Scroll back through your chatbot history to the conversation you'd least like a stranger to read. You know the one: a worry typed late at night, a plan you haven't said out loud. (I won't ask which. That's the point.)
Regulators know the genre. Lower Saxony's data protection commissioner, Denis Lehmkemper, warned on October 1 that people often confide very intimate thoughts to AI chatbots, about their health, their moods and their plans (his statement is in German). OpenAI makes a similar observation in a different spirit. "People come to ChatGPT with clear goals," it wrote on August 31. "They explain what they want to accomplish, what matters to them, and the constraints they face."
So do advertisers get to read along? OpenAI says no, in detail: "Advertisers never receive your chats, chat history, memories, name, email, precise location, IP address, or sensitive information (such as health, mental health, political topics)." I found nothing in OpenAI's documents that contradicts it.
But that promise is about what flows out of ChatGPT, and the targeting runs on what flows in — lists of customers and prospects, keyed to email addresses and phone numbers, and the advertiser's own description of the conversations where its product fits. ChatGPT does the matching inside the product. Switching off ad personalization doesn't take your current conversation out of it.
What does the promise cover, then? Which switches matter? And why is Europe different?
How an ad finds you when the advertiser can't see you
Who sees these ads? People on ChatGPT's Free and Go plans, and logged-out visitors; OpenAI says it shows none to accounts it identifies as under 18. By October 21, OpenAI said ChatGPT Ads was "available in 89 countries."
How does ChatGPT pick one? It weighs "the context and intent of your current conversation," the ad itself, "advertiser-provided context hints and targeting selections" and, with ad personalization on, "select signals from your broader ChatGPT experience," past chats and memory included. That information, OpenAI says, "stays within ChatGPT."
Then come the two things advertisers bring. The first is a list. Custom audiences let them apply their own customer or prospect lists, built from "email addresses, phone numbers, hashed email addresses, hashed phone numbers, or Google Advertising IDs (GAID)." (A GAID is an Android phone's advertising ID; hashing scrambles an address into a code that can still be matched.) A retailer with your email address can limit a campaign to the people on its list, or keep it away from them.
The limits are real. Aiming at a list takes "at least 25,000 matched users"; smaller lists can only exclude. OpenAI doesn't tell advertisers who matched (Ads Manager "does not show individual matched users") and deletes uploaded files, "usually no later than 24 hours after upload." Custom audiences are not supported for campaigns targeting the European Economic Area or Switzerland, and advertisers are told: "Don't upload broker-sourced data."
The second thing advertisers bring is a description. They can write context hints that "describe the conversations, topics, or keywords where their products or services may be relevant." OpenAI coaches them to name the "situations or decisions where your offering may be useful"; its own sample reads, "Cushioned everyday running shoes for beginners training for their first 5K." Hints "are not targeting rules or delivery instructions" and "do not guarantee delivery in specific conversations." The advertiser describes where its product fits, and "a relevance-weighted, second-price auction" picks the ad.
None of this is hidden, but 404 Media, which tested the system, spelled it out on October 15. Its verdict cuts both ways: the targeting is "somewhat standard practice across the advertising industry," and "also novel" because it's "based on the prompts users enter into the chatbot."
And the off switch? "If you turn off ads personalization, you will still see ads based on the context of your current chat thread," OpenAI says, though it stops using "other chat threads, ads history or topics."
Meta's version comes without the toggle
OpenAI isn't alone — and its version has more controls than Meta's. Since December 16, 2025, Meta has personalized ads using people's "interactions with our generative AI features." Chat with Meta AI about hiking, its announcement explains, and "you might start seeing ... ads for hiking boots." Its AI terms say it uses your interactions with its AIs "to personalize your experiences and ads."
Can you turn that off? Users "will not be able to opt out," The Record reported at rollout, though only for people using Meta AI, "which is integrated into Facebook, Instagram, WhatsApp and Messenger." Meta, declining to comment, pointed to its announcement, which says tools like Ads Preferences let you "adjust the content and ads you see at any time." It also says that when people discuss subjects such as their "religious views, sexual orientation, political views, health" with Meta AI, "we don't use those topics to show them ads."
Isn't this just advertising?
Is any of this worse than what the rest of the web does? In several ways, no.
OpenAI built in restraints. The 25,000 floor makes it hard to aim at a handful of people; it reads like one of the "guardrails to prevent narrow ads targeting" OpenAI promised when testing began. Ads are "not eligible to appear near sensitive topics, including personal health, mental health, or politics," and an audit using 91 simulated accounts, published October 11 in the proceedings of the AAAI/ACM Conference on AI, Ethics, and Society, found those topics drew "close to a 0% ad rate." Free users can drop ads without paying. And OpenAI says the ads help keep ChatGPT available to "more than 1 billion weekly active users."
Nor is OpenAI an outlier. Microsoft bases Copilot's "generic ads" on your current conversation, and its personalized ones "might use your chat history, saved memories" and more. Google says, "Your Gemini Apps chats are not being used to show you ads. If this changes, we will clearly communicate it to you." Anthropic, which makes Claude, wrote in February that "Claude will remain ad-free," adding: "Should we need to revisit this approach, we'll be transparent about our reasons for doing so." (A disclosure: this piece was drafted with help from Anthropic's Claude.) OpenAI promises to "keep your conversations with ChatGPT private from advertisers," while its help page adds, "We may explore additional measurement insights over time while continuing to protect user privacy." Each is current policy, and each leaves itself room to change.
So far, so good. What does the reassurance leave out?
First, the rules keep moving: OpenAI's changelog lists six revisions to its ad policies since March. April's reads, in part: "Medical, legal, and financial advice contexts are no longer categorically blocked from ads by default. Sensitive conversations and other prohibited contexts remain ineligible for ads."
Second, OpenAI's sensitive-topics rule governs where ads appear, not what shapes them. As of October 24, 2026, its help page doesn't say whether a sensitive conversation can become one of the "topics" behind a later ad in another chat. Its US privacy policy says, among state-law disclosures, "We don't process sensitive data for the purpose of inferring characteristics about you," but not how that applies to ad topics. Meta says it doesn't use sensitive topics for ads, and Microsoft says that, outside its opt-in Copilot Health feature, Copilot is "designed not to personalize interactions with you based on certain sensitive topics." In January, Sen. Ed Markey (D-Mass.) asked OpenAI directly whether it would "process information collected from sensitive conversations" for advertising. The closest thing to an answer I found is an October 21 OpenAI engineering post: with personalization on, the ad system considers "available nonsensitive information about the user's past conversations." It doesn't say what counts as sensitive.
Third, ad-free isn't tracker-free. Researchers at IMDEA Networks in Madrid tested nine chatbots and found that the web versions of six (ChatGPT, Claude, Gemini, Grok, Mistral's Le Chat and Perplexity) leak artifacts of conversations, such as IDs, links or titles, to third-party advertising and tracking services. ChatGPT sent a conversation ID and link to Datadog, a monitoring company rather than an advertiser. Claude sent the same, plus the user's email address, to Intercom, a customer-messaging service. Both flows ran even when cookies were rejected. Accept cookies, and Claude also sent the conversation ID to Datadog and forwarded user events, server to server, to eleven advertising platforms, Facebook and TikTok among them. Grok, which made conversation links public by default, sent links and chat titles to Meta's and TikTok's ad-measurement tools. Rejecting cookies or paying for a premium tier offered, in the authors' words, "limited protection." The study has been accepted for 2027 publication, one of its authors says.
In Europe, your past chats wait for a yes
What changes when the same product crosses the Atlantic?
ChatGPT's ads went live in 31 European markets on August 24, 2026. But as of October 24, 2026, OpenAI's help page says "Personalized ads are not initially available in the European Economic Area (EEA) or Switzerland." Its EU privacy policy makes personalization depend on "Your consent, for Free and Go users, when we ask for it." Meanwhile, users there get what it calls "generic ads," justified by its "legitimate interests" and drawn from "limited information" such as "the context of your current ChatGPT chat, location and time of day." Europe's version still reads the chat. What waits for your yes is the rest of your history.
The backdrop is the GDPR, Europe's data protection law. Its Article 9 says processing data revealing a person's health, political opinions, religious beliefs or sexual orientation, among other categories, "shall be prohibited" unless an exception applies, such as "explicit consent." The European Data Protection Board added in September that those categories "may include data derived or inferred from profiling activity" — even, it says, when the inference is wrong. A guess counts.
The Digital Services Act goes further for online platforms. Article 26(3) says they "shall not present advertisements" based on profiling that uses those sensitive categories (even with consent, the board adds), and Article 28(2) bars profiling-based ads to users a platform knows "with reasonable certainty" are minors.
The catch? Those articles bind platforms such as Facebook and Instagram. On August 31, the European Commission designated ChatGPT as a Very Large Online Search Engine — a different box. Its duties, due by January 2027, include a risk assessment covering its "systems for selecting and presenting advertisements" and a public ad repository listing "the main parameters used" to aim each ad. Whether the sensitive-data ban reaches ChatGPT isn't obvious (the designation decision itself was still "not yet available" on the Commission's list, last updated October 15), and GDPR's Article 9 binds OpenAI either way.
Meta made its own call. As of October 24, 2026, its EU terms say interactions with its AIs are used "to improve AI at Meta" and stop there; the UK version reads the same. When Meta announced the change, TechCrunch reported that the policy applied everywhere "except for users in South Korea, the United Kingdom, and the European Union," which it put down to privacy laws. That's a choice visible in Meta's terms, not a regulator's order.
Will the gap last? Hamburg's data protection authority said on October 2 that hyper-personalized ChatGPT ads "will soon launch in Europe," on an opt-in basis. It warns that chat content "which extends into the private sphere" will feed "personality profiles," and predicts that "users' moods will be detectable in real time." Hamburg and Berlin, Notebookcheck reported, advise declining personalized ads when ChatGPT asks.
Not everyone thinks Brussels chose well. Diana Năsulea, a classical-liberal critic, says the Commission "chose the box that fits least badly" and that designation "raises the price of every new feature" for EU users, though she grants the upside: "Anyone will be able to look up who paid for an advert and how it was targeted." And a proposal to amend the GDPR, the Digital Omnibus, was still "Awaiting committee decision" as of October 24, 2026; Article 9 hasn't changed.
At home, Congress never adopted "a single comprehensive consumer privacy law," though at least 19 states have their own. OpenAI's US privacy policy says it personalizes ads for Free and Go users "subject to your settings"; its EU policy says it will ask first. Same company, same product.
Picture the ad that talks back
This scenario is my extrapolation; OpenAI's own documents supply each piece.
Start with that running-shoe hint. You ask ChatGPT for a 5K training plan, and a shoe retailer whose newsletter you joined has uploaded its list. Your chat fits the hint, your email fits the list, the auction does the rest. You buy. At checkout, the OpenAI Pixel "automatically detects supported customer information" in the form and sends it on, hashed (OpenAI says advertisers' reports show campaign performance, not individuals), and OpenAI's privacy policy says it "could receive information about purchases you make from these advertisers."
Now add "Sponsored Agents," which OpenAI is testing with selected advertisers: a way to "chat with an AI representative of a business in ChatGPT." The ad becomes the conversation. You tell the shoe brand's agent your budget and your race date. If it works like messaging an advertiser through an ad does today, "the advertiser will only see the messages you send them directly" — every one of them.
Add memory — which ChatGPT "may save and use" when selecting an ad — and a year of it becomes an ad profile that never has to leave the building. OpenAI says it will explore ways for businesses "to interact with consumers in more native ways in ChatGPT."
Apart from what you type to an advertiser's agent, none of it requires a word of your chat to reach an advertiser.
Critics, defenders and one point of agreement
Who's worried? Markey, for one. He describes chatbots as becoming "spaces where users share personal thoughts, health questions, family issues" and has a bill that would bar a company that knows a user is a minor from configuring a chatbot to "advertise to such user." The Senate Commerce Committee approved it by voice vote on August 5, and its Republican chairman, Ted Cruz, said in prepared remarks that it "would prohibit advertising to minors on chatbots." As of October 24, 2026, it hasn't passed the Senate.
Meta's critics are blunter. Arielle Garcia of Check My Ads, a digital advertising watchdog, warned about "proxy audiences" (in The Record's paraphrase, a chat about World Diabetes Day standing in for a diagnosis). Nathalie Maréchal of the Center for Democracy and Technology: "People think that they are interacting in a completely private, secure environment, which is false." And 36 organizations asked the FTC in October 2025 to investigate and have Meta suspend the practice.
On the other side, Alex Ambrose of the Information Technology and Innovation Foundation, in an August report on chatbot safety for children, argues under the heading "Don't Ban Targeted Advertising" that online services mostly "sell the opportunity to advertise to a certain demographic" rather than personal data, and that losing ad revenue would shrink free resources for children, "especially detrimental to lower-income households."
The common ground is narrow — but real. On minors, a Democrat's bill and a Republican chairman's remarks agree, and Năsulea counts the public ad archive as a gain.
What does this mean for you?
Find the switches. In ChatGPT, go to Settings > Ad Controls and turn off "Personalize ads" and "Past chats and memory." "View History and Topics" shows the topics used to pick your ads, and "Delete ads data" clears them (allow up to 30 days; your chats aren't touched). None of this removes ads.
Use the doors that do. Plus, Pro, Business, Enterprise and Edu have no ads, and Temporary Chats "will not show ads." On Free, you can switch to "Ads-Free" (fewer messages, no image generation or deep research). Go users can't (Go counts as a paid plan); they'd have to drop to Free or move up to Plus or Pro.
Treat an advertiser's chat window as the advertiser's. If you message a business through an ad, it sees what you send.
Know your keys. Advertisers match on email addresses, phone numbers and Android advertising IDs. HAIA's September advice holds: "Reset your advertising identifier and turn off ad personalization, on the phone and in your accounts."
On Meta's apps, choose what you say. Its documents describe no switch for the chat signal; its terms advise: "Do not share information that you don't want the AIs to use and retain, such as information about sensitive topics."
In the European Economic Area or Switzerland, the consent prompt is the decision. As of October 24, 2026, personalized ChatGPT ads weren't on there. When ChatGPT asks, Hamburg's and Berlin's regulators say decline; generic ads will still read your current chat.
For anything sensitive, use Temporary Chat and, as HAIA put it in August, treat "retention as the default and deletion as a request."
The lesson, as I see it
A privacy promise tells you what leaves the room. OpenAI's holds, as far as its documents show. But an ad system doesn't need your chats to leave — it needs a list and a description to come in, and a model inside to do the matching. Copilot and Meta's apps also match ads to your AI chats inside their own walls.
What should you watch? Europe's consent prompt, and how many people refuse it. The first EU ad repository, due by January 2027. Markey's bill. And whether OpenAI answers, on its own help page, the question he asked in January.
My vote? OpenAI should ask for the yes everywhere, the way its own policy says it will in Europe, and say plainly, on the page that promises advertisers never see your chats, whether a conversation about your health can become one of your "topics." The promise about what goes out was the easy half.
Your conversation never goes to the advertiser. The advertiser comes to your conversation.