ChatGPT Ads Can Find You by Email: How Advertisers Match Customer Lists to Your Chats, and the Settings That Matter (AI Trends, 17 October 2026)

What’s trending in AI on 17 October 2026: Advertising inside ChatGPT has quietly grown up. An investigation by 404 Media, published on 15 October, bought two real ad campaigns to see how the system works and found that advertisers can upload lists of email addresses, phone numbers or Android advertising IDs, have OpenAI match them to ChatGPT accounts, and then show ads to those people based partly on what they are typing. None of this is hidden: it is in OpenAI’s own help pages for advertisers. But most of ChatGPT’s roughly one billion monthly users have probably never read them, and the “ads personalization” switch does less than its name suggests. The same week, OpenAI’s Chrome extension gained the ability to act inside your open browser tabs. Below: how an ad gets chosen in a chat, what custom audiences are, what OpenAI says protects you, what remains unanswered, and a ten-minute audit for individuals, employers and marketers.

Key takeaways

Your email can be a targeting key. Advertisers can upload raw or SHA-256-hashed emails and phone numbers, or Google Advertising IDs, and OpenAI matches them to ChatGPT users.
Your prompt is part of the targeting. Ads are chosen using the context and intent of the current conversation, plus advertiser “context hints” describing topics where an ad should appear.
Turning personalization off does not stop ads. It removes past chats and memory from ad selection, but the current chat can still shape which ad you see.
There are guardrails, by OpenAI’s account. A 25,000-matched-user minimum for inclusion targeting, files deleted after processing, no ads near health or political chats, and no ads for paid or under-18 accounts.
Businesses are on both sides. Staff using free ChatGPT for work see ads; marketing teams uploading customer lists take on their own privacy obligations.

ChatGPT’s ad system uses the same list-matching tools as social media, plus something new: what you type.

1. What 404 Media found

Reporter Joseph Cox did what any small business could do: he bought two campaigns through OpenAI’s self-serve Ads Manager. The ads themselves made a point. They told users that ChatGPT is not private because OpenAI hires people to read chats, a reference to 404 Media’s September reporting on “Project Lily”, in which hundreds of contractors rated real ChatGPT conversations to improve the model. The campaigns were aimed at people asking about privacy and AI.

The test showed two ways an advertiser can reach someone. The first is topical: advertisers write “context hints” describing the conversations, subjects or keywords where their product might fit. The second is personal: advertisers upload a list of identifiers, such as customers’ emails, and OpenAI checks which ones belong to ChatGPT users. 404 Media notes that list targeting is standard across the ad industry. What is new is combining it with the content of a conversation that many people treat as private, whether they are asking about a rash, a debt or a job search.

Zach Edwards of DecryptAds, quoted by 404 Media, called the gradual approach “boiling the frog”. The phrase fits the timeline. OpenAI started testing ads in the US on 9 February 2026, opened a self-serve Ads Manager beta to all US businesses on 5 May, launched in the UK on 6 June and documented custom audiences in July. Together, these steps give ChatGPT search-style intent plus social-style audience matching. We first flagged the direction when we covered OpenAI’s ads test in image generation earlier this month.

Eight months separated the first US test from list-based targeting tied to live conversations.

2. How an ad gets chosen inside a chat

OpenAI’s help page for users lays out the inputs. When an ad slot is available, the system looks at the context and intent of your current conversation, the advertiser’s landing page, title and copy, the advertiser’s context hints and its targeting choices. If ad personalization is on, it can also draw on “select signals” from your wider ChatGPT activity, including past chats and memory where memory is enabled. When several ads qualify, relevance and the advertiser’s bid decide which one appears first.

Context hints are looser than search keywords. In OpenAI’s words they “do not function as exact-match keywords”, which means an advertiser describes a theme and OpenAI’s systems decide which conversations fit. That is convenient for advertisers and harder for users to predict. You cannot easily know which words in your chat made you eligible for a given ad, though each ad has an “About this ad” option that explains why it appeared.

OpenAI says ads run on separate systems, are clearly labelled and do not change ChatGPT’s answers. Nothing in the 404 Media test contradicts that. The privacy question is about the data flowing into ad selection, not the answers.

Switching off personalization removes one input. Your current conversation stays in the mix.

3. Custom audiences: your email as a targeting key

Custom audiences are where the 404 Media story gets specific. According to OpenAI’s advertiser help page, a business can upload a CSV or TXT file of up to 500 MB containing email addresses, phone numbers in international format, SHA-256 hashes of either, or Google Advertising IDs from Android phones. OpenAI normalises the entries, matches them against its users and builds an audience that can exceed five million people. Processing usually takes 20 to 30 minutes.

The advertiser can then do three things with that audience: show a campaign only to it, exclude it from a campaign, or raise or lower bids for it by a multiplier between 0.1x and 10x. Inclusion and bid adjustments need at least 25,000 matched users, and OpenAI recommends 100,000. Smaller lists can still be used, but only to exclude people, for example to stop showing acquisition ads to existing customers.

Meta, Google and LinkedIn have offered customer-list matching for years. The difference is the setting: in ChatGPT, a matched ad can appear beside a conversation about your finances or a supplier dispute, chosen partly because of that conversation. Delana has written about how much people paste into chatbots at work; combined with list matching, that context becomes commercially valuable.

The 25,000 floor is meant to stop one-to-one targeting. It does not stop a list of customers being matched to their chats.

4. What OpenAI says protects you, and what is still open

OpenAI’s documentation lists several safeguards. Advertisers cannot see which individuals matched their list or pick specific people. Uploaded files are deleted after processing, usually within 24 hours. Advertisers receive only aggregated performance data such as views and clicks, never your chats, memories, name, email, precise location or IP address. The one exception is if you choose to message an advertiser through an ad, in which case they see what you send. These are OpenAI’s own descriptions; no independent audit has been published.

Two questions remain unanswered, according to 404 Media’s follow-up coverage. First, OpenAI accepts raw email addresses and phone numbers as well as hashes, but did not say whether it hashes raw data when it arrives. Meta, by comparison, says it does. Second, there is no clear way for a person to remove themselves from audiences that advertisers upload. You can switch off personalization and clear ads data, but you cannot stop a company that already has your email from including it in a list.

Regulators may take an interest. Personalized ads are not initially available in the European Economic Area or Switzerland, which suggests OpenAI expects tougher scrutiny there. In the US, the FTC already has open demands for OpenAI’s privacy and marketing records, which we covered in this week’s report on the state lawsuits and FTC demands.

5. Who sees ads, and what the off switch really does

Ads appear only for Free and Go users in eligible regions. Plus, Pro, Business, Enterprise and Edu accounts are ad-free. Accounts identified as belonging to someone under 18, whether from stated age or OpenAI’s age prediction, do not see ads. Temporary Chats show no ads, and OpenAI says ads are not placed near conversations about personal health, mental health or politics. Political advertising is not allowed for now. Free users can also choose an Ads-Free mode, at the cost of fewer daily messages and no access to some tools, such as image generation and deep research.

Setting or situation	Ads shown?	What is used to pick them
Free or Go, personalization on	Yes	Current chat, advertiser targeting and hints, plus past chats and memory
Free or Go, personalization off	Yes	Current chat and advertiser targeting; other threads, ad history and topics not used
Temporary Chat	No	Not applicable
Free with Ads-Free mode	No	Not applicable; fewer messages and some tools unavailable
Plus, Pro, Business, Enterprise, Edu	No	Not applicable
Account identified as under 18	No	Not applicable
Health, mental health or political conversation	No ads placed nearby	Regulated advertisers may run ads elsewhere under strict rules

Source: OpenAI Help Center, Ads in ChatGPT, accessed 17 October 2026. Whether a custom audience still applies when personalization is off is not spelled out.

The key line is the one 404 Media highlighted: with personalization off, ads “may still be based on your current chat.” For many people that will be the surprise. The switch narrows the data used but does not end conversation-based targeting. Clearing ads data stops it being used for ads, but OpenAI says removal from its servers can take up to 30 days.

For employers, the simplest privacy control is the plan: business tiers carry no ads.

6. Meanwhile, ChatGPT can now work your browser tabs

On 16 October, 9to5Google reported an update to OpenAI’s ChatGPT extension for Chrome. ChatGPT can now answer questions using the content of your open tabs and act in them: filling out forms, sending messages, downloading files and grouping tabs, from a sidebar similar to Chrome’s built-in Gemini panel. OpenAI’s examples include comparing products across tabs, checking pricing pages against requirements and filling in a registration form while stopping before submission.

The extension’s permission model, as described when it first launched in July, asks before ChatGPT works on a new site, with options to allow once, allow for that site, allow for all sites or decline, and asks again before sensitive steps such as sending information or making purchases. Chrome’s install prompt, however, lists broad access to data on all sites, history, bookmarks and downloads. Text and screenshots the extension reads become part of the conversation.

Nothing suggests tab content is used for ads. But ChatGPT is gaining more context about what you do just as its business model comes to depend on context. Our guide to why “allow always” is the new “I agree” covers how to handle agent permissions like these, and companies can manage the extension through Chrome Enterprise policies.

7. What this means for businesses

As an employer. If staff use personal Free or Go accounts for work, their work conversations can now shape the ads they see, and their work emails could be in an advertiser’s uploaded list. That is a prompt to move work use onto Business or Enterprise plans, which carry no ads and have admin controls. It also matters for data retention and vendor risk, a theme we explored when Character.AI’s bankruptcy raised the question of who owns chat data.

As an advertiser. ChatGPT ads are attractive because they reach people mid-decision. But uploading a customer list is a data-sharing decision, not just a marketing tactic. Depending on where you and your customers are, privacy laws may require that your privacy notice discloses this kind of sharing and that customers can opt out. Hash identifiers yourself before upload rather than relying on OpenAI to do it. Keep lists of people who have opted out of marketing out of inclusion audiences. And be wary of anyone offering access to ChatGPT ads outside OpenAI’s official Ads Manager: our report on fake AI ad portals showed phishers already exploit that interest. This is general information, not legal advice; check with counsel for your jurisdiction.

8. A ten-minute ChatGPT ad privacy audit

A timed audit for one sitting. Minutes one to four suit anyone on Free or Go; the rest are for teams.

Minute 1: check your plan. In ChatGPT settings, confirm whether you are on Free, Go or a paid tier. If you are on a paid or business tier, ads do not apply and you can skip to minute 5.
Minute 2: open Ad Controls. Go to Settings, then Ad Controls. Decide whether to turn off ad personalization, which removes past chats and memory from ad selection.
Minute 3: clear ads data. Use the clear option in Ad Controls if you want past ad interactions removed. Allow up to 30 days for deletion from OpenAI’s servers.
Minute 4: choose your sensitive-chat mode. For conversations you would not want an ad next to, use Temporary Chat, which shows no ads, or switch on Ads-Free mode and accept the lower limits.
Minute 5: review “improve the model”. Separately from ads, check the data-controls setting that allows your chats to be used for training, which is on by default for Free, Plus and Pro accounts; OpenAI says content used to improve its models may be reviewed by people.
Minute 6: audit the Chrome extension. If you installed ChatGPT for Chrome, open its site permissions, remove any “allow for all sites” grant and block banking, HR and admin consoles.
Minute 7: count personal accounts used for work. Ask team leads how many people use personal Free or Go accounts for work tasks. Any number above zero is a case for a business plan.
Minute 8: check your marketing team’s uploads. If you advertise on ChatGPT, list every custom audience, its source and whether it was hashed before upload.
Minute 9: compare against your privacy notice. Confirm your notice covers sharing customer identifiers with ad platforms for matching, and that opt-outs are removed from inclusion lists.
Minute 10: write it down. Record the decisions in your AI use policy so the next new hire, new campaign or new extension follows the same rules.

9. The bottom line

ChatGPT’s ad system is not secret, and many of its limits, such as the 25,000-user minimum, no ads for minors and no ads beside health or political chats, are more careful than parts of the wider ad industry. But it combines two things that used to be separate: what an advertiser knows about you from its customer list and what you are asking a chatbot right now. The off switch narrows that link without breaking it. For individuals, the fix is a few settings. For businesses, it is a plan decision for staff and a data-sharing decision for marketing. As OpenAI’s free tier keeps gaining features, it is worth remembering who pays for them.

Frequently asked questions

Can advertisers target me in ChatGPT using my email address?

Yes, as part of an audience. Advertisers can upload lists of email addresses, phone numbers, SHA-256 hashes of either, or Google Advertising IDs, which OpenAI matches to ChatGPT users. Inclusion targeting needs at least 25,000 matched users, and OpenAI says advertisers cannot see which individuals matched.

Does ChatGPT use my prompts to choose ads?

Yes. OpenAI says ads are selected using the context and intent of your current conversation, along with advertiser context hints, the ad’s content and targeting choices. With personalization on, past chats and memory can also be used. OpenAI says advertisers do not receive your conversations.

Does turning off ad personalization stop ChatGPT ads?

No. It stops other chat threads, ad history and topics being used, but you will still see ads, which may be based on your current chat. To avoid ads, use Temporary Chat, switch a Free account to Ads-Free mode with reduced limits, or use a paid plan.

Which ChatGPT plans have ads?

Ads may appear for Free and Go users in eligible regions. Plus, Pro, Business, Enterprise and Edu accounts are ad-free, and accounts identified as under 18 do not see ads. Personalized ads are not initially available in the EEA or Switzerland.

Is it legal for a business to upload customer emails to ChatGPT Ads?

It depends on your jurisdiction and what your customers agreed to. Many privacy laws require disclosure of sharing identifiers with ad platforms and an opt-out. Hash data before upload, exclude people who opted out of marketing, and get legal advice for your situation; this is not legal advice.

What can the updated ChatGPT Chrome extension do?

Since an update reported on 16 October 2026, it can answer using your open tabs and act in them, including filling forms, sending messages, downloading files and grouping tabs. It asks for permission per site and before sensitive actions, and businesses can control it through Chrome Enterprise policies.

Delana Technologies