OpenAI enables marketing cookies by default for free ChatGPT users

OpenAI is willing to target free users of its services with ads across the web, based on what it knows about them.

On Thursday, OpenAI sent an email to users outlining major changes to the US AI company’s privacy policy. “We will now use cookies to promote OpenAI products and services on other websites,” the email sent on April 30 said. “This does not impact your ChatGPT conversations. Your conversations with ChatGPT are private and are not shared with marketing partners.” Cookies store information in users’ browsers as they explore the web.

Chats with the bot are not shared with third parties. However, the details that OpenAI collects as users interact with its services may soon be used to market those same services, like ChatGPT, outside the platform. This appears to be aimed at converting free users (WIRED found that the marketing settings were “on” by default) and to see how effective its ads are in conversions.

The move comes as OpenAI looks to expand its own advertising network within ChatGPT. The company began rolling out ads below ChatGPT output for US users in February. Competitors, including Google, are exploring how to integrate ads into the user experience of creative AI tools and features.

“Nothing has changed about our policy of not sharing people’s conversations or other private user content with advertisers,” says Taya Christianson, an OpenAI spokeswoman. “Like many companies, OpenAI works with select marketing partners to help people learn about our products on third-party websites and apps, and we’ve updated our privacy policy to explain how that works. We don’t share your conversations with these marketing partners. To make OpenAI’s marketing efforts more relevant and measure their effectiveness, we may share limited identifiers, such as cookie IDs or device IDs, and users can opt out at any time in Settings.”

To help you better understand what’s changed recently, WIRED compared the new privacy policy to an earlier version saved from the OpenAI website earlier this month. The biggest change is around how your data is shared for marketing purposes.

Courtesy of Rhys Rogers

Data usage now includes third-party promotions

In the Disclosure of Personal Data section, OpenAI has expanded the paragraph detailing how personal data is disclosed. OpenAI now says it may share “limited information” with partners to promote services like ChatGPT and Codex outside of OpenAI’s platforms.

The company details this change on a new help page. It says it may send identifiers, such as users’ email addresses or cookie IDs, to advertising platforms. This way, OpenAI can check whether users have taken specific actions — such as signing up for its Codex tool after they see an ad for it on Instagram.

Users can opt out of this type of tracking by going to Settings > Data controls > Marketing privacy On the ChatGPT website. WIRED tested two free accounts and found that these settings were on by default. The two paid accounts examined by WIRED, one Plus and one Enterprise, were not turned on by default.

Old privacy policy

We disclose your personal data in the following circumstances:

Vendors and Service Providers: To help us meet our business operations needs and perform certain services and functions, we disclose personal data to vendors and service providers, including hosting providers, customer service resellers, cloud services, content delivery services, support and safety services, email communications software, web analytics services, payment and transaction processors, search and shopping providers, marketing service providers, and information technology providers. We also work with service providers who help us verify age and identity, you can learn more here⁠. On our instructions, these parties will only access, process or store personal data in the context of performing their duties to us.

New Privacy Policy

We disclose your personal data in the following circumstances:

Vendors, service providers and marketing partners: To help us meet our business operations needs and perform certain services and functions, we disclose personal data to vendors, service providers and marketing partners, including hosting providers, customer service resellers, cloud services, content delivery services, support and safety services, email communications software, web analytics services, payment and transaction processors, search and shopping providers, and IT providers. We also work with service providers who help us verify age and identity, you can find out more here⁠⁠. Where we work with service providers, these parties will access, process or store personal data on our instructions and only in the context of performing their duties to us. We also share limited information with select marketing partners that are not service providers in order to promote our products and services on third-party properties and to help us evaluate the effectiveness of those efforts. Some of these partners may receive information through cookies and similar technologies. Learn more about these practices and the options available to you here⁠.

The emphasis on “sensitive personal data” was removed by mistake

OpenAI classifies many different types of information as a user’s “personal data,” including dates of birth, payment information, and any claims the user may have made. In its privacy policies, it does not explain what types of this data it considers “sensitive,” but OpenAI promises that it does not use this information to infer the characteristics of consumers.

The sentence about “sensitive personal data” was briefly absent from the privacy policy on Friday when WIRED accessed the updated document. When WIRED reached out to OpenAI for comment, the company claimed this removal was an error and added a similar sentence again, in a different paragraph.