Aimerce Blog

Does OpenAI Ads Tracking Comply With GDPR and CCPA?

3 September 2026

Does OpenAI Ads Tracking Comply With GDPR and CCPA?

First-Party Data 101

Quick Answer: OpenAI has a dedicated Ad Tools Data Processing Addendum covering its Conversion Tools and Audience Tools, using Standard Contractual Clauses for EEA and Swiss data transfers, and explicitly naming California and other US states with comprehensive privacy laws as covered jurisdictions. That gives merchants a real legal framework to point to, but it doesn't remove your own obligations around consent, since compliance is a shared responsibility between OpenAI's infrastructure and how you collect and forward data.

Key Takeaways

OpenAI's Ad Tools Terms come with a dedicated Data Processing Addendum specific to Conversion Tools and Audience Tools, separate from OpenAI's general API DPA, using SCCs for EEA and Swiss data transfers.
The DPA's defined "Restricted Jurisdiction" explicitly names the EEA, Switzerland, the UK, and a long list of US states with comprehensive privacy laws, including California, so this isn't a framework built only with GDPR in mind.
Conversion and advertising data are governed separately from the data used to train ChatGPT's models. The two are controlled by different settings, and nothing in OpenAI's published policies indicates conversion data is used for model training.
On April 30, 2026, OpenAI updated its US privacy policy to formalize that it receives purchase data from advertisers and shares user information with marketing partners for third-party ad targeting, a real, dated change worth knowing about.
OpenAI's own materials describe ChatGPT ads as providing aggregate impression and click data to advertisers rather than individual-level user data, meaning the data flow into OpenAI via CAPI and the data flow out to advertisers aren't the same thing.
A compliant DPA on OpenAI's end doesn't remove a merchant's own consent obligations. Compliance here is shared, not something you can fully outsource to the platform.

OpenAI has published a specific legal framework for this, an Ad Tools Data Processing Addendum covering Conversion Tools and Audience Tools, which is the mechanism that lets it process data under GDPR and CCPA-style obligations rather than leaving it unaddressed.

That's a meaningfully different answer than "yes" or "no." A DPA existing means OpenAI has defined its role, its data categories, and its transfer mechanism for this specific product, which is the legal groundwork compliance actually depends on. It doesn't mean every possible use of the data is automatically compliant, and it doesn't remove a merchant's own responsibility for consent. What it does mean is that there's a real, citable framework to point to, rather than general platform terms that were never written with advertising data specifically in mind.

What is OpenAI's Ad Tools DPA, and why does it matter?

It's a Data Processing Addendum specific to OpenAI's Conversion Tools and Audience Tools, separate from OpenAI's general API DPA, and it's the document that actually defines how OpenAI is allowed to handle the conversion data your store sends [1].

A few specifics worth knowing directly from that document. It defines a "Restricted Jurisdiction" covering the EEA, Switzerland, the UK, and a long list of US states with comprehensive consumer privacy legislation, California, Colorado, Connecticut, and many others by name. For EEA and Swiss data specifically, it relies on Standard Contractual Clauses, Module One, Independent Controller Processing, which is a standard, recognized mechanism for lawful international data transfer under GDPR. This matters because it means OpenAI's ad infrastructure was built with these jurisdictions in mind from the start, rather than retrofitted after the fact.

Does customer purchase data sent via CAPI train ChatGPT's models?

Nothing in OpenAI's published policies indicates that it does, and the two are explicitly governed by separate settings.

This is the concern that's genuinely unique to running ads on an AI company's platform, not something that comes up the same way with Meta or Google. Conversation content typed into ChatGPT may be used to improve model performance by default for many users, governed by its own account-level settings. Advertising and conversion data, purchase amounts, event data, hashed identifiers sent through the Conversions API, falls under the separate Ad Tools DPA described above, which governs how that data is processed for measurement and ad delivery. One analysis of OpenAI's policy updates states directly that "the advertising update does not change this existing practice," referring to model training, "it is governed by separate settings from advertising data controls" [4]. The two data flows exist, they're just not the same pipeline.

What data categories does OpenAI's Ad Tools DPA actually cover?

A defined list that maps closely to what a standard Conversions API integration actually sends: email addresses, phone numbers, cookies, online identifiers, device or browser information, event data, transaction data, and purchase data, along with related metadata [1].

That list is worth reading literally rather than skimming past. It means the order value, hashed customer email, and event details your store sends through OpenAI's Conversions API fall within a defined, named category in a real legal document, not an ambiguous gray area the DPA never anticipated.

Individual-level user data does not appear to flow out to advertisers. OpenAI's own materials describe advertisers as receiving aggregate impression and click data rather than individual user records [3].

That's worth separating clearly from the direction of data flow this article is mostly about. Your store sends conversion data into OpenAI's systems via CAPI for measurement purposes, that's the flow the Ad Tools DPA governs. Advertisers receiving raw, individual-level data about other platform users going the other direction is a different question, and the available evidence points to that not happening, aggregate reporting only.

What changed with the April 2026 privacy policy update?

OpenAI formalized, in binding legal language for the first time, that it receives purchase data from advertisers, shares user information with outside marketing partners for third-party ad targeting, and uses personal data to promote its own products [2][5].

This wasn't a new capability appearing out of nowhere, coverage describes it as formalizing arrangements that had been building since OpenAI began testing ads in ChatGPT in February 2026. For a merchant already sending conversion data through OpenAI Ads, the practical relevance is that this is now explicit, defined policy language rather than an unstated practice, which is generally the more compliance-friendly direction for a policy to move in, not less.

Comparison: How Does OpenAI's Ad Data Framework Compare to Meta and Google's?

Dimension	Meta	Google	OpenAI
Dedicated ad-specific DPA	Yes, established for years	Yes, established for years	Yes, since June 2026, newer but explicit
SCCs for EEA/Swiss transfers	Yes	Yes	Yes, Module One
Named US state privacy laws covered	Yes	Yes	Yes, explicitly listed by name
Conversion data separated from other product data governance	Yes	Yes	Yes, separate from model-training settings specifically
Individual user data shared with advertisers	No, aggregate/matched signals only	No, aggregate/matched signals only	No, aggregate impression and click data only
Merchant's own consent obligation	Still required	Still required	Still required

What should you actually do as a merchant?

Treat OpenAI Ads the same way you already treat Meta and Google from a compliance standpoint, since the underlying obligation, valid consent before data collection, doesn't change based on which platform receives the event.

If you already have a compliant consent setup for Meta and Google CAPI: extend the same logic to OpenAI. The legal mechanism differs slightly, but the practical requirement, don't fire conversion events for users who haven't consented, is identical.

If your privacy policy or cookie disclosure doesn't currently mention OpenAI Ads: that's worth updating, since disclosure obligations generally cover which parties receive customer data, not just which ones you're most familiar with.

If you're relying on a server-side tracking provider: confirm it respects your consent logic the same way across every destination, OpenAI included, rather than assuming a provider that handles this correctly for Meta automatically extends the same care to a newer integration.

Common mistakes to avoid

Assuming a platform's DPA existing means your own consent obligations disappear. A DPA governs the platform's side of processing. It doesn't collect consent on your behalf.
Treating OpenAI Ads as exempt from existing privacy disclosures because it's newer. The same disclosure obligations that apply to Meta and Google apply here.
Confusing conversation-data training settings with advertising data settings. They're governed separately, don't assume adjusting one affects the other.
Ignoring the April 2026 policy update because it doesn't feel like it directly affects a Shopify merchant. It's the specific legal basis under which your conversion data is now explicitly covered, worth knowing even if nothing about your own setup needs to change.

FAQ

Does OpenAI Ads tracking comply with GDPR and CCPA? OpenAI has a dedicated Ad Tools Data Processing Addendum covering Conversion Tools and Audience Tools, using Standard Contractual Clauses for EEA and Swiss transfers and explicitly naming California and other US states with comprehensive privacy laws. That provides a real compliance framework, but merchants still carry their own consent obligations.

Is OpenAI's Ad Tools DPA different from its general API DPA? Yes. OpenAI maintains a separate Data Processing Addendum specifically for Conversion Tools and Audience Tools, distinct from the general API DPA that covers other OpenAI products and services.

Does the data I send through OpenAI's Conversions API get used to train ChatGPT? Nothing in OpenAI's published policies indicates that it does. Conversation data used for model training is governed by separate account-level settings from advertising and conversion data, which falls under the Ad Tools DPA instead.

What data categories does OpenAI's Ad Tools DPA cover? Email addresses, phone numbers, cookies, online identifiers, device and browser information, event data, transaction data, and purchase data, along with related metadata, a list that maps closely to what a standard Conversions API integration sends.

Does OpenAI share individual customer data with other advertisers? Available evidence points to no. OpenAI's own materials describe advertisers as receiving aggregate impression and click data rather than individual, user-level records.

What changed in OpenAI's privacy policy in April 2026? OpenAI formalized, in binding legal language, that it receives purchase data from advertisers, shares user information with marketing partners for third-party targeting, and uses personal data to promote its own products, making previously informal practices explicit policy.

Do I still need my own consent banner if I use OpenAI Ads? Yes. OpenAI's compliance framework governs how OpenAI processes the data it receives. It doesn't collect consent from your customers on your behalf, that responsibility stays with the merchant, the same as it does for Meta or Google.