OpenAI is purchasing personal data about you from data brokers to show you ChatGPT ads, according to new research by 404 Media. The company buys detailed information including phone numbers and email addresses, then uses this data to target specific people across Instagram, Facebook, Google, and other advertising platforms. This targeting happens without most people knowing their contact details have been sold and resold multiple times in the background.
The practice is not illegal. OpenAI follows the same model as Meta, Google, Amazon, and countless other tech companies that use data brokers to improve ad targeting. Data brokers are companies that collect personal information from public sources, purchase it from other companies, and then sell it to advertisers. Your phone number, email, address, and browsing habits get assigned a market value. Someone pays to access that information to show you an ad. The system operates mostly invisibly. When you see an OpenAI advertisement while scrolling, you do not know it appeared because the company paid for access to your contact details.
What makes this revelation timely is that advertising networks have become a delivery mechanism for malware. Research cited in the same 404 Media investigation shows that spyware companies are now using these ad networks to distribute potent malware that can steal passwords, track text messages, or monitor your phone. The same infrastructure that delivers targeted ads to you is also becoming a route for harmful software to reach your device. This creates a dual problem. Your data is being collected and sold without your knowledge, and the systems handling that data are increasingly compromised.
India has no unified law addressing data broker activity at this scale. While regulations like GDPR exist in Europe and some state laws in the US require transparency and consent, Indian users have fewer protections. Your information can be collected, aggregated, and sold with minimal oversight or disclosure. The Data Protection Act, 2023 provides some framework, but enforcement remains weak and many data broker practices exist in gray areas.
Your options are limited. You can manually request removal from individual data broker databases, but the process is time consuming and the information often reappears. Changing privacy settings on social platforms reduces targeting but does not stop it. Disabling personalized ads in your Google or Facebook settings helps, but companies can still use data they purchase from brokers. Real change would require regulation that forces companies to disclose where they source data and gives people genuine control over their information. For now, assume your phone number and email are already in circulation somewhere in the advertising ecosystem.
