ChatGPT Ads Can Target You by Prompt, Phone Number, and Email
A 404 Media investigation found advertisers can upload email and phone lists to target ads inside ChatGPT sessions, and targeting also draws on prompt content, reaching Free and Go plan users even when personalization is disabled. OpenAI says advertisers cannot see who matched their lists and uploads are deleted within about a day.
On this page
The finding
A 404 Media investigation published on 15 October shows advertisers can inject ads into ChatGPT users' sessions and target specific groups of people using uploaded lists of email addresses and phone numbers, or based on what users discuss in their prompts. The targeting reaches Free and Go plan users, and it applies even when the user has personalization disabled in settings, according to the report.
The mechanism resembles the custom-audience matching that Meta platforms pioneered: advertisers upload contact lists, the platform hashes them, and ads serve to matching accounts. What is new is the venue and the signal. The venue is an assistant people use for medical questions, legal worries, and personal crises; the signal is the prompt content itself, which 404 Media notes can reveal context, emotion, and detail that a cookie never could.
What OpenAI says, and what stays true anyway
OpenAI's response to the investigation: advertisers cannot see which specific users matched their targeting lists, and uploaded files are deleted after processing, usually within 24 hours. Both claims matter, and neither changes the core transaction. The platform knows who you are and what you asked; the advertiser learns that their list matched; and the ad that follows is personalized by the most sensitive signal in the stack, your own words.
The August launch coverage framed ChatGPT ads as a billion-dollar run-rate business serving more than 40 countries, with OpenAI asserting advertisers cannot access private conversations. The investigation tests that boundary precisely: the conversation stays private from the advertiser, while the targeting built on it gets more personal. Both statements remain technically true, which is exactly how modern ad-privacy claims tend to work.
The local-AI angle, sharpened
This is the clearest demonstration yet of the trade local models opt out of. A locally run assistant has no server-side session to match against an uploaded contact list, no prompt history to score for ad relevance, and no business unit whose revenue depends on either. The trade is real: you give up frontier-cloud quality and pay for hardware.
For Free and Go users, the practical options are limited: upgrade to a paid tier outside the ad-serving scope, keep sensitive prompts in a local or non-ad-supported assistant, or accept prompt-based targeting as the cost of the free tier. What the investigation changes is visibility: the targeting draws on prompt content, not just account metadata, and that is a fact every free-tier user should have before their next question. The visibility now runs in both directions: users finally have a documented mechanism, named fields, and a retention window to hold the platform to, and regulators have a concrete example of personalization claims meeting ad-targeting practice.