TLDR;
OpenAI lets ChatGPT Ads advertisers match customer and prospect lists to ChatGPT users. Lists can contain emails, phone numbers, hashed versions of both and Android advertising IDs, with at least 25,000 matched users needed for inclusion targeting. Enterprise brands should treat this as a governed first-party data programme, because the channel is familiar but the consent, regional and measurement risks are not solved by the platform.
What happened
404 Media reported on 15 October that it ran two ChatGPT Ads campaigns and found a customer-list targeting system behind the conversational ad format. Advertisers can upload identifiers they already hold and ask OpenAI to match them to ChatGPT accounts. The report also found that advertisers can supply context about the conversations where an ad may be relevant.
OpenAI's documentation confirms the mechanics. A custom audience can contain email addresses, phone numbers, SHA-256 hashed versions of those identifiers or Google Advertising IDs from Android devices. The audience can limit campaign eligibility, exclude existing customers or change an ad group's maximum bid when a viewer matches.
There are scale and privacy controls. Inclusion targeting and bid adjustments require at least 25,000 matched users, while smaller lists can be used for exclusions. OpenAI recommends at least 100,000 users for inclusion or bid adjustments. Ads Manager does not reveal which individuals matched, and OpenAI says the uploaded audience file is normally deleted within 24 hours after processing.
The Ads API also supports context hints that describe relevant products, use cases or needs. OpenAI states that these are not exact-match keywords and do not replace location, platform or audience targeting. Campaign documentation says custom audiences should not be used for EEA or Swiss campaigns while ads personalisation is unavailable there. Gizmodo's follow-up highlighted the practical privacy concern: people may not realise that an ad inside a chat was made eligible by contact data supplied elsewhere.
Why it matters
This turns ChatGPT Ads into a recognisable media buying product. Brands can suppress recent purchasers, reach known prospects or bid more for valuable customer groups. The surrounding experience is different because the ad appears during a conversation that may feel more private than a social feed.
A match does not explain intent. An email address can identify that someone is in a CRM segment, while the current conversation can provide contextual relevance. Neither tells the advertiser what the person said, and OpenAI does not expose individual matches. Campaign teams need to avoid claiming that they can read prompts, identify specific ChatGPT accounts or target one person.
The minimum size also changes who can use the tool. A large consumer brand may clear 25,000 matched users easily, while a specialist B2B list may only qualify for exclusion. Uploaded rows and matched users are different because invalid, duplicate and unmatched records do not count. Planning against raw CRM volume will overstate the addressable audience.
The bigger risk sits in data governance. A company may have a customer's email for service delivery without permission to use it for advertising on a new platform. Hashing does not fix a weak legal basis. OpenAI deleting the upload file does not remove the advertiser's responsibility for the list.
How your brand can benefit / be affected
Before uploading anything, document the audience's source, consent language, retention, market and purpose. Ask privacy and legal teams to review ChatGPT Ads as its own destination. Do not assume approval for another platform covers this use.
Build the first test around a decision that customer matching can improve. Useful examples include excluding active subscribers from an acquisition campaign, separating existing customers from prospects or adjusting bids for a high-value segment. Keep the audience definition simple enough to explain and audit. Do not start with every record in the CRM.
Check the processed match count before launch. If the audience falls below the inclusion threshold, use it only for exclusion or test broader eligibility without pretending the original segment is active. For EEA and Swiss campaigns, follow OpenAI's current restriction and keep custom audiences out until the documentation changes.
Measure incremental profit, not match rate. Use a holdout where possible and compare conversions, customer quality, repeat purchase, cancellations and margin with a similar untargeted campaign. Context hints, audience membership and bid adjustments can all affect delivery, so record each change. The value of customer matching is not that ChatGPT Ads now resembles established ad platforms. It is whether the additional data produces better commercial outcomes without creating a consent problem the brand cannot defend.
News date: 15 October 2026. Editorial review: 18 October 2026.