OpenAI Shares ChatGPT User Data With Advertisers as EU Expansion Begins

OpenAI sent an email to users on April 30 laying out major changes to its privacy policy in the U.S. "We'll now use cookies to promote OpenAI products and services on other websites," the email stated. "This does not impact your conversations in ChatGPT. Your conversations with ChatGPT are private and are not shared with marketing partners." WIRED compared the new privacy policy to a previous version and found the biggest change revolves around how user data is shared for marketing purposes.

OpenAI spokesperson Taya Christianson told WIRED: "Nothing about our policy of not sharing people's conversations or other private user content with advertisers has changed. Like many companies, OpenAI works with select marketing partners to help people learn about our products on third‑party websites and apps, and we updated our privacy policy to clarify how this works."

The key distinction: OpenAI says it does not share the verbatim content of conversations with advertisers. But it does share "limited identifiers, such as cookie IDs or device IDs," Christianson told WIRED. The company may also share email addresses with advertising platforms so it can check whether users took specific actions — like signing up for Codex after seeing an ad for it on Instagram.

According to Adweek, OpenAI's updated policy also explicitly acknowledges receiving purchase data from advertisers and their partners to measure ad effectiveness. The company renamed its vendor disclosure category to include "marketing partners" — a sign that relationships with outside ad tech are being formalized beyond traditional service providers.

WIRED tested two free ChatGPT accounts and found marketing settings were "on" by default. Two paying accounts — one Plus and one Enterprise — did not have the settings enabled by default.

OpenAI is building the technical infrastructure to bring ChatGPT advertising to Europe. A code update to its conversion tracking pixel, reviewed by Digiday, adds a consent management system — a mechanism that asks users for permission before tracking them and stops tracking if permission is withdrawn. The update also adds a country field to the data the pixel collects, suggesting jurisdictional data handling is a priority.

This is required for EU compliance under GDPR, where explicit consent is needed before a tracking pixel can fire — fundamentally different from the U.S. opt‑out model. "OpenAI's move into advertising looks like it's being built with European regulation in mind, and it has to be, with governments increasingly focused on the next phase of the platforms' societal impact," said Enthropy Consulting founder Alex Tait, as reported by Digiday.

OpenAI's ChatGPT ad pilot is already extending beyond the U.S., with Canada, Australia, and New Zealand coming in the next weeks. The company is also hiring ad executives in London and Tokyo.

OpenAI took a different approach to ad measurement than the legacy platforms. While Google and Meta spent years building server‑to‑server alternatives after Safari and Firefox blocked third‑party cookies, OpenAI simply skipped that chapter, building server‑side from the start, Digiday reported.

But the pixel is still maturing. Early advertisers in ChatGPT's ads pilot had no pixel at all — they were manually tracking ad‑driven traffic using rough methods and spreadsheets. The current version only measures the last action a user takes before converting, such as clicking on an ad. More sophisticated measurement, like attributing ads a user saw but didn't click, is planned but has no confirmed timeline.

"Now that OpenAI has got the conversion pixel, they're going to start getting those implemented," Jai Amin, chief solutions officer at Jellyfish, told Digiday. "I'd imagine the narrative around this just being brand budgets is going to change once they start to see the data and conversion sales information coming in."

For developers and builders integrating ChatGPT into their products, the advertising shift raises several concerns:

• API users are not directly affected — yet: ChatGPT API usage is not included in the advertising program. API calls don't serve ads, and API data is not used for ad targeting under current policy.
• Custom GPT creators have no control: If you build Custom GPTs on the GPT Store, you have no say over whether your users see ads or are tracked — that's determined by the user's subscription tier.
• Trust erosion for integrators: Builders who route users through free ChatGPT are indirectly exposing them to ad tracking. If your product embeds ChatGPT widgets or directs users to ChatGPT, those users now have marketing cookies enabled by default.
• Competitive positioning: The shift to ads may push privacy‑conscious builders toward alternatives like Anthropic's Claude API or Google's Gemini API, which currently have no ad‑supported tiers.

Free ChatGPT users can opt out of marketing tracking by navigating to >>Settings Data Controls Marketing Privacy on the ChatGPT website. But the default‑on setting means millions of users are being tracked unless they actively change their settings — a pattern privacy advocates have criticized as a dark pattern.

ChatGPT conversations are uniquely intimate compared to typical web browsing data. Users share personal problems, medical questions, work challenges, and creative projects. While OpenAI says it doesn't share conversation content with advertisers, the behavioral signals derived from ChatGPT usage patterns could be far more revealing than traditional search or social media data.

For EU users, the consent management requirement means they'll at least get an explicit choice before tracking begins. For U.S. free users, the tracking is already on unless they find and change the setting.