“No company should be able to target you using your personal data,” Oregon Sen. Wyden urges Congress to pass his bill banning surveillance ads and targeted advertising by chatbots

Oregon – “No company should be able to target you using your personal data, including the sensitive data people share with ChatGPT. The privacy harms are enormous. Congress needs to pass my bill to ban surveillance ads—including targeted ads by chatbots,” Oregon Sen. Ron Wyden wrote on X on October 15.

The Democratic senator made the statement after investigative journalist Joseph Cox reported for 404 Media that OpenAI allows advertisers to target ChatGPT users using uploaded phone numbers, email addresses and other identifiers, raising questions about how personal information can be used to deliver advertisements inside an AI chatbot.

Wyden, who has long pushed for stronger federal privacy protections, argued that Americans should not have their personal information used to target them with advertising, particularly when the information involves sensitive subjects people discuss with AI tools.

His comments came as ChatGPT’s advertising system faced scrutiny following 404 Media’s investigation, which examined how advertisers could build audiences to reach particular groups of users.

In his report published October 15, Cox said he tested the advertising system and found that advertisers could upload lists containing raw email addresses, phone numbers, hashed versions of those details or Android advertising IDs to create audiences for targeted advertising.

According to 404 Media, OpenAI checks whether the submitted identifiers correspond to ChatGPT users, allowing advertisers to target matching audiences. The system also allows advertisers to provide contextual information about the topics they want their advertisements associated with, meaning ads can be matched to subjects users discuss in their prompts.

However, the investigation identified an important limitation: an audience must contain more than 25,000 entries to be used to target users for inclusion. Smaller lists can be used to exclude people from an advertising audience instead.

The findings prompted questions about whether users understand how their personal information might be used when interacting with an AI chatbot.

404 Media noted that this type of audience targeting is already common in the digital advertising industry. However, users may not expect an AI assistant, which they use to ask questions and discuss personal matters, to be another platform where advertisers can target them using identifying information and the subjects they discuss.

OpenAI told 404 Media that uploaded audience files are deleted after processing, usually within 24 hours, and that advertisers cannot see which individual users matched their lists. The report also described how advertisers could use the platform’s targeting tools without needing access to the actual conversations of the people they wanted to reach.

The investigation did not establish that advertisers could read users’ private conversations simply by uploading contact information. Rather, it documented the ability to match identifying information to ChatGPT accounts and combine audience targeting with contextual advertising.

Wyden’s criticism is part of a broader effort to restrict what companies can do with personal information collected through online advertising.

The senator has previously supported legislation known as the Banning Surveillance Advertising Act, which he introduced alongside New Jersey Sen. Cory Booker in 2023. The proposal would prohibit advertising networks and facilitators from using personal data to target advertisements, while preserving certain forms of contextual advertising that do not rely on extensive personal profiling.

Wyden reiterated his support for that approach in September 2026, when he urged Google, Meta and TikTok to make it easier for Americans to opt out of invasive advertising tracking. He argued that tracking tools often collect information by default, placing the burden on website operators and businesses to change settings to comply with privacy requirements.

The latest controversy highlights the challenge lawmakers face as advertising becomes more closely integrated with AI services. Traditional online advertising can use browsing activity, demographic information and identifiers to build audiences. AI platforms introduce another dimension because users may discuss health concerns, financial difficulties, relationships and other sensitive subjects while seeking assistance.

Wyden argues that existing privacy protections are insufficient to address these risks and that Congress should establish clearer restrictions on surveillance-based advertising, including ads delivered through chatbots.

The senator’s October 15 post did not announce a new bill specifically targeting OpenAI. Instead, he used the report to renew his call for Congress to pass legislation banning surveillance advertising, explicitly including targeted advertising by chatbots.

Whether lawmakers will advance such restrictions remains uncertain. For now, the investigation has added to the debate over how AI companies should handle advertising, personal information and the expectations of users who turn to chatbots for help with private questions.