This lesson is not legal advice: it's what we've read in OpenAI's documentation and what we've verified while building our own measurement. Before applying any of it, have it reviewed by whoever handles data protection in your company.
That said, there is a product decision here that is ours, and it is an uncomfortable one: measuring without advertising consent is not an option.
What changes in the EEA (OpenAI's decision)
In the European Economic Area and Switzerland, according to OpenAI's help centre, personalised ads are not available for now. In practice, for the advertiser:
| Outside the EEA | In Spain and the rest of the EEA | |
|---|---|---|
| How your ad is chosen | Conversation context and signals from broader ChatGPT use | Only the current conversation, the language and the approximate location |
| History, memories, earlier chats | May play a part if the user has personalisation on | No |
| Custom audiences (customer lists) | Yes, with minimum match sizes | Not available |
The practical consequence: in Spain your context hints and your creative do nearly all the targeting work, because the platform has fewer signals to refine with. And the "don't pay for people who are already customers" lever doesn't exist here.
What you receive and what you don't
This is official too, and worth being clear about before writing your privacy policy: advertisers receive aggregated performance data. OpenAI does not share conversations, history, memories, name, email, precise location, IP address or sensitive information. Ads are also not shown next to sensitive content (health, mental health, politics) or to under-18s.
In other words: from the platform's side you receive no personal data about anyone. Personal data appears in the other direction, when you are the one sending the conversion.
The consent that really is yours
Your website's cookie banner governs your measurement. And here the platform has a known trap: the pixel starts by assuming consent is granted. In Europe that has to be inverted: set it to "no" and only switch it to "yes" when the person accepts the advertising purpose in your banner. OpenAI's own help centre says it plainly: conversion data should only be sent after informing users clearly and obtaining all necessary consents where the law requires them.
What to do with each visit, depending on what the person accepts:
| The person… | Click identifier | Conversion to OpenAI | Your analytics |
|---|---|---|---|
| Accepts advertising | Stored and used | Sent | Yes |
| Accepts analytics only | Not used for advertising | Not sent | Yes, on your legal basis |
| Refuses or ignores the banner | Not stored | Not sent | No |
⚠️ Trap: what was blocked is not recovered later. If someone accepts on the third day, their earlier visits don't reappear by magic. There will be clicks your measurement never sees, and that is part of the normal gap between the platform's clicks and your visits.
A hashed email is still personal data
When you send a conversion with the SHA-256 hashed email so the platform can match it better, you are not anonymising anything: you are pseudonymising. The same email always produces the same result, so it still singles out a person. Under the GDPR that is personal data, with its legal basis, its prior information and its place in your record of processing activities. It is stated that way, incidentally, in our own privacy policy.
Watch out too for the pixel's automatic advanced matching: it detects contact details in your site's forms and hashes them in the browser to send with the conversion, without you doing anything. It is a useful feature and OpenAI declares it, but it is one more processing activity you have to know about, disclose and obtain consent for.
The detail that settles the decision
We verified it ourselves while building our conversion sending in September 2026: the server-side conversion route has no consent field. The closest thing is a flag asking for that conversion not to be used to personalise advertising. There is no way to say "this person didn't accept, count them but don't use them".
So in the EEA the right decision is the simplest one:
📌 What we do: with no advertising consent, nothing is sent. Not the conversion, not the hashed email, not the click identifier. The lead is stored in our system with its consent status and stays there. We'd rather have an incomplete report than a transfer we can't justify.
That has a cost you should accept with your eyes open: with a low acceptance rate the campaign optimises on less signal and your conversion figures will be lower than reality. One more argument for judging channels with your own funnel, not just with what each platform reports.
What to put in your privacy policy
Without inventing anything, and in plain language:
- That you advertise in ChatGPT and use a first-party cookie to attribute the visit to the ad, and how long it lasts.
- That you send OpenAI conversion events and, where applicable, hashed contact data for matching, with the legal basis.
- Who the recipient is and that there is an international transfer, with the appropriate mechanism.
- How long you keep each thing, including the intermediate technical copies inside your own systems.
- How consent is withdrawn and what happens then.
What to take away
- In the EEA and Switzerland the ad is not personalised and custom audiences aren't available: your context hints do the work.
- OpenAI doesn't hand you personal data about users; the personal data is what you send when reporting conversions.
- The pixel assumes consent by default: in Europe, do the opposite.
- SHA-256 is pseudonymisation, not anonymisation.
- The server route has no consent field (checked by us): without permission nothing is sent, not even the click identifier.
- Disclose the cookie, the transfers, the hashing, the recipient and the retention periods. And have a professional review it.