ChatGPT Ad Privacy Risk: OpenAI Stores Unhashed User IDs for Targeting
Advertisers can upload lists of personal identifiers to target specific ChatGPT users, raising privacy concerns about data handling and matching.
Key points
- OpenAI allows advertisers to target users via uploaded email, phone, or device IDs.
- Lists must contain at least 25,000 entries to create a custom audience.
- Uploaded data may remain unhashed, though OpenAI claims deletion within 24 hours.
OpenAI’s ChatGPT advertising platform permits marketers to target specific users by uploading lists containing personal contact details and device identifiers, a practice that exposes users to highly personalised promotional content.
Root cause
The capability stems from OpenAI’s expansion of its ad injection features within ChatGPT conversations, which now include visual promotions alongside text-based ads. According to 404 Media, the system allows advertisers to define audiences using personally linked account information. This includes email addresses, phone numbers, and unique mobile device identifiers. The platform matches these uploaded identifiers against its user base to determine ad eligibility.
Attack path
Advertisers submit lists of identifiers gathered through various external methods. OpenAI’s system checks whether these accounts correspond to active ChatGPT users. If a match is found, the user becomes eligible for targeted advertising. The source notes that raw emails, hashed versions, or Android advertising IDs can be used. OpenAI states it does not reveal matched accounts to advertisers, preventing profile discovery via this tool.
Affected versions
The feature is available to advertisers using OpenAI’s current advertising platform. There is no specific software version cited, as this is a service-level configuration rather than a code vulnerability. The mechanism applies to users interacting with ChatGPT who have accounts linked to the uploaded identifiers.
Mitigation
- Review privacy settings to opt out of personalised advertising where possible.
- Monitor account activity for unexpected ad targeting patterns.
- Limit the sharing of personal identifiers with third-party services.
- Assume uploaded data may be processed in plain text despite vendor claims.
Why it matters
Security teams must understand that ad targeting infrastructure can inadvertently expose user privacy. When platforms allow external data uploads for matching, the risk of data leakage increases. Teams usually audit how vendors handle raw versus hashed data during processing. Check whether opt-out mechanisms cover all identifier types, not just behavioural data. Ensure that user consent aligns with the actual scope of data matching.
What to do and how to stay safe: OpenAI
- Audit organisational data sharing practices to prevent employee details from appearing in advertiser lists.
- Review ChatGPT privacy settings to disable personalised ad targeting.
- Monitor for unusual ad content that may indicate identifier matching.
- Contact vendors to clarify data retention and hashing policies for uploaded lists.
Step-by-step guide: Stop Sensitive Data Leaks in AI Chatbots: Priority Controls
General security guidance from the Vector Bulletin newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Can advertisers target a single user with an ad?
No, advertisers must upload lists containing at least 25,000 entries to create a target audience.
Does OpenAI hash the uploaded data?
It is unclear if OpenAI hashes raw data, though the company claims to delete files within 24 hours.
Can users opt out of all targeted ads?
Users can opt out of ads based on past activity, but ads may still be served based on current chat context.
