Advertising tracking is authorized by legislation in Europe provided that the user’s informed consent is obtained. In France, the ChatGPT.com site prepares the user for this possibility, but its charter relating to cookies will have to evolve.
A class action filed in California federal court on May 13 accuses OpenAI of having disclosed personal data and even sensitive from a ChatGPT user to Meta and Google without her consent “throughout 2025 and 2026”. The complaint, which we have consulted, seeks to demonstrate how ChatGPT was able to transmit this data in a structured and organized manner, thanks to Meta and Google tracking technologies integrated into the code of its site.
The latter would thus have accessed the requests made by ChatGPT users without their knowledge, in real time, and linked this information to the identifier of each user on these Gafam environments. The class action filed in California seeks to represent “all residents of the United States who have accessed and made requests to ChatGPT.com.”
For what purpose does ChatGPT integrate these technologies?
“Technically, as with any other advertiser with a website, these technologies allow ChatGPT to retarget its users on FacebookInstagram or on Google environments with advertising,” explains Thomas Skowronski, executive vice president of Jellyfish Technology Solutions. “In the case of Meta, a pixel integrated into the ChatGPT site allows you to send it the subject of the request and the user ID of the person; if the user is connected to their Facebook account, the link can be established. In the case of Googlethe link is established directly thanks to the user’s e-mail address”, continues the expert.
Our expert describes methods that are more than proven and known throughout the world, widely used by advertisers and in particular e-retailers and entirely possible in France, provided that user consent is obtained. And that’s where the problem lies: the Californian complaint claims that the user was neither informed nor given consent, which, in the United States, is also contrary to the Electronic Communications Privacy Act (ECPA) and the California Information Privacy Act. Another point complicates things: Gafam has access to the titles of the queries asked in the prompt, which for specialists reveals more information about users than simple metadata.
In France, tracking is possible but not applied
Asked by the Journal du Net, the Jellyfish teams checked whether these tracking methods are deployed by OpenAI on ChatGPT in France, and the answer is no. “I see tracers on https://openai.com/ but not sure https://chatgpt.com/“, explains François de Broissia, senior data & analytics director at Jellyfish. “On both domains, there is a cookie banner, and both banners refer to the same privacy policy which explicitly mentions Meta and Google,” he continues.
We analyzed the consent request banner and the privacy policy relating to cookies of chatpgt.com, the last of which was updated on May 6, 2026. The conclusion is clear: OpenAI will have every interest in reviewing its copy the moment it decides to deploy the technologies of tracking Gafam. And for good reason. ChatGPT requests consent only for “marketing measurement” cookies used to “measure the effectiveness of our advertising campaigns”. No mention is made of profiling or retargeting even though the ground for this is ready: in its privacy policy relating to cookies, Google and Meta just like Bing, LinkedIn, Reddit and TikTok are even listed by ChatGPT in the “marketing performance cookies” category. In addition, the platform also indicates that it uses “third-party cookies, from a domain different from the one you are visiting” without forgetting “similar technologies, such as pixels, Internet beacons, sharing of device identifiers and other identifiers via APIs or local storage”. However, Gafam’s retargeting and advertising measurement technologies fall right into this category.
“Site publishers have a legal obligation to specify all the purposes of the processing they carry out. Here, in the case of ChatGPT, the term ‘marketing performance measurement’ remains quite vague, especially since it concerns the titles of the requests and not only the metadata. Furthermore, the data retention period for Meta, of 400 days, seems disproportionate and even problematic to me given the mass of information collected which could give rise to cross-referencing. data which can reveal potentially sensitive information”, declares Me Alexandra Iteanu.
Sensitive information
The Californian complaint does not only concern the transfer of general personal data. She also notes the fact that sensitive data concerning the personal life, health and finances of a citizen were transmitted. In Europe, the transfer of so-called sensitive data (health, political opinions, sexual orientation, etc.) is strictly prohibited except in the case of exceptions (article 9.2 of the GDPR) which themselves require explicit consent and which do not concern advertising.
“If tomorrow ChatGPT decided to collect prompts from its users in France, it would have to specify its purpose very clearly and identify a legal basis for this because this type of data goes much further than the classic metadata collected by advertising trackers (IP, device, URL visited, etc.),” concludes the specialist.
Can ChatGPT limit this access in order to prevent sensitive data from being transmitted to Gafam? “The case of sensitive data is possibly the result of the normal functioning of the nature of the site. Meta will normally collect the ‘page title’ which is often renamed after the prompt. They will also observe elements that resemble forms, and this is the case of chat on ChatGPT. Meta can search the page for data that resembles emails to collect them. This is activated by marketing teams in Business Manager, which obviously poses a governance problem”, explains François de Broissia. However, this is not inevitable: “It is entirely possible to control what the library does via implementation in a tag manager (probably they have not done this), and ideally by setting up the server-side which allows an intermediate step of control / alteration / pseudonymization. This is today a standard for mature advertisers”, concludes our expert.
