OpenAI Enables Marketing Cookies by Default for Free ChatGPT Users

OpenAI is ready to target free users of its services with advertisements around the web, based on what it knows about them.

On Thursday, OpenAI sent an email to users laying out major changes to the AI company’s privacy policy in the US. “We’ll now use cookies to promote OpenAI products and services on other websites,” reads the email sent on April 30. “This does not impact your conversations in ChatGPT. Your conversations with ChatGPT are private and are not shared with marketing partners.” Cookies store information in users’ browsers as they explore the web.

Chats with the bot aren’t shared with third parties. Even so, details OpenAI collects as users interact with its services may soon be used to market those same services, like ChatGPT, outside the platform. This appears to be targeted at converting free users (WIRED found that marketing settings were “on” by default) and seeing how effective its ads are at conversions.

The move comes as OpenAI looks to expand its own advertising network inside ChatGPT. The company started rolling out ads at the bottom of ChatGPT outputs this February for US users. Competitors like Google are exploring how ads can be woven into the user experience of generative AI tools and features.

"Nothing about our policy of not sharing people’s conversations or other private user content with advertisers has changed,” says OpenAI spokesperson Taya Christianson. “Like many companies, OpenAI works with select marketing partners to help people learn about our products on third-party websites and apps, and we updated our privacy policy to clarify how this works. We do not share your conversations with these marketing partners. To make OpenAI marketing efforts more relevant and measure their effectiveness, we may share limited identifiers, such as cookie IDs or device IDs, and users can opt out at any time in settings."

To help you better understand what recently changed, WIRED compared the new privacy policy to a previous version saved from OpenAI’s website earlier this month. The biggest change revolves around how your data is shared for marketing purposes.

Data Usage Now Includes Third-Party Promotions

In the “Disclosure of Personal Data” section, OpenAI expanded the paragraph detailing how it discloses personal data. OpenAI now says it may share “limited information” with partners to promote services like ChatGPT and Codex off of OpenAI’s platforms.

The company details this change in a new help page. It says it might send identifiers, such as users’ email addresses or cookie IDs, to advertising platforms. That way, OpenAI can check whether users have taken specific actions—like signing up for its Codex tool after they get shown an ad for it on Instagram.

Users can opt out of this kind of tracking by going to “Settings > Data Controls > Marketing Privacy” in the ChatGPT app. WIRED tested two free accounts and found that those settings were on by default. The two paying accounts WIRED checked, one Plus and the other Enterprise, did not have it on by default.

We disclose your Personal Data in the following circumstances:

Vendors and Service Providers: To assist us in meeting business operations needs and to perform certain services and functions, we disclose Personal Data to vendors and service providers, including providers of hosting services, customer service vendors, cloud services, content delivery services, support and safety services, email communication software, web analytics services, payment and transaction processors, search and shopping providers, marketing service providers, and information technology providers. We also work with service providers who help us with age and identity verification, and you can learn more here⁠. Based on our instructions, these parties will access, process, or store Personal Data only in the course of performing their duties to us.

We disclose your Personal Data in the following circumstances:

Vendors, Service Providers, and Marketing Partners: To assist us in meeting business operations needs and to perform certain services and functions, we disclose Personal Data to vendors, service providers, and marketing partners, including providers of hosting services, customer service vendors, cloud services, content delivery services, support and safety services, email communication software, web analytics services, payment and transaction processors, search and shopping providers, and information technology providers. We also work with service providers who help us with age and identity verification, and you can learn more here⁠⁠. When we work with Service Providers, these parties will access, process, or store Personal Data based on our instructions and only in the course of performing their duties to us. We also share limited information with select marketing partners who are not service providers in order to promote our products and services on third-party properties and help us assess the effectiveness of those efforts. Some of these partners may receive information through cookies and similar technologies. Learn more about these practices and the choices available to you here⁠.

Assurance About ‘Sensitive Personal Data’ Removed in Error

OpenAI categorizes many different types of information as a user’s “Personal Data,” including birthdates, payment information, and any prompts a user might have written. In its privacy policies, it doesn’t explain which types of this data it considers “sensitive,” but OpenAI does promise that it doesn’t use this information to infer characteristics about consumers.

A sentence regarding “sensitive Personal Data” was briefly absent from the Privacy Policy on Friday as WIRED accessed the updated document. When WIRED reached out to OpenAI for comment, the company claimed this removal was an error and added a similar sentence back, in a different paragraph.

This section now says that OpenAI uses some information to run ads outside its platform. While it doesn’t say it in the Privacy Policy itself, OpenAI links to a help page explaining that it employs user identifiers to track ad conversions on other platforms.

We don’t “sell” Personal Data or “share” Personal Data for cross-contextual behavioral advertising, and we do not process Personal Data for “targeted advertising” purposes (as those terms are defined under state privacy laws). We also don’t process sensitive Personal Data for the purposes of inferring characteristics about a consumer.

We don’t “sell” Personal Data. Depending upon your choices, we may share limited data with select marketing partners for purposes of promoting our products and services to you on third-party properties.

This is known as “targeted advertising” or sharing for “cross-context behavioral advertising” under certain state privacy laws. You can opt out using the marketing privacy control in your account settings. If you’re not logged in, you can opt out using the Your Privacy Choices link on our website. You can also opt out using a legally recognized opt-out mechanism, like Global Privacy Control. You can learn more about the types of data we use and share for these purposes and controls we offer you here⁠. We don’t engage in these activities for users we know to be under 18 years of age.

OpenAI continues to barrel towards a potential IPO at the end of this year, eyeing ways to bring in more moolah. And by buying lots of ads, the startup may be able to convert more free users into paying subscribers (all while tracking them along the way).