The Free User Is the Product: OpenAI Built an Ad Machine on Your Settings Menu
The Free User Is the Product: OpenAI Built an Ad Machine on Your Settings Menu
OpenAI has a tracking system running on 200 million free accounts. Whether those users know about it is another question.
On April 30, OpenAI flipped marketing cookies on by default for free ChatGPT users, sharing cookie IDs and email addresses with advertising partners including Criteo and Kargo. On May 5, it opened a self-serve Ads Manager to any US business — the infrastructure needed to turn those free users into a $2.5 billion annual revenue stream by 2026.
The opt-out exists. It is buried in Settings > Data Controls > Marketing Privacy. Whether it actually works — whether toggling that setting genuinely stops the data flow to ad partners, or whether OpenAI's Conversions API continues collecting signals even after opt-out — is a question nobody outside the company has tested publicly.
That gap between the privacy claim and the verification is the story.
"We do not share your conversations with these marketing partners," OpenAI told users in an April 30 email. What it did not say: that cookie IDs and email addresses are shared, that those signals let ad partners build profiles on free users across the web, and that this infrastructure is live months before OpenAI's expected IPO — when S-1 disclosures will face scrutiny over exactly what user data feeds the ad machine.
OpenAI declined to make a technical representative available for this article.
The Two-Tier Privacy Model
Plus and Enterprise subscribers are not enrolled in the default tracking. Their data is not shared with ad partners for marketing purposes. Paying users bought privacy as part of their subscription.
Free users are not offered that choice by default. They are tracked unless they find the settings menu, understand what they are looking at, and act. The default is revenue. The opt-out is discoverable.
With more than 90 percent of ChatGPT's weekly active users on the free tier, this is not a marginal feature. It is the core of how OpenAI plans to pay for the computing infrastructure serving those 200 million conversations.
The Revenue Math
OpenAI told investors it expects $2.5 billion in ad revenue this year, according to Axios. That figure grows to $11 billion in 2027, $25 billion in 2028, and $53 billion in 2029, with a long-range target of $100 billion by 2030.
Those are not the projections of a company that has figured out advertising. They are the projections of a company that needs those numbers to justify a valuation at IPO. The self-serve platform is the mechanism for getting there — opening ChatGPT ad inventory to every US business, not just the holding-company clients (Dentsu, Omnicom, Publicis, WPP) that had access during the February pilot.
The platform added CPC bidding alongside the existing $60-per-thousand-impressions CPM model. The shift from impression-based to action-based pricing matters: it signals that OpenAI is trying to attract performance marketers, not just brand advertisers, and that it believes clicks in ChatGPT are a meaningful signal of commercial intent.
"Many ChatGPT conversations are active and decision-oriented," OpenAI said in its May 5 announcement. "People are often learning about a category, comparing options, or deciding what to do next."
The Measurement Problem
One of the most-requested capabilities during the pilot was robust conversion measurement. OpenAI recently launched a Conversions API and pixel-based tracking — tools that let advertisers see what happens after a user clicks an ad and lands on their site. The company says this data is aggregated, with no individual conversation data accessible to advertisers.
This closes a gap that kept performance-focused marketers away during the pilot. Without conversion tracking, CPM advertising is essentially brand awareness spend with no accountability loop. With it, ChatGPT ads become comparable to Google or Meta — a channel where an advertiser can trace a click to a signup, a purchase, a lead.
Whether the Conversions API actually respects the opt-out status of users who disabled tracking is exactly the question that needs answering before an advertiser commits budget.
The CPRA Exposure
The California Privacy Rights Act treats default-on sharing of email addresses and cookie IDs with third-party ad partners as a form of cross-context behavioral advertising. Free users in California are entitled to opt out. OpenAI's default-on enrollment, switched on April 30, may trigger enforcement by the California Privacy Protection Agency before OpenAI's IPO.
OpenAI did not comment on the CPRA exposure.
What OpenAI Says vs. What Has Not Been Tested
OpenAI's position: no conversation content is shared, users can opt out at any time, and the Conversions API and pixel tools are designed with privacy protections. The company provided a spokesperson statement confirming the privacy policy update and the scope of data sharing.
What nobody has independently verified: whether the opt-out mechanism actually terminates the data flow, what the Conversions API logs when an opted-out user triggers a pixel, and whether the email address sharing with partners constitutes a separate data transfer under CPRA that requires a separate opt-in.
The ad platform is live. The IPO timeline is approaching. The users being tracked number in the tens of millions. The verification gap is real.
OpenAI said it plans to continue evolving its ad platform with new formats and capabilities. For now, the product works. The privacy controls exist. Whether they do what they say is an open question — and one that will face its first real test before the S-1 filing.
Sources: OpenAI blog post (May 5, 2026); WinBuzzer (May 3, 2026); PPC.land; Search Engine Land; Axios (April 9, 2026)