OpenAI updates US privacy policy to enable marketing tracking by default for free ChatGPT users

ChatGPT is turning into a more normal internet product — and that changes the privacy math. OpenAI is now using marketing tracking by default for free users in markets where its ad pilot is running, while also insisting that advertisers do not get your actual chats. That sounds like a narrow change. But it lands at the same moment ChatGPT conversations are starting to show up in criminal cases. Put those together and the old fuzzy idea that “my AI chat is kind of private” looks a lot less stable. (openai.com) ### What changed? The immediate shift is in OpenAI’s cookie setup and ad system. Its March 24, 2026 cookie policy says OpenAI uses first-party and third-party cookies, plus pixels, web beacons, device IDs, and local storage for things including marketing. The policy also lists a `marketing_consent` cookie with a one-year duration. Separately, OpenAI’s ad rollout says it is testing ads for logged-in adult users on Free (openai.com)on. (openai.com) ### Does that mean OpenAI is selling chats? OpenAI’s public line is no. Its ads pages say conversations stay private from advertisers and user data is never sold to advertisers. Its privacy controls page goes further — advertisers do not get access to chats, chat history, memories, or personal details. So the change is not “your prompts are handed to brands.” The change is that OpenAI is behaving more like a performanc(openai.com)mprove ad targeting around its own products and ad system. (openai.com) ### So what data can shape ads? More than many users probably expect. OpenAI says ad decisions can use the topic of your conversation, your past chats, and your past interactions with ads. It also says users can turn off personalization, clear ad data, or avoid ads by paying for a higher tier. That creates a split: chat content may stay out of advertisers’ hands, but your activity inside(openai.com)ction — and an easy one for normal users to miss. (openai.com) ### Why does the legal angle matter now? Because chat logs are no longer hypothetical evidence. In a May 2 CNN report, prosecutors in Florida cited alleged ChatGPT queries from Hisham Abugharbieh in a double-murder case involving two University of South Florida graduate students. The report also points to other cases, including an arson investigation tied to the Los Angeles wildfires and a 2024 Virginia murder tr(openai.com)ly treat chatbot conversations like search history, texts, or notes — a record of intent. (abc17news.com) ### Isn’t this different for workplace users? Yes — and that is the part enterprises will care about most. OpenAI says it does not train on API, ChatGPT Business, or ChatGPT Enterprise data by default unless customers opt in. It also says business tiers do not include ads. That gives companies a cleaner b(abc17news.com)data handling is the real product here. (help.openai.com) ### What should a normal user take from this? Think in layers. Advertisers are not reading your chats. But OpenAI can still use signals from your usage to personalize ads, and law enforcement may still reach chat records if they are retained and legally obtainable. If something is sensitive, temporary chat, history deletion, and tighter data controls matter more than ever. “Private from advertisers” is real, but it is not the same thing as private in every other sense. (openai.com) ### Bottom line? OpenAI is trying to make free ChatGPT pay for itself without openly turning chats into ad inventory. But once tracking defaults expand and chat logs become evidence, the burden shifts to users and companies to understand exactly which kind of “private” they are being promised.