ChatGPT Ads Now Runs From Inside HubSpot and Shopify: The Governance Questions Come First

OpenAI has named HubSpot as its first CRM partner and Shopify as its first ecommerce partner for ChatGPT Ads. In HubSpot, a customer can connect a ChatGPT Ads account and create campaigns, track performance and follow up on leads without leaving the CRM. In Shopify there is a dedicated app: it syncs the product catalogue, builds ads from it, runs campaigns using a Shopify pixel and conversion events, and reports back in the Shopify admin. The app went live for US merchants on 3 September and became available internationally on 23 September, across the markets where ChatGPT Ads operates.

Framed as a convenience story this is unremarkable — one more place to buy one more thing. Framed as an operating change it is the most significant thing to happen to small and mid-market media buying this month, because it moves the act of spending money out of an advertising platform and into the two systems where the client's own team already works.

What changes when the buy button is in the store

Media buying has traditionally required a deliberate act: someone logs into an ads platform, and that login is a control point. It is where access is granted, where naming conventions are enforced, where a second pair of eyes exists, and where an agency's process lives.

An ads app inside Shopify removes that step for anyone with admin access to the store. The person who edits product descriptions can now launch a campaign against those products, and the campaign inherits the catalogue and the pixel automatically. That is genuinely useful for a merchant with no agency. For a client with an agency, a retainer and a media plan, it is a second buying path that nobody designed.

The permissions question is a data-protection question

The Shopify app's access scope covers customer data — names, email addresses, IP addresses, browsing behaviour and product information — and the ability to edit marketing events and pixels. Nothing about that is unusual for a commerce integration, and all of it is necessary for the features described. It is still a transfer of personal data to a new processor, and for clients in the EU and the UK it belongs in a records-of-processing entry and a data processing agreement before it belongs in a campaign.

• Confirm who the controller and processor are for data the app receives, and whether your existing agreements cover it.
• Check that the consent state captured on the storefront actually governs what the pixel sends. An app installed in an admin panel does not inherit the consent logic your developers built into the theme unless someone verifies that it does.
• Record the install date. A data flow that started on an unknown date is the hardest kind to answer questions about later.

What OpenAI has not published

Four things remain unstated, and each one matters more to a buyer than the integrations do: how Sponsored Agent activity is measured, how it is priced, what advertisers can see of the conversations their ads appear in, and which model powers the agents. Those are not small omissions. They are the entire basis on which a media buyer would decide what this inventory is worth.

So the honest budget position is the one we set out when the ad format itself was announced: treat it as a test with a ceiling, not as a line in a media plan. An environment whose pricing model and reporting are undocumented cannot be planned against, however easy it has become to buy.

The incentive to notice

OpenAI and HubSpot are running a joint promotion with an end date at the end of September, combining discounted HubSpot seats with a match on new ChatGPT Ads spend. Spend-matching offers are effective precisely because they move a decision forward, and a decision moved forward is a decision made with less diligence. If a client raises it, the useful response is not to dismiss it but to separate the two questions: whether the tooling is right for them, and whether a deadline is a reason to answer that this week.

Where this is genuinely good news

Two groups benefit without much caveat. Merchants with no agency and no media buyer get a competent default: catalogue-driven ads, a pixel installed correctly, conversion reporting in the place they already look. That is a better starting position than most such businesses reach on their own.

And B2B teams running HubSpot get something structurally interesting — campaign creation, lead follow-up and closed-won analysis in the same system. The reason attribution arguments are endless is usually that the ad platform and the CRM disagree and neither can see the other. A campaign created in the CRM, against contacts the CRM owns, closes that gap by construction. Whether the numbers that emerge are correct is a separate matter, and one we have written about at length in the context of measuring marketing in an AI attribution world.

A short checklist for the next fortnight

1. Inventory Shopify and HubSpot admin access for every client account you are responsible for.
2. Agree in writing who may install an ads app and who must be told when one is installed.
3. Add ChatGPT Ads spend to your reporting template now, with a zero in it, so the first spend appears rather than hides.
4. Confirm the data-protection paperwork covers the integration before the first campaign, not before the first audit.
5. Keep the budget for it inside a test allocation until measurement and pricing are documented.

None of this is a reason to stay out. It is a reason to arrive in order: permissions, paperwork, reporting, then spend. The platforms have reversed that sequence by making spend the easiest step, and the discipline has to come from the buyer because it is no longer built into the tooling.