OpenAI updated its privacy policy in the U.S. on April 30 to formalize data-sharing arrangements with advertisers and marketing partners, explicitly acknowledging that it receives purchase data from advertisers to measure ad effectiveness and shares user information with partners for third-party targeting.
The updated policy marks a shift from OpenAI's prior stance that it would never sell user data, though a company spokesperson told Adweek that “nothing about our policy of not sharing people's conversations or other private user content with advertisers has changed” and that it only shares limited identifiers like cookie IDs or device IDs.
It's worth noting that cookie IDs and device IDs can be matched against data broker databases to identify individuals by name, address, and detailed behavioral history. The CCPA and GDPR both classify these identifiers as personal data. So while cookie IDs and device IDs sound relatively anonymous, they're exactly what ad tech companies use to build full personal profiles.
OpenAI also updated the code on its ChatGPT conversion tracking pixel to add a consent management system and a country data field, indicating that it is building the technical groundwork to run advertising in the EU. The update lets advertisers ask users for permission before tracking and stops tracking when permission is withdrawn, features required under EU privacy law that are not needed in the U.S. where tracking operates on an opt-out basis. Then again, maybe the company is voluntarily updating its U.S. code to support consent because it's the right thing to do? I wouldn't put my money on it…
ChatGPT's ad pilot is extending beyond the U.S. to include Canada, Australia, and New Zealand in the coming weeks, and Digiday reported last week that the company is looking for executives for its ads team in London and Tokyo.