ChatGPT Ads advanced matching turns on 17 August
OpenAI documents the mechanism on its own developer site. The date, the default and the off switch came through a different channel entirely. That gap is the whole story, and it closes on a Monday.
What is happening. On 17 August 2026, OpenAI switches automatic advanced matching on for ChatGPT Ads pixels that are already installed. The pixel starts reading customer details out of the forms on your site, hashing them in the browser, and sending the hash with every conversion. New pixels already work this way.
Who can close the tab. If you do not have an OpenAI Pixel on your site, nothing here applies to you. There is no setting to check and nothing to decide. Come back when you launch a campaign.
Why the rest of you should spend fifteen minutes. Because the switch flips whether or not anyone in your company has read what it does, and because in the European Union a hashed email address is still personal data. That is not our opinion. It is the position the European Data Protection Board put in writing.
- The exact four clicks that turn it off, and where they hide.
- Which parts OpenAI documents on its own domain, and which parts only exist in an advertiser email.
- Why hashing changes your risk but not your legal basis.
- What ChatGPT actually sent this website in the same twenty-eight days, measured rather than guessed.
We have been writing about ChatGPT advertising in Europe since July, and it turned into the most-read thing on this site. In the twenty-eight days to 9 August, our page on it collected 689 impressions in Google and 43 clicks, at an average position of 6.2. In those same twenty-eight days, ChatGPT sent this website two visits. Two.
Hold both numbers in your head, because they explain the shape of what is happening. The interest in advertising inside ChatGPT is real and it is early. The traffic is not there yet for most European businesses. And into that gap, OpenAI has just shipped a measurement change with a date on it.
On 17 August 2026, automatic advanced matching becomes the default on ChatGPT Ads pixels that already exist. If you installed the OpenAI Pixel before this change, it is your pixel that flips. Until then, you can opt out. After that, you can still opt out, but you will be turning something off rather than choosing whether to turn it on, and those are different conversations to have with a client or a data protection officer.
One detail before the rest, because it decides what you can tell a client. The most precise public statement about this change is not in a blog post or an advertiser email. It sits in OpenAI's ads API reference, in a note under a boolean field, and we quote it in full further down.
What changes on 17 August 2026
Nothing about your campaigns changes. No budget moves, no ad stops, no account gets suspended. What changes is what the tracking script on your website does when somebody fills in a form.
Today, on a pixel you installed some time ago, a conversion is matched to an ad mostly through a click identifier — a tag OpenAI attaches to the link when somebody clicks your ad, so it can recognise the same person arriving on your site. When that identifier is missing, and it often is, the conversion goes unattributed. Advanced matching is the fallback: it looks for customer details typed into your forms and uses those instead.
From 17 August, that fallback is on by default on existing pixels. On pixels created after the change, it is already on from the first line of code.
The switch does not ask. It is a default, applied on a date, to a script that is already running on your site. Whoever installed the pixel is not necessarily whoever will notice.
That last sentence is the practical problem. In most small companies, the pixel was pasted in once, by a developer or an agency, during a launch week. Nobody has opened that part of the account since. A default that changes behaviour on a script nobody is watching is a governance question before it is a privacy question.
What automatic advanced matching is
Definition: automatic advanced matching is a feature of the OpenAI Pixel that detects customer information typed into forms on your website, hashes it in the visitor's own browser, and sends the hash alongside the conversion event so more conversions can be matched to ads.
OpenAI describes the purpose plainly in its developer documentation: the feature "improves website conversion measurement by helping match more conversions to your ads when a click identifier is unavailable." The same page says "the OpenAI Pixel automatically detects supported customer information entered into website forms", that "the Pixel normalizes and securely hashes this information in the browser using SHA-256 before including it with conversion events", and that "raw customer information is not sent to OpenAI through automatic advanced matching."
Two things in that description do real work, and they pull in opposite directions.
The hashing is genuine and it happens on the visitor's device. Your customer's email address is turned into a fixed string of characters before it leaves their laptop. OpenAI never receives the address as you hold it.
But a hash used for matching has to be reproducible, or it would not match anything. OpenAI documents how: the address is trimmed of whitespace and lowercased, then hashed. Follow that recipe on any system and the same address yields the same string. That is not a flaw, it is the mechanism — it is how an advertiser and a platform can work out they are looking at the same person without either saying the name out loud. A hash is not a disguise. It is a shared reference number.
Here is the analogy we use with clients, because it is the only one that has ever landed. Hashing an email is like replacing a customer's name on a file with a barcode. You have not made the customer anonymous. You have made the file easier to match against every other system that scans the same barcode.
Which fields, exactly? This is the question every client asks and it has a partial answer. For the manual version of matching, OpenAI publishes the schema: email_sha256, external_id_sha256, plus country, city and postcode. It even publishes the normalisation rule — "SHA-256 hash of the email address after trimming whitespace and converting it to lowercase". For the automatic version, the one switching on next Monday, the documentation says only "supported customer information entered into website forms". It does not list the fields.
So treat the scope as email address and similar identifiers, and do not assume a fixed list. If your forms collect something you would not want leaving the building even as a hash, that uncertainty is itself an argument for switching the feature off until the list is published.
Where OpenAI actually says this, in its own words
Most write-ups attribute the date to an email OpenAI sent advertisers in early August. That is true, and it is not the best source available. The precise version is published, and it is in the ads API reference, as a note under the boolean field automatic_advanced_matching_enabled:
Beginning August 17, 2026, new Web pixels created through the Ads API have automatic advanced matching enabled when this field is omitted. Pass false explicitly to disable it. Before August 17, the field defaults to false. Also on August 17, OpenAI will enable automatic advanced matching for all existing Web pixels created through the Ads API, unless it was explicitly disabled or the ad account opted out.
That paragraph is worth more than the email, for three reasons. It gives the exact behaviour rather than a summary: the setting was false before the date and becomes on-when-omitted after it. It confirms the retroactive part in plain language. And it names a second escape hatch nobody has been talking about — an account-level opt-out, alongside the per-pixel one.
The scope of that note is pixels created through the Ads API. For pixels created in the interface, the same date and the menu path live in OpenAI's help centre article on conversion measurement, which blocks automated readers, so we are relying on it as quoted by Search Engine Land, Search Engine Roundtable and PPC Land.
Verified by us on OpenAI's domains: what advanced matching does and how it hashes, from the measurement pixel documentation; the 17 August date, the default flip and the account-level opt-out, from the ads API reference.
Taken from the trade press: the four-click menu path in the interface, and the rest of the release — oCPC, dynamic URLs, carousels, Brazil and Mexico.
Before and after, in a table
| Behaviour | Existing pixel, before 17 August | Existing pixel, from 17 August |
|---|---|---|
| Matching a conversion to an ad | Click identifier, plus a first-party cookie | The same, plus hashed form data as a fallback |
| Reading your form fields | Off unless you built it yourself | On, automatically |
| Code changes required from you | — | None. That is the point, and the problem |
| Who decided | You, when you installed it | A default, applied on a date |
| Consent notice on your site | Whatever you wrote for the pixel | Unchanged, unless you change it |
The last row is the one that costs money later. Your cookie banner and privacy policy describe a pixel that measured clicks. From the seventeenth, on most sites, they will describe it inaccurately.
Is a hashed email still personal data under the GDPR?
If you operate in the European Union, this is the paragraph that decides your answer.
In January 2025 the European Data Protection Board adopted Guidelines 01/2025 on Pseudonymisation, and in February it published a plain-language summary of them. That summary answers the question directly: "Pseudonymised data, which can be linked back to an individual using additional information, is still personal data. This remains true when another party keeps the additional information."
Read the second sentence again with advanced matching in mind. You send a hash. You keep the plaintext email in your own CRM. The additional information that reconnects the two never leaves your building — and it does not matter, because the data is still personal data.
The same EDPB summary is helpful in the other direction too, and it would be dishonest to quote only the inconvenient half. Pseudonymisation, it says, "is a technical and organisational measure to reduce the risks for individuals and meet data protection obligations", and so "it does not need its own separate legal basis. The legal basis for the processing of the personal data extends to the pseudonymising transformation."
Put together, those two statements say something quite specific. Hashing improves your position. It does not create your position.
In practice: if your existing consent does not cover sending customer identifiers to OpenAI for conversion measurement, do not assume that hashing brings the processing inside it. The EDPB guidance gives pseudonymisation no legal basis of its own; whether yours already covers this is a separate question, and it depends on your setup, your stated purposes and the recipients you named.
We are a digital studio, not a law firm, and this is not legal advice. What we can tell you is which document to put in front of the person who does give you legal advice: EDPB Guidelines 01/2025 on pseudonymisation, and OpenAI's own description of what the pixel transmits. Those two, side by side, are a fifteen-minute conversation instead of an hour.
What you need before you decide
- Access to the ChatGPT Ads account, at a level that can edit a data source — not just read reports.
- To know whether the pixel is actually installed, and where. On many sites it went in through a tag manager, which means the person who can find it is not the person who can log in to the ads account.
- The list of forms on your site that collect an email address or a phone number. Contact form, newsletter, checkout, booking, quote request, the download gate you forgot about.
- Your current consent text, in whatever cookie tool you use, so you can see what it says today about advertising and measurement.
- A decision-maker. In a company of ten this is the owner. Say so out loud, because "the agency will handle it" is how a default becomes a surprise.
If you cannot assemble that list in fifteen minutes, that is itself the answer for now: turn the feature off, and turn it back on deliberately when you can. A default you did not choose is worth less than an attribution gap you understand.
How to turn off automatic advanced matching, in four clicks
In the ChatGPT Ads Manager, the path reported by the trade press from OpenAI's help centre is short and slightly buried:
- Open Tools.
- Go to Conversions.
- Select Data Source.
- Choose Edit pixel on the web pixel you want to change, and opt out.
Two notes from the shape of the menu rather than from the announcement. It is per pixel, so if you run several properties you will be doing this several times. And it sits under Tools rather than under privacy or settings, which is where most people would look first — budget an extra minute for hunting.
If you decide to leave it on, the work does not disappear, it moves. Verify that your consent and privacy documentation actually cover sending hashed customer identifiers to OpenAI for conversion measurement, and then test that the pixel stays silent on the reject path, not only on the accept path. Testing the accept path is the mistake we see most often; everybody clicks "agree" when they are checking their own site.
What advanced matching does not do
- It does not send OpenAI your customer list. It sends a hash, per conversion, for people who filled in a form on your site after seeing your ad.
- It does not read your ChatGPT conversations. This is a pixel on your website. It has nothing to do with what anyone types into ChatGPT itself.
- It does not improve your campaigns by itself. It improves the count. Better attribution can lead to better bidding decisions, but only if somebody acts on the numbers.
- It does not make you compliant, and it does not make you non-compliant. It changes what your site transmits. Whether that is lawful depends on paperwork you already own.
- It does not publish which form fields it reads. The manual schema is documented; the automatic detection scope is described only as supported customer information.
- It does not apply to Google or Meta. Those platforms have their own equivalents, with their own settings, which brings us to the next section.
You probably already run this, under another name
Advanced matching is not a new idea and OpenAI has not invented anything here. Meta has shipped the same mechanism in its pixel for years, under almost the same name. If you run Meta campaigns and you have never opened that setting, the thing you are being asked to decide about ChatGPT is a thing already running on your site.
That reframes the fifteen minutes. You are not auditing OpenAI. You are auditing every advertising pixel you have installed, and OpenAI just gave you a dated reason to do it. When we take over Meta Ads management for a new client, this is in the first pass, along with which conversions are even defined and whether the values attached to them mean anything. The same audit belongs in Google Ads management, where the equivalent question is enhanced conversions and who agreed to them.
taie coincidenta Google
What ChatGPT actually sent us
Now the honest part, and it is the more interesting half.
This site relaunched on 6 July 2026 and we only started working on its own search visibility deliberately on 27 July — before that, like most agencies, we were the cobbler with no shoes. So these are early numbers from a small window, and we are publishing them because the ratio is the point, not the size.
Between 13 July and 9 August 2026, from the Search Console and Google Analytics APIs on cittago.com:
| Measure | Value |
|---|---|
| Impressions for our page on ChatGPT ads in Europe | 689 |
| Clicks on it | 43 |
| Its average position in Google | 6.2 |
| Total sessions on the site, all channels | 304 |
| Sessions from Organic Search | 108 |
| Sessions attributed to the AI Assistant channel | 2 |
Two sessions. Not two percent — two sessions, out of 304. In the same four weeks in which 689 people saw a page about ChatGPT advertising in Google's results and 43 of them clicked through to read it.
Bottom line: for a European small business today, the demand to understand ChatGPT advertising is running well ahead of the traffic ChatGPT sends. The measurement infrastructure is arriving first. That is normal for a new channel, and it is exactly why a default that flips on a date deserves fifteen minutes rather than a week.
Before publishing a number this small, we went looking for a bigger one. There is no public study, with a stated method, measuring what AI assistants send to small business websites in the EU — we checked, and so did two of the research tools we use. So this is one small site's measurement standing on its own, which is exactly how we are labelling it.
If a client sent us that table we would expect them to be disappointed, so we will say the obvious thing about it. Two sessions from AI assistants is not a verdict on the channel. It is a measurement of one small site, five weeks after relaunch, in a window where the AI Assistant channel in GA4 itself is only a few months old. We will publish it again with a bigger denominator. Ask us in three to six months 😉
We have written before about the flip side of this: what is actually live for ChatGPT advertisers in Europe, and, on the organic side, how Google is pushing bidding towards signals that most small accounts cannot yet feed it. The pattern repeats across platforms. The tooling for measuring the future arrives several quarters before the future does.
The rest of the release: oCPC, dynamic URLs, carousels
Advanced matching arrived inside a larger update, and the other pieces are worth knowing about even if none of them has a date attached.
- oCPC, in beta for product feed campaigns. You keep paying per click, but the system optimises towards conversions. Existing CPC campaigns can be cloned into oCPC campaigns, including in bulk. This is the piece that needs advanced matching, or something like it, to work well — optimising towards conversions requires counting them.
- Dynamic URL parameters. Campaign, ad group and ad IDs can be appended to your landing page URLs automatically, which is how the traffic stops arriving in your analytics as an unlabelled blob.
- A multi-product carousel format in testing for product feed campaigns, letting several products appear in one ad unit at the bottom of a conversation.
- Brazil and Mexico joining the list of countries where ChatGPT Ads is available.
- Integrations and diagnostics, including Triple Whale and Hightouch, plus improved pixel diagnostics.
Four of those five are the same project: making conversions countable. The carousel is the only item on the list a customer would ever see.
The words, in a table
| Term | What it actually means |
|---|---|
| Pixel | A small script on your website that reports back to an ad platform when something happens — a purchase, a form sent, a page seen. |
| Click identifier | A tag added to the link when someone clicks your ad, so the platform can recognise that visitor when they convert. |
| Advanced matching | Using customer details from your forms as a second way to recognise the same person when the click identifier is missing. |
| Hash (SHA-256) | A one-way transformation of text into a fixed string. The same input always gives the same output, which is what makes matching possible. |
| Pseudonymisation | Processing data so it can no longer be attributed to a person without extra information held separately. Under the GDPR the result is still personal data. |
| oCPC | You pay per click; the platform bids towards conversions rather than towards clicks. |
| Attribution | Deciding which ad deserves credit for a sale. Every argument about advertising budgets is, underneath, an argument about this. |
Where you stand, in three thresholds
Threshold one — no OpenAI Pixel on your site. Nothing to do. Note the date somewhere, because the day you launch a ChatGPT campaign the feature will already be on, and the decision will be yours from minute one rather than on a Monday you did not pick.
Threshold two — a pixel installed, consent handled generically. This is most companies. Turn advanced matching off before 17 August, then decide properly. Turning it back on later costs four clicks. Explaining after the fact why your site sent hashed customer identifiers to a platform your privacy policy does not name costs considerably more.
Threshold three — a pixel, a real consent management platform, a documented lawful basis and a data protection officer who has read it. Leave it on, and use the fortnight for the useful test instead: confirm the pixel genuinely stays silent when a visitor refuses. That is the check almost nobody runs, and it is the only one that would fail in an audit.
If you land between two and three, and most growing companies do, the honest sequence is: turn it off, fix the consent text, turn it on. In that order. The attribution you lose in a fortnight on a channel sending single-digit sessions is not a number anyone will ever notice.
Questions nobody has actually asked us
Nobody has emailed us about advanced matching, because the announcement is days old and because most companies we talk to are not yet advertising inside ChatGPT. These are the questions we would have if we read the announcement cold, plus the ones that come up constantly in real conversations about pixels and consent.
Do my campaigns stop if I do nothing?
No. Nothing pauses, nothing breaks and no ad is affected. The change is entirely about how conversions get matched. If you do nothing, on 17 August your pixel starts using hashed form data as a fallback and your reporting may show slightly more conversions than before.
Does this mean OpenAI reads what people type into ChatGPT?
No, and the confusion is understandable given the name on the box. This is a script running on your own website, reading the forms on your own pages. It has nothing to do with conversations inside ChatGPT, and turning it off changes nothing about how ChatGPT handles chats.
If the data is hashed, is it still personal data under the GDPR?
Yes. The European Data Protection Board's February 2025 summary of its pseudonymisation guidelines says it directly: pseudonymised data that can be linked back to an individual using additional information is still personal data, and that stays true when another party holds the additional information. Hashing lowers your risk. It does not take the data out of scope.
Do I need new consent, or does my existing cookie banner cover it?
Ask whoever wrote your consent text, with the specific question: does the advertising purpose cover sending hashed customer identifiers to OpenAI for conversion measurement? A generic "marketing cookies" toggle written before this platform existed is a weak answer. Naming the recipient is a strong one.
Where exactly is the off switch?
In ChatGPT Ads Manager: Tools, then Conversions, then Data Source, then Edit pixel on the web pixel you want to change. It is set per pixel, so repeat it for each property you run. The path comes from OpenAI's help centre as reported by the trade press, not from the developer documentation.
What happens to conversions I already recorded?
OpenAI's API reference describes the change as enabling the setting on existing pixels from 17 August, not as reprocessing anything already recorded. Read that way, it affects how future conversion events are matched. If you leave the feature on, expect a small step change in your numbers around the seventeenth rather than a smooth line.
Is this worth the trouble if ChatGPT sends me almost no traffic?
The measurement gain is small today, which is exactly the argument for deciding calmly rather than by default. Our own site got two AI Assistant sessions in twenty-eight days. If your numbers look like ours, you are giving up very little by switching the feature off for a fortnight while you check your consent text.
My agency installed the pixel. Whose job is this?
The decision is yours, because it concerns data you are the controller of. The execution is theirs. Send them one email asking two things: is advanced matching on or off on our pixel as of today, and does our consent text name OpenAI. An agency that cannot answer both within a day has told you something useful.
Does Meta or Google do the same thing?
Both have equivalents. Meta has had advanced matching in its pixel for years; Google's counterpart is enhanced conversions. If this announcement is the first time you have thought about the mechanism, the honest conclusion is that you have two more settings to look at, not one.
What would you do if it were your account?
Turn it off this week, because the fortnight costs us nothing measurable. Use the time to write a consent purpose that names the platform. Then turn it back on, deliberately, with a note in the account of who decided and when. Every part of that takes less time than the meeting about it would.
Last updated: 10 August 2026. OpenAI's ads API reference states that from 17 August 2026 automatic advanced matching is enabled by default on new web pixels created through the API, and switched on for existing ones unless explicitly disabled or the ad account has opted out. The mechanism is documented on OpenAI's developer site. The four-click path in the interface comes from the help centre as quoted by the trade press. We update this page when either changes.
