Consent and the OpenAI Pixel: GDPR, UK GDPR and India's DPDP

Last verified: 12 September 2026 | Version: 1.0 | Next scheduled review: 12 October 2026

The short version: you are the controller, the legal basis is yours to establish, and OpenAI's own contract says so. The Ad Tools Data Processing Addendum, effective 19 August 2026, sets OpenAI and the customer as independent controllers for most processing, with a narrow processor relationship only for what it calls Restricted Processing.

This is not legal advice. The section at the end says so properly.

Who is controller and who is processor

This is the provision that determines everything downstream, and it is the one most advertisers assume the opposite of.

Independent controller status means OpenAI is not processing your data solely on your documented instructions. Each party determines its own purposes for the data it holds. Practically, that removes the mental model many advertisers carry over from a straightforward processor arrangement, where the vendor's compliance posture does a lot of work on your behalf. Here it does considerably less.

For transfers, the DPA routes EEA and Swiss data through OpenAI Ireland Limited, and UK data through OpenAI OpCo, LLC using the UK Standard Contractual Clauses, with Module One, controller to controller, applying to independent controller processing, governed by the law of England and Wales. Sub-processors are listed at OpenAI's ad tools sub-processor page.

What the advertiser is contractually promising

The Ad Tools Terms, published 24 August 2026, put the representation in plain language: the advertiser has provided all required notices and has obtained and will maintain all rights, consents, permissions and legal bases required to collect, use, share and provide audience data to OpenAI.

Three further obligations sit alongside it.

First-party data only. Data must be collected directly from your own users. A service provider may process or match it, but cannot be its original source and cannot add third-party enrichment.

Prohibited Data must not be sent. The terms name health information, sexual orientation, race or ethnicity, religion, financial distress, genetic data, disability status, and data relating to children. This list maps closely onto special category data under Article 9 of the GDPR, plus financial distress, and it is stricter than a general GDPR analysis would be, because it is an outright contractual prohibition rather than a heightened-condition requirement.

Honour withdrawals by stopping the flow. Where a user withdraws consent or opts out, the advertiser must cease providing the affected personal data. There is no documented suppression signal you send to OpenAI to accomplish this. You stop sending.

That last point has a practical consequence. If your consent management platform blocks the pixel client side but your server-side Conversions API integration continues to post events for the same user, you have a gap, and the contract puts it on your side of the line.

Consent mode style handling, and what is missing

Advertisers coming from Google Ads are used to a consent signalling framework: a documented set of parameters passed with each call, telling the platform what consent state applies, with modelled conversions filling the gap.

OpenAI publishes no equivalent as of 12 September 2026. There is no documented consent parameter, no consent mode, and no published modelling behaviour for unconsented traffic. What the contract requires instead is simpler and blunter: do not send the data.

That leaves the implementation pattern to you, and the defensible one is a hard gate.

1. Category the pixel correctly. It is advertising or marketing, never strictly necessary and never functional. Any consent management platform that classifies it as necessary is misconfigured.
2. Gate loading, not just firing. The tag should not load before consent. A loaded tag that is instructed not to fire still executes third-party code in the user's browser.
3. Gate the server side with the same signal. The Conversions API is the more common failure point because it sits outside the browser and outside the consent management platform's natural control. Your event pipeline needs to carry a consent flag through to the point of dispatch and drop the event if it is absent.
4. Log the consent state with the event, not separately. If a supervisory authority asks you to evidence the basis for a specific transfer, a timestamped consent record joined to the event is the answer. A general statement that you use a consent platform is not.
5. Re-check on every consent platform change. Tag categorisation is the thing that silently regresses.

The three regimes, and where they differ

EU GDPR. For the pixel itself, the first hurdle is not GDPR but the ePrivacy Directive as implemented nationally, which requires consent for storing or accessing information on a user's device for advertising purposes regardless of the GDPR basis. Then GDPR applies to the processing that follows. The independent controller structure means you cannot rely on OpenAI's basis for the processing OpenAI does for its own purposes, and OpenAI cannot rely on yours.

UK GDPR. Substantially the same analysis, with PECR in place of the national ePrivacy implementation. The DPA's own routing is the notable operational detail: UK data goes to OpenAI OpCo, LLC under the UK SCCs, so a UK advertiser is making a restricted transfer to the US and should have the transfer risk assessment that sits behind that, not just the clauses.

India's DPDP. Different in ways that matter and easy to get wrong by analogy. The Digital Personal Data Protection Rules were notified on 13 November 2025, with substantive compliance obligations phased, and the full compliance date reported as 13 May 2027. Two differences stand out for advertisers. India's Act does not recognise legitimate interest as a lawful basis in the way GDPR does, which removes a fallback some ad tech relies on. And tracking, behavioural monitoring and targeted advertising directed at children are prohibited, with anyone under 18 treated as a child and verifiable parental consent required.

There is a second-order point for India that is easy to miss. ChatGPT Ads advertiser account eligibility follows the country of business registration, and India is on neither the serving market list nor the advertiser eligibility list as of September 2026. An India-registered entity is more likely to encounter these questions as the parent of a foreign subsidiary that holds the ad account than as a direct advertiser, which makes the intra-group data flow the thing to document.

What we cannot tell you

• Whether OpenAI will publish a consent signalling framework. Nothing equivalent to consent mode is documented, and nothing is on a published roadmap.
• Exactly what the pixel writes to the browser. No public technical reference lists the cookies, storage keys, lifetimes or payload fields. The DPA describes categories of data, not implementation.
• How the independent controller structure will be assessed by a supervisory authority. No EU or UK regulatory decision addresses OpenAI's ad tools as of September 2026.
• How DPDP will treat this in practice. Substantive obligations are still phasing in ahead of the reported May 2027 date, and there is no enforcement history for advertising pixels under the Act.
• Whether consent rates materially change ChatGPT Ads reported performance. There is no modelling disclosure and no advertiser has published a consented versus unconsented comparison.

Quick answers

Who is the controller for ChatGPT Ads conversion data? OpenAI's Ad Tools DPA, effective 19 August 2026, sets OpenAI and the customer as independent controllers for most processing. The customer is controller and OpenAI processor only for Restricted Processing, meaning audience matching and opt-out data.

Do I need consent before firing the OpenAI pixel in the EU or UK? For an advertising pixel, the device-access consent requirement under ePrivacy and PECR applies before the GDPR basis question is reached. Treat consent as required and gate loading, not just firing.

Is there a consent mode for ChatGPT Ads? No. OpenAI publishes no consent signalling parameter or modelling behaviour as of 12 September 2026. The contractual obligation is to stop providing the data where consent is withdrawn.

What data am I not allowed to send? The Ad Tools Terms name health information, sexual orientation, race or ethnicity, religion, financial distress, genetic data, disability status and children's data as Prohibited Data. Data must also be first-party, with no third-party enrichment.

Does the Conversions API need consent handling too? Yes, and it is the more common gap. Server-side events sit outside the browser consent platform, so the consent flag has to travel through your event pipeline to the dispatch point.

What is different about India's DPDP? The Rules were notified on 13 November 2025 with full compliance reported for 13 May 2027. There is no legitimate interest basis, and targeted advertising to anyone under 18 is prohibited with verifiable parental consent required.

This is not legal advice

Everything above is a reading of published contractual documents and regulations, written by a paid media team, not by lawyers. It is not legal advice and it is not a compliance assessment of your implementation. Data protection outcomes turn on facts we do not have: your data flows, your consent platform configuration, your establishment, your sector and your national implementation. Have a data protection lawyer review any specific implementation before it goes live, and have them read the Ad Tools DPA and Ad Tools Terms directly rather than this summary of them.

Sources

Related reading

• Setting Up the OpenAI Pixel
• The ChatGPT Ads Conversions API
• ChatGPT Ads in India and the UAE
• ChatGPT Ads Eligibility: Who Can Actually Buy
• The Nine Questions Enterprise Procurement Asks Before Approving ChatGPT Ad Spend

Changelog

12 September 2026, v1.0. First publication. Records the independent controller structure in OpenAI's Ad Tools DPA, the Prohibited Data list, the absence of any consent signalling framework, and the DPDP divergences.

Field kit

Tools

• Eligibility Checker
• Budget Calculator
• OAI-AdsBot Checker
• Context Hints Generator
• Buy Scorecard

Site

• ChatGPT Ads
• Google AI Mode Ads
• Methodology
• Glossary
• Contact

OpenAI (primary)

• ChatGPT Ads Help Center
• Ads in ChatGPT: The Basics
• Measure Results
• Ad Policies
• Ads Manager
• OAI-AdsBot verification