Wired has reported that OpenAI enabled marketing cookies by default for free ChatGPT users, a settings change that reveals more about the commercial pressures facing free AI products than it does about any single privacy decision.
The specific finding is that free-tier ChatGPT users in the United States are being tracked by marketing cookies that are enabled without requiring affirmative opt-in, with the option to disable them available in settings but not surfaced prominently during normal use. Paid ChatGPT Plus subscribers appear to be treated differently, with less aggressive default tracking, which creates a two-tier data relationship that mirrors the freemium architecture of advertising-supported consumer internet products rather than the essential infrastructure positioning OpenAI has cultivated in its public narrative.
The geographic distinction matters for understanding the regulatory exposure. In the European Union, GDPR's consent requirements mean that pre-ticked marketing cookie boxes are not lawful, and regulators in Germany, Ireland, and France have been actively enforcing against exactly this kind of default-on consent architecture. The U.S. has no equivalent federal standard, which is why the behavior Wired documented appears to be U.S.-focused in its implementation. That jurisdictional split is a familiar pattern from the social media industry's regulatory history, and it tends to end with the stricter standard eventually applying more broadly as enforcement catches up.
OpenAI's cost structure is not a secret. Running frontier AI models at the scale ChatGPT operates requires compute expenditure that the current subscription revenue base does not fully cover. The company has been explicit about the gap between its revenue and its operating costs, and it is raising capital at a pace that reflects the reality that free AI services at massive scale are expensive to sustain. The move toward advertising-adjacent data collection is a logical response to that financial reality, even if it sits awkwardly alongside the company's positioning as a responsible AI developer building beneficial technology.
The data categories that marketing cookies typically touch include browsing behavior, session patterns, interaction frequency, and referral sources, none of which are as sensitive individually as the conversation content itself, but which collectively build a behavioral profile that has commercial value in targeted advertising and partnership contexts. OpenAI has not disclosed a specific advertising product, and marketing cookies can serve purposes beyond direct ad targeting, including analytics partnerships and attribution for enterprise sales. But the infrastructure being built by enabling those cookies by default is the same infrastructure that advertising businesses depend on, and the direction of travel is difficult to misread.
The paid-versus-free distinction is particularly worth examining for what it reveals about the business logic. If marketing tracking were purely about improving the product experience, there would be no obvious reason to apply it differently to paying and non-paying users. The differential treatment suggests the tracking is primarily commercial rather than technical in its purpose, which is exactly the kind of two-tier data arrangement that regulators in the EU and UK have been scrutinizing in social media platforms for years.
Whether privacy concerns create a real market opening for competitors
The consumer AI market is still early enough that trust architecture decisions made now will compound over time in ways that are difficult to reverse. Google spent years building an advertising business on behavioral data from free services before the regulatory and public trust costs of that model became fully apparent. OpenAI appears to be moving toward a version of the same architecture at a moment when users are more informed about data collection practices, regulators are more prepared to act, and the competitive alternatives to ChatGPT are more capable than Google's early advertising competitors were.
That combination creates a genuine opening for AI products positioned explicitly around privacy as a feature rather than a compliance obligation. Local AI models that run on-device without sending conversation data to external servers, enterprise-first products with contractual data handling commitments, and paid-only services that do not depend on behavioral data monetization all occupy positions that become more attractive as free AI's data practices become more visible. Mistral's European positioning and its emphasis on data sovereignty has already attracted enterprise customers for whom the provenance and handling of their data is a procurement criterion rather than an afterthought. Apple's on-device AI processing, which it has been expanding through its Apple Intelligence features, is another expression of the same competitive positioning, and it comes with the distribution advantages of the world's largest consumer device installed base.
The practical implication for founders is straightforward. The market segment of users and organizations that actively value data minimization is not the largest segment of the AI market, but it is the segment with the highest willingness to pay for a product that takes that preference seriously. A free product that tracks behavior and a paid product that does not is a business model that has worked in adjacent markets because it correctly identifies that privacy-sensitive users will pay a premium to avoid being the product. The question is whether the AI product quality of privacy-first alternatives is compelling enough to make the trade-off worth it for enough users to build a sustainable business around. Right now, that quality gap is closing faster than most of the large platforms appear to have anticipated.
Also read: A dark-money campaign is allegedly paying influencers to frame Chinese AI as a national security threat and the beneficiaries are worth examining • ByteDance Is Building Drug Discovery AI and It Is Presenting at the World's Best Science Conferences • Google told employees it is proud of its Pentagon AI contract and the era of internal veto power over defense deals is effectively over
