ChatGPT now holds a standing subscription to your credit file — and the Privacy Center that shipped the same day changes none of your settings

What shipped

Finances in ChatGPT is not new. OpenAI launched it to Pro users in May 2026 and extended it to Plus by 25 June 2026 — a dashboard of connected accounts, spending breakdowns, and questions answered against a user’s own financial context, with bank connections running through Plaid.

What was added on 21 September 2026 is a separate connection, to a different kind of data.

A US Plus or Pro subscriber can now ask ChatGPT to connect their credit score. The flow hands off to an Experian identity-verification form; Experian collects the verification details in its capacity as OpenAI’s service provider, and OpenAI receives the connection status plus whatever credit data the user authorises Experian to release. What comes back is an Experian-based VantageScore 3.0, a credit report that updates monthly, and optional monitoring alerts flagging a new inquiry, a new account or a new address.

Three operational details that are easy to miss:

• It is a soft inquiry. Checking the score through this connection does not affect the score.
• It is independent of Plaid. Connecting bank accounts does not connect credit, and connecting credit does not connect bank accounts.
• Alerts and connection are separate switches. Credit alerts can be turned off in notification settings while the Experian connection remains live and the score continues to refresh monthly.

The feature is US-only, on Plus and Pro, and rolling out gradually.

The part that is genuinely new

Credit monitoring is a commodity. Experian sells it directly, card issuers hand it out free, and there is nothing remarkable about a consumer seeing a VantageScore on a dashboard.

What is new is the terminus of the feed. This is not a one-time score lookup. It is a standing, authorised, monthly-refreshing connection between a credit bureau and a general-purpose conversational assistant — one that maintains memory across sessions, runs personalisation, and operates an advertising business.

Each of those three things is fine in isolation and each has its own controls. The configuration is what deserves attention, because credit standing is not ordinary personal data. It is close to the highest-intent commercial signal that exists about a consumer: it predicts who is about to borrow, who is about to be declined, who is shopping for a card, and who can be sold a refinance. Lenders pay a great deal for weaker versions of it.

And ChatGPT already has the other half of that transaction wired in. Experian has spent 2026 building a financial marketplace inside the product: an insurance marketplace in February, a personal loans app in June, and on 27 August 2026 an Experian Credit Cards app for conversational card discovery — browsing offers from Experian’s partner network, comparing annual fees, bonuses, rewards rates and APR ranges, with the app directing users to offers “that match their Experian credit profile” before handing off to Experian’s site. Experian’s executive VP of product for consumer services, Debbie Hsu, framed it as consumers expecting “financial experiences to be as intuitive as the technology they use every day.” Separately, Experian and OpenAI launched the UK’s first credit score app inside ChatGPT, with a postcode-based score comparison tool.

So as of this week the same conversational surface holds: your credit score, your credit report, a monthly refresh of both, alerts when either moves, a marketplace of credit products matched to your file, and an advertising system.

None of that is an allegation. OpenAI’s stated position on its advertising business is that advertisers receive none of the underlying material — no chats, no chat history, no memories, no personal details. That is OpenAI’s claim and it cannot be verified from outside, which is the appropriate way to report it. The point is structural: this is now the architecture, and architectures outlast the policies written over them. The EEA consent-or-pay structure for ChatGPT ads exists because European regulators reasoned the same way about a smaller data set.

The asymmetry in the off switch

The detail with the most practical consequence is in the disconnection behaviour.

Disconnecting Finances removes synced account data from OpenAI’s systems within 30 days. It does not automatically delete relevant information already contained in conversation history.

That is a reasonable engineering outcome and a poor mental model for a user. The integration is revocable. The conversation is not — not by the same action, anyway. Every thread in which a score, a balance, a delinquency, a dispute, a declined application or a debt figure was discussed persists after the connection is severed, in the store that memory and personalisation draw from.

This is the same shape of problem as self-written compaction summaries becoming an untrusted memory channel: the durable artefact is the text the model wrote about the data, not the connector that supplied it. Revoking the connector is the visible, satisfying action. Clearing the text is the one that matters, and it is a separate, manual job.

The same logic applies to how a system of record behaves once an assistant is allowed to read it, which is why the read-only boundary on OpenAI’s Epic EHR connector was the most important line in that announcement. Read-only limits what the assistant can change upstream. It does nothing about what the assistant writes downstream, into a chat log.

The Privacy Center, on the same day

OpenAI also announced a Privacy Center in the ChatGPT release notes on 21 September 2026. It lives at chatgpt.com/privacy-center, reached on the web through the account menu under Help and on mobile under Settings, and it reached Free, Go, Plus, Pro and Business accounts. It gathers seven privacy topics — running from memory to advertising to account deletion — with a Manage control on each, so the whole set can be walked top to bottom in one pass.

Notebookcheck’s coverage put the limitation in its headline: the privacy center changes none of your settings. That is accurate and not a criticism. A navigation improvement is a navigation improvement. Anyone who opens it expecting defaults to have been tightened will find their account exactly as they left it.

The timing is what makes it worth a paragraph. OpenAI made its privacy controls substantially easier to find in the same release notes entry that connected ChatGPT to a credit bureau. Whether that is coordination or coincidence, the practical instruction is identical: the controls are now findable, the most sensitive data class yet is now connectable, and walking the seven topics has more value this week than it did last week.

What this changes for buyers

Treat the score as informational, because it is. VantageScore 3.0 runs 300-850 and was built jointly by Experian, TransUnion and Equifax. Some lenders use it; many use FICO models, frequently against a different bureau’s file. The number in ChatGPT is a useful trend line and a poor predictor of approval, rate or limit. Alerts work the same way: a new-inquiry flag is a prompt to open the report, not evidence of fraud.

Assume the conversation is the record. Anything typed into a thread about credit outlives the connector. For individuals that means treating credit conversations as durable and deleting them deliberately. For anyone thinking about assistant data governance generally, it is the clearest available example of why connector-level revocation is not data deletion — a distinction that also governs Claude, Gemini and every other assistant with memory, and one that the assistant shortlist does not capture in any feature grid.

Write the policy before someone connects it. This is a consumer feature on personal Plus and Pro subscriptions, which means it will appear on managed devices without passing through any administrative control. The workable response is an acceptable-use line naming personal ChatGPT subscriptions as an unmanaged data path, not an attempt to block one feature. Small business operators running personal subscriptions across a team have the least separation between the two and the most to gain from writing it down.

Price the privacy posture alongside the capability. Assistant selection has generally been argued on capability and price — the axis Claude and ChatGPT and Gemini and ChatGPT are usually compared on. Data surface is now a third axis with real variance between vendors, and it moves faster than capability does. A model’s benchmark score is stable for months. A product’s connector list changed twice this week.

Watch the direction, not the feature. February insurance, June personal loans, 25 June Plus rollout of Finances, 27 August credit cards, 21 September the credit file itself. That is a consistent eight-month build toward a financial-services surface inside a general assistant, and the next entries in the sequence are predictable enough to plan for rather than react to.

The verdict

The credit score is the least interesting thing OpenAI shipped on 21 September. It is a commodity number, from a model most lenders do not use, behind a soft inquiry that costs nothing.

What shipped underneath it is a permanent, authorised pipe from a credit bureau into a conversational product with memory, personalisation, an advertising business and a partner-offer marketplace attached — and an off switch that closes the pipe while leaving everything the model already wrote about the contents of the file exactly where it is.

OpenAI has said the right things about what advertisers receive, and there is no reason today to doubt them. That is a statement about current policy. The architecture is the thing that will still be there when the policy is next revised, and this week the architecture acquired your credit report.

Questions or corrections? Email Pick Right. Want the full list? See all news.