A customer list sitting in your CRM is not automatically an advertising audience. The upload button does not settle the question.
OpenAI now documents how advertisers can build ChatGPT custom audiences from email addresses, phone numbers, hashed identifiers, and Google Advertising IDs. Those audiences can limit delivery, exclude people, or change bids. A marketing manager can turn a familiar CSV into a new targeting control pretty quickly.
The useful pause comes one step earlier. Why is each person on the list? What were they told? Who should be removed? How will the list stay current after somebody buys, opts out, changes roles, or asks to be left alone?
OpenAI’s custom-audience documentation tells advertisers to use only first-party data they have the right to use for ads, reject broker-sourced data, confirm the required notices and permissions, and obtain privacy or legal approval for the use case. That is a solid platform rule. Your company still has to prove it can follow it.
A clean CSV can still contain a dirty decision.
1. Name the list without using marketing fog
“High-value audience” sounds tidy. It says almost nothing.
Write a plain-language definition that another person could reproduce. For example: customers in Wisconsin who completed a purchase during the past 180 days, have not requested marketing suppression, and are eligible for the product in the campaign. State the source systems and the date the list was pulled.
Then keep four groups separate:
- Customers: people with a completed transaction or signed engagement;
- Prospects: people who asked for information or entered a documented sales process;
- Subscribers: people who chose to receive a specific kind of communication;
- Purchased or appended contacts: records acquired from somebody else.
Do not mix those groups because the spreadsheet has the same columns. OpenAI expressly says not to upload broker-sourced data. Even among first-party records, a newsletter subscription, event registration, donation, job application, and customer account can carry different expectations and restrictions.
SigServe’s tracking-plan audit uses the same discipline: document what the data system actually does, then compare it with the promise a person saw. A privacy-policy link in the footer cannot rescue a list nobody can explain.
2. Build the exclusion list before the inclusion list
Marketers love inclusion. Who can we reach? Start with the less glamorous question: Who should never receive this campaign?
Your suppression rules may include:
- people who opted out of the relevant marketing;
- current customers who already bought the promoted service;
- employees, vendors, test accounts, and agency staff;
- complaints, disputes, fraud flags, and do-not-contact records;
- ineligible regions, ages, professions, or account types;
- records collected for a purpose that does not fit this ad use.
OpenAI allows advertisers to use custom audiences for inclusion, exclusion, or both. Its Ads Manager instructions say exclusions take precedence when both are used. Small ready audiences can be used only for exclusion, while inclusion requires at least 25,000 matched users.
That makes suppression a practical starting point for many professional-services firms and nonprofits whose entire usable database may never reach the inclusion threshold. Excluding existing clients from a broad acquisition campaign can be useful. Pretending a 9,000-name file is an account-based targeting plan will not make the match pool larger.
3. Do the audience math before promising a campaign
The public planning threshold is 25,000 matched users for inclusion targeting and bid adjustments. Uploaded rows are not matched users. Invalid addresses, duplicates, formatting problems, and identifiers without a corresponding ChatGPT account reduce the usable audience.
So a spreadsheet with 25,001 rows is not ready. Neither is a file assembled by piling old lists together until the row count looks respectable.
Make a small forecast:
- Count the raw records.
- Remove suppressions, duplicates, stale records, and ineligible sources.
- Estimate a conservative match range instead of assuming every identifier will match.
- Check whether the remaining audience is large enough after campaign exclusions.
- Write down the fallback if it is not.
The fallback might be broader contextual targeting with customer suppression. It might be a different paid channel. It might be no campaign. Good media planning includes the last option.
4. Treat hashing as formatting, not permission
OpenAI accepts raw email and phone fields or SHA-256 hashes of normalized email addresses and phone numbers. The technical instructions are specific about lowercasing emails, using E.164 phone formatting, and submitting a 64-character hexadecimal digest.
Hashing reduces exposure during matching. It does not change how the record was collected, whether the ad use is allowed, or whether the person should be suppressed. A hashed address from a purchased list remains a purchased-list problem wearing a nicer coat.
Keep the permission review outside the upload file. Your record should include:
- audience name and business purpose;
- source systems and extraction query;
- inclusion and exclusion rules;
- notice or consent relied upon;
- privacy or legal approver;
- file owner, upload date, and campaign IDs;
- next refresh and deletion date.
OpenAI says uploaded audience files are deleted after processing, usually within 24 hours. Your exported copy, download folder, shared drive, email attachment, and agency handoff do not disappear with it. Decide where the working file may live and who removes it.
5. Give the audience an owner after launch
Customer status changes. Suppression status changes faster.
OpenAI’s API supports adding, removing, replacing, and merging audience membership. The distinction matters. An add file only adds. A remove file only removes. A replace operation uses a complete snapshot. If nobody owns that choice, yesterday’s eligible prospect can become today’s annoyed customer who keeps seeing an acquisition offer.
Put one person on the calendar for three jobs:
- Refresh: rebuild the audience from the documented query on a defined schedule;
- Suppress: remove opt-outs and other exclusions on a faster schedule when needed;
- Reconcile: confirm the live campaign references the intended audience and the last operation finished successfully.
“Ready” means the platform processed the audience. It does not mean the source was appropriate, the campaign is sensible, or the audience is eligible for every use. OpenAI’s API documentation also notes that campaign eligibility is checked again when settings are saved. Capture the final status instead of treating an accepted upload as success.
6. Measure the decision, not the novelty
ChatGPT ads can use the context of a current conversation, advertiser inputs, and, when personalization is enabled, selected signals from a user’s broader ChatGPT experience. OpenAI says advertisers do not receive chats, memories, names, email addresses, or sensitive information from ChatGPT. The ad still sits in a place people may use for personal decisions, so creative restraint matters.
Keep the test plain:
- one audience with a documented reason to exist;
- one exclusion rule that prevents obvious waste or friction;
- one offer matched to what the business actually knows about the list;
- one primary conversion and one quality check after conversion;
- a spend cap and a date for the keep, revise, or stop decision.
Use SigServe’s general ChatGPT ads reality check for the channel-level questions: reachable users, landing-page fit, conversion tracking, and comparison with existing media. This customer-list audit answers the narrower question that comes first. Should this data become an ad audience at all?
The pre-upload signoff
Before anyone opens Ads Manager, get five lines in writing:
- Source: We can reproduce where every included record came from.
- Permission: We documented why this ad use is allowed and who approved it.
- Suppression: We removed the people and records that should not be used.
- Operation: We named the owner, refresh method, status check, and deletion date.
- Decision: We defined the spend cap, result, quality check, and stop date.
If one line is blank, stop. The platform can wait. Your customers already gave you the harder thing to replace.
Can your customer list survive the five-line signoff?
SigServe can help you define the audience, document the exclusions, tighten the campaign brief, and build a test that protects the customer relationship.