This week, 404 Media did the thing journalists should do with an ad system: they bought in. Joseph Cox's team ran two ads on ChatGPT to inspect the advertiser controls, and the resulting report confirms three things. Advertisers can upload email addresses, phone numbers, or Android advertising IDs to build audiences of ChatGPT users. Ads can be matched to the topics of your conversations through what OpenAI calls "context hints." And the personalization toggle, when switched off, still permits ads based on the chat you are having right now.
If you use AI through an API rather than a chatbot, none of this applies to you directly, and we will get to that distinction, because it matters. But the direction of travel should concern anyone who types into a box. ChatGPT has about one billion monthly active users, per 404 Media's report, and most of them treat it as a private room. This week the room got an ad network, and the targeting data is, in part, the conversation itself.
Facts below come from 404 Media's investigation, published October 15, 2026, and from OpenAI's own advertiser-facing wording as quoted there. Disclosure: Wallaby Token runs an inference API with no advertising business, which is a position on this question, and we state it plainly at the end.
What the test actually found
Contextual targeting on prompts. OpenAI's advertiser interface invites buyers to "describe the conversations, topics, or keywords where your products or services may be relevant," with the caveat that these hints "guide matching but aren't exact-match targeting rules." 404 Media supplied hints about privacy and AI topics, and its ads ran. The novel part is not topical advertising; it is that the corpus being matched against is a stream of messages users largely believe are private. 404 Media had already reported in September that contractors review real user prompts to improve the models. Now the same text feeds an ad marketplace.
Uploaded audiences. Advertisers can submit raw or hashed email addresses and phone numbers, or Android ad IDs, and OpenAI checks them against its user base. OpenAI told 404 Media that inclusion targeting requires at least 25,000 matched users, that advertisers cannot see who matched, and that uploaded files are deleted after processing, usually within 24 hours. One question went unanswered: whether OpenAI hashes raw contact data after receiving it. Other ad platforms, Meta among them, hash such lists on receipt.
The off switch is narrower than it looks. The personalization setting reads: "Allow ChatGPT to use your past chats, activity, and preferences to select ads. Ads may still be based on your current chat." Opting out covers history. It does not cover the conversation in progress.
To be fair to the mechanics: minimum audience sizes, no individual-level visibility, and file deletion are real constraints, and much of this is standard adtech plumbing. The reason it reads differently here is the input. A search query is a snapshot of intent. A chatbot conversation is where people now bring medical worries, legal problems, and half-formed business plans. The privacy weight of the two is not the same, and the industry is treating them as if it were.
The chatbot and the API are different products
One distinction deserves its own section, because conflating the two is the most common error in commentary so far. Everything above describes consumer ChatGPT, where the user's attention is the product being sold. API products are sold by the token to developers, and their data terms are separate documents with separate commitments. "ChatGPT uses prompts for ads" does not mean "your API provider does." But it does mean the question is now reasonable to ask out loud, of everyone.
Five questions to ask any AI provider
This is the checklist we would bring to any vendor conversation, with the answers this week's news gives for consumer ChatGPT, and what a verifiable answer looks like.
1. Are my prompts used to target advertising? For ChatGPT: conversation topics can guide ad matching, per the context-hints system above. A verifiable answer names the mechanism, not the intention. "We don't sell ads" is only complete if the business model makes it true. Inference sold by the token has no ad inventory to fill.
2. Will a human read them? For ChatGPT: yes, in some cases. 404 Media's Project Lily reporting documented contractor review of real prompts, and OpenAI acknowledged sensitive details can slip through its scrubbing. Anthropic confirmed to 404 Media that it also uses human review. A verifiable answer states who can see prompt content, under what process, and whether that process is auditable.
3. Are they used for training? This one was not in this week's report, but it belongs in the same conversation, because the answer changes per product tier at most providers. Ask for the specific terms document, not the marketing page.
4. How long are prompts retained, and can I check? Retention is the question where "trust us" is weakest and logs are strongest. A verifiable answer is one you can test against your own usage records.
5. What still happens after I opt out? ChatGPT's toggle exempts the current conversation from its own protection. A verifiable answer lists the residual uses explicitly, in the setting's own text, not in a policy PDF three links away.
Our answers, on the record
Since we are asking, we should answer. Wallaby Token sells metered inference for open-weight models, prepaid, per token. There is no advertising business, so there is no ad targeting, and prompts are not scanned for one. Our consumption logs record metering data, not prompt content. The website promises are narrow on purpose: no cookies, no fingerprinting, aggregate numbers only, and they are written to be checked against the privacy page rather than around it. If a provider's answer to any of the five questions cannot be verified from the outside, that is the answer.
Where to go next
- Deeper: our privacy page, the commitments as written, kept short so they stay checkable.
- Sideways: the Authors Guild filings are an API procurement problem — the same buyer's-questions method, applied to training data provenance.
- Forward: what our own workloads cost on Kimi K3 — because the alternative to an ad-funded model is a metered one, and the meter should be boring.