearing in ChatGPT this year, offers two ways to choose an audience. An advertiser can select a topic, and the system places a sponsored answer beside conversations about, say, running shoes or accounting software. Or the advertiser can bring a list of its own: email addresses, phone numbers or Android advertising identifiers, which OpenAI matches against accounts.
Lists smaller than 25,000 records cannot be used to build an audience. They can still be used to exclude one. That threshold says something about the matching: a short list produces too few hits to spend against, but it is precise enough to keep a named group of people from seeing an ad.
None of the machinery is new. Meta and Google have sold customer-list matching for more than a decade, and the technique is the backbone of retail advertising online. Match rates vary with list quality and typically land between a third and two thirds of records, which is enough for a brand to measure whether a campaign moved sales.
What is new is the setting. A search engine infers intent from a string of keywords. A chatbot is told, in sentences, what a person is worried about, what they are about to buy and what they do not understand. The signal is better, and better signal is the whole business.
OpenAI has answered the questions this raises with a set of narrow assurances. The company said uploaded files are deleted within 24 hours of processing, that advertisers cannot see which accounts matched, and that appearing on a list does not by itself cause an ad to appear. A person has to fall inside an audience the advertiser built and then clear the relevance and frequency rules the system applies.
Each of those statements can be accurate while the larger question stays open. The advertiser does not need to know who matched. It needs to know that a campaign aimed at 200,000 addresses produced a measurable lift among the people on it, and the system is built to tell it exactly that.
The gap between the privacy language and the product is the part regulators tend to notice. OpenAI has spent two years telling users that their conversations are protected, that training data respects their settings and that enterprise content is walled off. The ad console is governed by a different document, with different defaults and a different vocabulary.
One detail from the test bears on that. Turning off personalization does not turn off ads. It removes some of the targeting, and the system may still place a sponsored answer based on the conversation in front of it. That is a defensible design for a product that has to pay for inference, and it is not what most users picture when they see a switch labeled personalization.
Advertisers have their own reasons to press. ChatGPT reaches a very large audience, but the budgets it wants come from brand marketers who are used to buying against measured audiences and measured outcomes. Without list matching and conversion reporting, the product competes for leftover performance spend. With them, it competes for the money that funds television.
The comparison that unsettles privacy lawyers runs to retail media. Grocery chains and airlines now sell advertising against purchase histories, and the legal theory supporting that trade rests on consent language few shoppers read. A chatbot holds richer material than a loyalty card and, until this year, a lighter regulatory record.
That record is filling in. The Federal Trade Commission has been examining data practices at the largest AI companies, privacy laws in a dozen states give consumers rights over profiling, and European regulators have ruled repeatedly on how identifiers may be matched without consent. Uploaded customer lists sit directly in that territory.
A competitive argument cuts against restriction. If OpenAI limits list matching, advertisers can move the same budget into Google’s Performance Max or Meta’s Advantage+ and reach the same people with less friction. A company committed to building an ad business inside a subscription product has to offer the tools its buyers already expect.
For users, the practical question is smaller and harder to answer. A person who types a question about a medical symptom, a debt or a divorce is generating the most valuable targeting data in the history of the medium, and the disclosure that covers it is a settings page.
What to watch is narrow. Whether list upload stays open to any advertiser or gets restricted to a verified tier. Whether OpenAI publishes match rates, as Google and Meta do. And whether the company enforces a rule against ad copy that makes claims about the product itself, which is what the two test campaigns did.
Cox’s ads were cheap to run and easy to approve, which suggests the review process was not looking for that kind of claim. The next test will come from someone with a budget and a reason to push harder, and the answer will be visible in what the console allows six months from now.
