OpenAI just moved into the advertising business. Here is what that actually means for anyone using AI in their work, and why the “your conversations are private” reassurance is missing the point.

Yesterday, Tuesday 26th May 2026, OpenAI sent its European users a short email, the subject was unremarkable, the content was not.

“We’ll now use cookies to promote OpenAI products and services on other websites.”

One sentence, tucked inside a newsletter-style update about privacy policy changes, followed immediately by a reassurance: “Your conversations with ChatGPT are private and are not shared with advertisers.”

What actually changed

OpenAI’s updated European privacy policy now explicitly states that cookie data will be used to promote their products across third-party websites. This is standard ad-retargeting infrastructure. You visit ChatGPT, you leave, you see OpenAI ads elsewhere, the loop closes.

This is separate from your conversations, and it is worth closer inspection because OpenAI has drawn a line between conversation content and behavioural tracking, but the line they drew matters less than the fact that a line now exists at all.

Before this update, there was no cookie-based advertising from OpenAI. Now there is, that is a structural change to the relationship between you and the tool you have been calling “free.”

Here is what the privacy policy covers, and what most people will never read.

OpenAI collects log data, device information, location data inferred from IP address, usage patterns across their services, and data from connected integrations. They share this with vendors, affiliates, and potentially government authorities under certain conditions. Your data can transfer in the event of a business restructuring.

None of this is unusual for a technology company, what is unusual is the scale of the tool, the intimacy of the data passing through it, and the gap between how people understand their relationship with it and what the terms actually describe.

Most people using ChatGPT believe they are using a search engine with personality, they are not, they are interacting with a platform that has a detailed model of their queries, interests, professional context, and communication patterns, and that platform is now in the advertising data business.

Very Reassuring

Re-read the reassurance: “Your conversations with ChatGPT are private and are not shared with advertisers.”

Conversations, not behaviour, patterns or the signal that “this user visited ChatGPT four times this week and spent forty minutes each session.”

The distinction between conversation content and behavioural data is real. It is also precisely the distinction that advertising infrastructure does not require. Advertisers do not need to know what someone said, they need to know that they were there, how long, how often, and what they did next, that is what retargeting runs on.

OpenAI has told them what you are doing, but they have not told you the full picture of what they are doing.

Why this matters for anyone using AI in their work

This is not an article about privacy law, it is an article about the operating model you are building, or failing to build, around your AI use.

Every platform you use has an architecture, and that architecture determines who benefits from your behaviour. The “free” label has never meant zero cost. It has always meant cost in a different currency. If the platform is free you are the product.

The people who will navigate this well are not the ones who stop using AI tools, they are the ones who understand that directing AI toward defined outcomes, rather than accepting whatever the platform defaults to, requires a methodology layer above the tools. Something that does not sit inside ChatGPT’s context window or OpenAI’s cookie jar.

The tools are not the problem, the absence of a methodology layer that directs AI is.

The problem was never the AI. The problem was the missing methodology layer.

configure YOUR system. contAIn™ the chaos. control YOUR outcome.

References

[1] OpenAI Europe Privacy Policy — Section 3: Disclosure of Personal Data. https://openai.com/policies/eu-privacy-policy/

[2] OpenAI Europe Privacy Policy — Section 3: Business Transfers. https://openai.com/policies/eu-privacy-policy/

This article was first published on LinkedIn. Read the full version on Substack.