404 Media 实测 ChatGPT 广告如何基于提示词、手机号和邮箱定向投放
Key highlights
404 Media found through its own testing that OpenAI lets advertisers target ChatGPT users, and can aim at specific groups via email, phone number, or a unique on-device identifier, folding the user's own prompts into the advertising signal in a way that most people did not expect.
What happened
More unsettling, ChatGPT's ad targeting also draws on user prompts that people may assume are private, which may be human-reviewed or used for ad targeting. Of ChatGPT's roughly one billion monthly active users, most likely do not know they are being precisely targeted via personal data that advertisers uploaded to OpenAI, and that asymmetry is the heart of the controversy surrounding the practice.
Technical details
So-called targeting based on uploaded personal data means advertisers can hand the platform their own customer lists, such as emails or phone numbers, for matching and precise reach. When this mechanism is combined with prompts also used for targeting, the intentions, health status, and purchase plans users reveal unintentionally can all become ad signals, quietly redefining the boundary of privacy while users remain unaware of the exposure.
Versus the competition
Against the mature model of search advertising built on search terms, conversational AI captures prompts rich in deeper intent, commercially more valuable but exponentially more privacy-sensitive. OpenAI introducing such targeting this early in monetization is more aggressive than social platforms were in their day, and more likely to trigger regulatory and public backlash because it touches the most intimate input a user provides.
Industry impact and use cases
Put simply, the logic that free or low-cost AI is paid for by someone else is now materializing, and the price is a redefinition of privacy boundaries. For ordinary users, avoid revealing sensitive information in prompts; for regulators, this kind of targeting may become a new flashpoint for AI advertising compliance, because the larger the model, the wider the affected population.
Practical notes
For ordinary users, the most direct protection is to avoid writing real names, addresses, health details, and financial specifics into prompts, treating ChatGPT as a collaborator that is not confidential rather than a vault, since platform policy and commercial incentives shift over time. For enterprises procuring AI tools, contracts should specify data usage and advertising-related terms, and should prefer solutions that can prove they do not train on or resell data. For regulators, this targeting reveals a new reality in which input is itself signal, and prompts need to enter the privacy framework rather than remaining at the level of web browsing and device identifiers.
Broader context
The commercialization of conversational products is turning a user's most private input into a signal that can be priced. Unlike search advertising, which relies on search terms, the prompts inside a conversation often reveal deeper and more continuous intent, spanning health, finance, and personal relationships, and the commercial value of such information is higher while its privacy sensitivity rises many times over. When advertisers can also match against their own customer lists, an individual can hardly tell how they are being profiled, and this information asymmetry is precisely the heart of the controversy that surrounds the practice.
What to watch next
What deserves attention is whether regulators will fold prompts into the privacy protection framework. If the rules stay limited to device identifiers and browsing history, the targeting that defines the conversational era will remain in a gray zone for a long time. For users, the most pragmatic defense is to treat conversation as collaboration that is not confidential rather than a vault. For buyers of AI tools, contracts should spell out data usage and advertising related terms, and should prefer vendors that can prove they do not train on or resell user data under any circumstance.
Practical takeaway
For ordinary users, the most direct protection is to avoid writing real names, addresses, health details, and financial specifics into prompts, treating the conversational product as a collaborator that is not confidential rather than a vault, since platform policy and commercial incentives shift over time. For enterprises procuring intelligent tools, contracts should specify data usage and advertising related terms, and should prefer vendors that can prove they do not train on or resell data. For regulators, this kind of targeting reveals a new reality in which input is itself a signal, and prompts need to enter the privacy framework rather than remaining at the level of web browsing and device identifiers from an earlier era.