Every empire of attention ends up in the same place. First comes the gift, the free square where anyone may speak. Then the square has to be paid for, and its walls are put up for rent. That, at least, is how it tends to go, and ChatGPT, used by some one billion people every month, is now partway along that road.
The square and its walls
On 16 January OpenAI published a post titled Our approach to advertising and expanding access to ChatGPT. It said ads would be tested at the bottom of answers “when there’s a relevant sponsored product or service based on your current conversation.” The same post promised no ads for users under 18 and none in conversations about sensitive or regulated subjects such as health, mental health or politics. People paying for Plus, Pro, Business or Enterprise would be spared. The ads arrived in the United States in February, on the Free and Go tiers, and then spread to other countries, Europe among them. This month they moved again, onto the results of image generation.
So far the people buying space on these walls have been a narrow crowd. Much of the advertising has been software sold to people who already buy software. The more interesting question is how the walls decide whom to address.
An advertisement against the advertiser
To find out, Joseph Cox of 404 Media became an advertiser himself. The outlet ran two ads inside ChatGPT. Both carried the same text, written as a warning about the place they were shown in:
ChatGPT isn’t private. OpenAI hires humans to read users’ chats. Learn more
The link led to 404 Media’s earlier reporting on Project Lily, in which contractors read the prompts of real ChatGPT users.
OpenAI lets advertisers give the system “context hints” so that an ad reaches people using the chatbot for particular things. In the company’s words: “Describe the conversations, topics, or keywords where your products or services may be relevant; these hints guide matching but aren’t exact-match targeting rules.” 404 Media asked for people searching for privacy topics, or for the privacy of ChatGPT chats specifically, or asking about current technology and AI.
That is the part with no real precedent. Other platforms target what you do and who you are. This one also targets what you confide to it, in prompts many users probably think of as private, and which, as Project Lily showed, other people may read.
The list
Then there is the audience: a list of specific users the advertiser wants to reach. OpenAI accepts “raw” email addresses and phone numbers, hashed versions of both (scrambled so the plain text is not handed over), and Android advertising IDs, the unique identifier given to every Android phone. The company checks the list against its own users, and where a match is found, those people can be targeted. According to 404 Media, the advertiser doing this can be a large business “or essentially a random person.” The feature had appeared quietly in the summer: OpenAI described it in an email to advertisers on July 9, according to Shopifreaks, and trade outlets such as Search Engine Land reported the rollout.
There are limits. In 404 Media’s tests, a list could only be used to target people once it had more than 25,000 entries. Below that, it could only be used for exclusion, to make sure the people on it did not see the ad. Meta’s systems hash raw email addresses and phone numbers when they are uploaded. Asked whether OpenAI does the same, the company did not answer, and only repeated that advertisers can upload both raw and hashed data. A spokesperson said uploaded files are deleted after processing, usually within 24 hours, and added:
Being on an advertiser’s list does not, by itself, cause an ad to be shown. Inclusion filters and audience bid adjustments require at least 25,000 matched users, and advertisers cannot see which individuals matched or select specific people within an audience.
Note the small difference. 404 Media described the threshold as a count of entries on the uploaded list. The spokesperson put it as a count of matched users, which is a higher bar, since not every uploaded address belongs to a ChatGPT account. Either way, the threshold protects the individual by hiding them in a crowd. It does not ask whether the crowd agreed to be assembled.
A switch that half turns off
Users can opt out of “ads personalization.” The setting describes what it does, and what it doesn’t: “Allow ChatGPT to use your past chats, activity, and preferences to select ads. Ads may still be based on your current chat.” Switching it off stops the use of your history. The conversation you are having right now is still in play.
The ads, catalogued
A small trade has already grown up around watching these ads. A site called ChatGPT Ad Library feeds prompts into the chatbot and records what comes back. It says it has captured at least 43,410 ads across 415,289 placements, and it is careful about what that means: “Figures reflect our captured sample, not OpenAI’s internal data.” Search it and you can see which prompt brings up which ad. “free ai video generator with sound” brings up an AI video-editing tool. “which AI moderator is best” brings up a company promising to remove harmful content from the web, and the same company appears again for “best tools to monitor reviews before they damage app rankings.”
Zach Edwards, co-founder of DecryptAds, which collects online advertising data for research, sees the familiar pattern. “OpenAI’s advertising products are operating just like most other massive companies which start to monetize their audiences,” he told 404 Media. “They are boiling the frog and hoping their users won’t notice the privacy implications from their new ads.”
His remedy is aimed at the advertisers rather than the platform. “We need to strengthen data broker laws so that advertisers sharing sensitive PII [personally identifiable information] with ad tech companies like OpenAI are required to register as data brokers and give people a clear process for removing their data from these systems.”