ChatGPT ads target by email and phone: check your consent

ChatGPT ads can now find your customers by email address and phone number. 404 Media ran two test campaigns on OpenAI's ad platform and documented how the targeting works, as reported on October 15, 2026. For merchants, ChatGPT ads custom audiences are the same playbook as Meta and Google: upload a list, reach the people on it. The difference is the channel. Those people are talking to an assistant when your ad shows up.

What actually happened

Per 404 Media and Gizmodo's follow-up, citing OpenAI's own help documentation:

• Customer lists. Advertisers can upload email addresses, phone numbers, hashed versions of those, or Android advertising IDs. OpenAI checks for matching ChatGPT accounts, and matched users become eligible for ads.
• A 25,000 floor. An audience built from an uploaded list must have at least 25,000 entries.
• No match reports. OpenAI's documentation says it does not tell the advertiser which entries matched an account.
• File deletion. OpenAI says it deletes uploaded files within 24 hours of processing. It did not answer whether it hashes raw contact data it receives.
• The conversation counts. OpenAI says ads may still be based on your current chat. The personalization opt-out covers past chats and activity, and Gizmodo notes it may not stop identifier-based targeting.

Why ChatGPT ads custom audiences matter for your business

Two things change for a small merchant.

The minimum keeps most small brands out of list targeting. A 25,000-entry floor means a shop with an 8,000-person customer list cannot use this feature on its own. Contextual placement, based on what people are asking, is the realistic entry point. That puts the weight back on your product data: clear names, specs and prices that match how people actually ask.

Uploading a list is a data decision, not just a media buy. Before your customer emails go into any ad platform, you need to know three things: what your privacy policy promised, whether those customers consented to ad use, and whether the list goes in hashed. If your policy says you share data with "advertising partners like Meta and Google," it does not name OpenAI. Update the policy before the upload, not after a customer asks.

We would also keep the raw list inside your own systems. Hash it in your pipeline, upload the hash, and log what went where and when.

Sources: 404 Media, Gizmodo.