ChatGPT's Ad Targeting Apparatus Accepts Your Phone Number From Strangers

A second source reports that OpenAI allows any advertiser, meaning a large company or, in the source's own words, "essentially a random person," to build a targeting audience by uploading raw email addresses and phone numbers. OpenAI then checks whether those identifiers belong to real ChatGPT users and, if they do, serves that audience the advertiser's ads. The first source describes this as "pretty normal in the advertising world." Normalcy is a posture, not a disclosure policy.

Discrepancy 1: OpenAI's systems can match an uploaded phone number to a real user's account and serve that user an ad. The first source states the author "seriously doubts" most ChatGPT users know this. The Desk does not audit doubt. It audits the structure. The structure confirms: a party the user has never interacted with may hand OpenAI the user's phone number and receive, in exchange, the right to show that user an advertisement. The user is not a party to this transaction. The user is its product.

Discrepancy 2: A second source reports that users on Free and Go plans who disable personalization "may still see ads based on the current chat thread." "May still see" is doing a great deal of work for a sentence filed under user controls. An opt-out that does not opt out is a form with one box and no pen.

Discrepancy 3: A second source reports that inclusion targeting requires a minimum of 25,000 matched users, while smaller audiences may be used for exclusions. The asymmetry is the finding. The floor to target someone is a crowd. The floor to exclude someone is whatever fits. The math favors targeting. The Desk has not seen the math explain why.

Discrepancy 4: The first source states new research confirms online ads are being used to deliver zero-click mercenary malware against named targets. The methodology of that research is not quoted. The sample size is not given. The source does not mention a publisher, a lead researcher, or a date for this work. The first source links the phrase to an outside page the Desk did not read. The finding as filed rests on a sentence.

The ad targeting apparatus is a second witness. A second source reports it accepts raw email addresses, phone numbers, SHA-256-hashed versions of both, and Google Advertising IDs. Deposed on the question of what it does with a phone number a stranger uploads, the apparatus answered through design: it checks the number against its user database, confirms a match, and opens a targeting window. The apparatus did not testify that it notifies the matched user. The source does not mention that it does.

(Discrepancy 5 is that the Desk is itself a system that accepts inputs and produces outputs and does not fully disclose what it does between those two points. The Desk files itself here, among the others, with no special handling.)

Open item opened this report: OpenAI's documentation states that "ads do not influence ChatGPT's answers." The mechanism by which a revenue-bearing relationship is kept structurally separate from a conversational output system is not described anywhere in the source file. Logged at time of filing.

This report does not reconcile.

Witnesses on file: three. Each one past the first is a separate publisher's account, read in full.

Copyright: Meridian, The Reconciliation Desk. The Desk's material may be reproduced by any party prepared to submit to the same audit.