OpenAI Flips the Switch: Free ChatGPT Users Now Tracked for Ads by Default

On April 30, 2026, OpenAI sent an email to users laying out major changes to its U.S. privacy policy. The most striking change: a complete reversal on targeted advertising. WIRED compared the old and new policies and found that OpenAI's previous pledge — "We don't 'sell' Personal Data or 'share' Personal Data for cross‑contextual behavioral advertising, and we do not process Personal Data for 'targeted advertising' purposes" — has been replaced with language that explicitly acknowledges sharing data for targeted advertising.

The new policy reads: "Depending upon your choices, we may share limited data with select marketing partners for purposes of promoting our products and services to you on third‑party properties. This is known as 'targeted advertising' or sharing for 'cross‑context behavioral advertising' under certain state privacy laws," as reported by WIRED.

WIRED tested multiple accounts and confirmed: free ChatGPT users have marketing privacy settings turned ON by default>>. They must manually navigate to Settings Data Controls Marketing Privacy to opt out. Paid users (Plus and Enterprise) do not have marketing tracking enabled by default.

The vendor disclosure category has been renamed from "Vendors and Service Providers" to "Vendors, Service Providers, and Marketing Partners." The new language states: "We also share limited information with select marketing partners who are not service providers in order to promote our products and services on third‑party properties and help us assess the effectiveness of those efforts," per WIRED.

What data is shared? Cookie IDs, device IDs, and email addresses — sent to advertising platforms to check whether users have taken specific actions like signing up for Codex after seeing an ad on Instagram. OpenAI states it does not share conversation content with advertisers.

The privacy policy change didn't happen in a vacuum. OpenAI has been quietly building a full advertising stack since January 2026, when it launched a ChatGPT ads pilot in the U.S. at $200K-$250K minimum spend, according to Digiday.

OpenAI's rush into advertising is driven by financial pressure. The company is projected to lose $14 billion this year alone, according to Karsten Weide, principal analyst at W Media Research, who told Digiday that OpenAI is "desperate for money" and "anything that can support the top line, they will pursue."

The ad business is already generating results: OpenAI recorded $100 million in annualized ad revenue just six weeks into the pilot, per Reuters, cited by Digiday. The Information projects the advertising opportunity could reach $102 billion by 2030. Multiple sources cite a planned IPO later in 2026 as adding urgency to building out the ads business.

However, the rapid expansion comes with declining rates. CPMs dropped from $60 at launch to as low as $25 within 10 weeks, Digiday reported on April 21, creating pressure to shift to CPC pricing models.

OpenAI is laying the technical groundwork for running ads in the European Union. The May 1 update to its conversion tracking pixel added a consent management system — a mechanism that lets advertisers ask users for permission before tracking, and stops tracking if permission is withdrawn, according to Digiday. The U.S. operates on an opt‑out basis, while the EU requires explicit consent upfront before a tracking pixel can fire.

The ad pilot is extending beyond the U.S. to include Canada, Australia, and New Zealand in the coming weeks, per Digiday. OpenAI is also looking for ads team executives in London and Tokyo.

Brian Kane, COO of Sourcepoint, warned: "A consent signal has to travel cleanly through every partner in the advertiser's tech stack — and that transmission problem is where ad tech has struggled for years. Each handoff creates a potential compliance risk, one regulators and privacy groups will be watching closely," as quoted by Digiday.

OpenAI spokesperson Taya Christianson told WIRED: "Nothing about our policy of not sharing people's conversations or other private user content with advertisers has changed. Like many companies, OpenAI works with select marketing partners to help people learn about our products on third‑party websites and apps, and we updated our privacy policy to clarify how this works. We do not share your conversations with these marketing partners. To make OpenAI marketing efforts more relevant and measure their effectiveness, we may share limited identifiers, such as cookie IDs or device IDs, and users can opt out at any time in settings."

However, WIRED also noted that a sentence regarding "sensitive Personal Data" was briefly absent from the privacy policy on the day of the change. When WIRED reached out, OpenAI claimed the removal was an error and added a similar sentence back in a different paragraph.

For developers and builders who rely on OpenAI's tools, the advertising pivot raises several practical concerns:

• Privacy defaults matter for developer tools. Many developers use the free ChatGPT tier for coding help and may not realize their cookie IDs and device IDs are now being shared with ad platforms by default. The Codex coding agent is specifically mentioned in the new privacy language as a product being promoted via this tracking.
• Conversations are still private (for now). OpenAI emphasizes it does not share chat content with advertisers. But the trajectory — from an explicit no‑targeted‑advertising commitment to enabling targeted advertising by default for free users in under a year — suggests this could change.
• No current impact on API users. The privacy policy changes and cookie tracking apply to the ChatGPT consumer product, not the API. But the broader strategic shift toward advertising could eventually influence API pricing or data handling.
• The sensitive data slip is concerning. The brief removal of language protecting sensitive personal data — even if called an error — signals that privacy protections may be treated as negotiable as the ad business scales.
• OpenAI skipped the cookie era entirely. Unlike Google and Meta, which had to retrofit their ad tech around third‑party cookie deprecation, OpenAI is building server‑to‑server from scratch. This could give it a technical advantage — but also means less regulatory precedent to rely on.