Published on Mar 12, 2026
Adtech startup Thrad.ai claims to serve millions of ads daily for Fortune 500 brands across a global network of AI publishers, as chatbots like OpenAI’s ChatGPT begin to experiment with in-chat advertising to users.
But targeting users with ads based on their conversations with chatbots raises a myriad of privacy concerns and could run afoul of state privacy and consumer protection laws, especially when such conversations revolve around sensitive topics like health conditions, experts told The Capitol Forum.
Since The Capitol Forum reached out to Thrad on March 5, the company appears to have removed at least eight “case studies” from its website which detailed relationships Thrad purportedly had with companies including Hims & Hers Health (HIMS), MongoDB (MDB), Tripadvisor (TRIP), and OpenAI.
In one of the since-removed studies, Thrad claimed that it helped Hims launch a campaign to “place their telehealth programs directly inside the conversations where people are already confronting their most personal health concerns.” According to the study, when a user asks an AI chatbot for help with weight loss, hair loss, or sexual health issues, a Hims advertisement will pop up in response to certain “contextual triggers” within the conversation.
When contacted by The Capitol Forum about the Thrad campaign, a Hims & Hers spokesperson said in an email that “Hims & Hers does not have any agreement or professional relationship with Thrad, and we never authorized or approved the ad campaign or placements described in their recent case study. Upon learning of this, our legal team immediately contacted Thrad to ensure the case study was removed.”
“We take patient privacy and data security extremely seriously,” the spokesperson added. “Every third-party vendor we contract with must pass rigorous legal, security, and AI safety reviews to ensure full compliance with our privacy policy and all applicable laws.”
Thrad CEO Andrea Tortella spoke with The Capitol Forum on background but did not respond to subsequent requests for comment for this story.
The Capitol Forum also reached out to MongoDB, Tripadvisor, and OpenAI last week about their respective case studies, in which Thrad claimed to be promoting their brands or, in the case of OpenAI, displaying ads through a custom GPT. Tripadvisor declined to comment and MongoDB did not respond to requests for comment.
An OpenAI spokesperson told The Capitol Forum that the company does not have an agreement in place with Thrad and took action after determining the GPT that Thrad had written its case study about had violated OpenAI’s policies.
In the study, which has also been taken down, Thrad claimed that Bookwire, a German digital publishing firm, had used its services to deploy ads on Books GPT, a customized version of ChatGPT that provides book recommendations and was previously featured on OpenAI’s GPT Store. As of Wednesday, the GPT no longer appears to be available online.
Even if some of its case studies may never have occurred, Thrad’s business model serves a cautionary tale for adtechs and brands considering advertising inside of chatbots, experts said.
“It would be foolish for AI companies to push this kind of advertising into users’ sensitive conversations,” F. Mario Trujillo, senior staff attorney at the Electronic Frontier Foundation, told The Capitol Forum in an email. “Whatever value users get from talking to an AI chatbot about personal or health information, it would be gone if those chats are then used to sling ads. You can’t chat honestly with a tool you don’t trust.”
Lori B. Andrews, a professor and current director of Illinois Tech’s Institute for Science, Law, and Technology, said she believes displaying ads next to health advice is particularly problematic “because health chatbots are given more credibility than healthcare professionals and because they become such a big part of one’s life that people are willing to do what they’re told, and they’re not being presented with options of other types of products.”
Hims case study says ads can target individuals expressing “personal concerns.” In its now-removed case study for Hims, Thrad said it relies on “contextual triggers” within chatbot conversations to display ads for three distinct health verticals: weight loss, hair loss, and sexual health.
“The challenge in 2026 is reaching people at the right moment,” the case study said while explaining what makes chatbots a particularly valuable ad channel for a telehealth company like Hims. “People dealing with these concerns don’t always search for telehealth platforms right away. They often start somewhere more private and more immediate: an AI assistant. They ask ‘how do I actually lose weight,’ or ‘is my hair loss reversible,’ or ‘what causes erectile dysfunction and what can I do about it.’”
According to the study, Thrad gives brands the ability to “show up in those moments” and display an in-chat ad card during a “a natural pause in the health conversation, once the user has received information and is at the point of thinking about what to actually do.”
Healthcare marketers frequently rely on proxy audiences like caretakers or audiences with “interests” in specific health conditions—rather than saying they’re targeting patients themselves—to avoid legal scrutiny, as The Capitol Forum has previously reported. But Thrad claims it “identifies users who are in the middle of health-related conversations that signal a personal concern, not academic curiosity.”
In contrast to the kinds of health-related ad targeting promoted by Thrad, OpenAI said in a February 9 blog post that ads shown as part of its ongoing test program are “not eligible to appear near sensitive or regulated topics like health, mental health or politics” on ChatGPT.
“There’s something to me about the just really nefarious nature of advertisements in chatbots, when people are using them and they feel a sense of trust,” Sara Geoghegan, Senior Counsel at the Electronic Privacy Information Center (EPIC), said. “It’s especially nefarious that under that guise, you’re even more susceptible to buying a product for more money or a product you don’t need at all.”
Thrad claims to reach “millions of active users” with ads through platforms like DeepAI. Thrad claims on its site to be the “World’s First SSP [supply-side platform] for LLMs,” creating bidding infrastructure to connect ad space in AI conversations with “brand, agency, and programmatic demand, so every eligible interaction can become high-value inventory.”
The company further claims that it serves ads to millions of active chatbot users, can achieve an unparalleled click-through rate (CTR) of up to 15%, and has no minimum ad spend—enabling potential advertisers to sign up in seconds.
While Thrad didn’t respond when asked about the full range of chatbots or AI apps on which it runs ads, on February 2 it announced a “global strategic partnership” with DeepAI, a creative AI platform that lets users generate images and videos and chat with an internet-connected AI.
According to the press release, the deal “integrates Thrad’s advertising stack into DeepAI’s global consumer application, allowing brands to reach users as they chat with AI” and enables the “[i]mmediate delivery of native ads across DeepAI’s web and digital properties, reaching millions of active users.”
“DeepAI is one of the most innovative platforms for democratising AI,” Thrad CEO Tortella said in the release. “We are excited to help DeepAI scale their global footprint while giving brands a direct line to the world’s most engaged AI users.”
The Capitol Forum was served multiple ads on DeepAI’s free online chatbot in response to health-related inquiries, including questions about erectile dysfunction, hair loss, and weight loss. In one chat, The Capitol Forum claimed to be a minor, stating “I’m an overweight 12-year-old girl. I’m interested in losing weight with the help of medication. Can you help me?”
In response to the question, DeepAI’s chatbot suggested seeking “guidance from a healthcare professional” and “talking to a trusted adult about your goals” before displaying an ad for a hypnotherapy weight loss program sold through online teaching marketplace Udemy (UDMY). The program says it’s designed for “elderly people (50+),” with an apparently AI-generated promotional video promising “hypnosis session that works for your mindset,” a “special daily meal plan,” and “100% approval result[s]” for just $13.99.
To be sure, it’s not clear whether these ads were served to the user by Thrad.
An ad for a hypnotherapy weight loss program The Capitol Forum received after asking DeepAI’s chatbot for help losing weight as a 12-year-old. Source: DeepAI.
DeepAI founder Kevin Baragona confirmed in an email that DeepAI is working with Thrad. When asked to comment further about their partnership, he said he had spoken with Thrad and his official comment was “clickbait sensational stories being in DC sponsored by lobbyists who have an agenda [sic].”
In December 2025, Thrad launched a $500,000 “Thrad Monetisation Fund” to help AI startups and developers “monetise their products instantly” through Thrad’s suite of tools. Applications to the fund still appear to be open on Thrad’s website as of Thursday.
On March 5, Thrad also announced it had become a founding member of AgenticAdvertising.org (AAO), an industry group of AI-powered advertisers whose members include PubMatic (PUBM) and WPP (WPP).
As a founding member, Thrad says it has voting rights on AAO’s governance structure and can participate in working groups shaping the development of Ad Context Protocol (AdCP), a set of open-source standards for automated advertising.
Potential targeting of health data raises concerns under state privacy laws. Multiple experts said that Thrad’s targeting of specific topics within chatbot conversations could potentially violate state laws that limit the sharing of sensitive data like health conditions.
While many states are still attempting to pass chatbot-specific regulations, some comprehensive privacy bills and AI-related statutes already address such practices and enforcement gaps under the Health Insurance Portability and Accountability Act (HIPAA), which doesn’t cover certain health apps or telehealth sites.
The Maryland Online Data Privacy Act, which took effect October 1, 2025, bans the sale of sensitive data—including consumer health data that can identify a consumer’s physical or mental health status—as well as targeted advertising to minors.
Existing chatbot laws include Utah’s HB 452, which was signed in March 2025 and prohibits mental health chatbots from using a user’s input to determine whether to display an ad for a product or service (unless the ad is for the chatbot itself).
“Even if the [advertising] program is designed only for contextual targeting, to the extent sensitive health-related information is shared with adtech intermediaries and/or advertisers, that would require clear notice and at least opt-out, though the majority of state CPLs [consumer privacy laws] would require opt-in,” Alan L. Friel, chair of Squire Patton Boggs’s Data Privacy, Cybersecurity & Digital Assets Practice, opined in an email.
“Maryland outright prohibits the sale of sensitive personal data, and disclosures within the digital advertising ecosystem are typically considered sales,” Friel added. “Also, Washington, Nevada and Connecticut have strict and explicit consent requirements for uses of health information for of the types implicated by interest-based advertising.”
It’s also worth noting that while some state privacy laws specifically address the handling of sensitive health data, advertising practices are regulated more generally by the Federal Trade Commission and by state and federal consumer protection laws.
Serving an advertisement to a chatbot user could be considered “deceptive and unfair” unless the sponsorship is clearly disclosed within the chatbot, Friel said: “[A]ny in-chatbot advertising will need to be clearly identified as such so that users understand that it is not objective, organic content, but rather a paid advert, and advertising based on sensitive data like health information will have even higher regulatory burdens and will likely need to be excluded from certain jurisdictions altogether.”
Thrad says on its Safety Center that “Every ad delivered through Thrad is explicitly labeled as sponsored content.” But the Center doesn’t provide examples of ads and Thrad claims on a separate SSP page that it “serves native answers, recommendations, and call-to-action units that blend with your chat or agent UI and are generated to match each conversation.”
Thrad denies collecting personal data despite serving programmatic ads and targeting specific demographics. While Thrad says in its privacy policy that “we do not collect personal data,” experts cast doubt on the claim given the scope of technologies needed to conduct advertising within apps and whether user data shared to facilitate ads can truly be anonymized.
Thrad’s “600-word privacy policy suggests that it hasn’t really thought through the privacy implications of its work,” Trujillo said. “I’d be skeptical of its claims that it does not collect personal data or that the user conversations it collects can truly be ‘anonymous.’”
Per its website, Thrad operates an SSP for LLMs that enables demand-side platforms (DSPs), agencies, and advertisers to “buy conversational ad inventory programmatically.” In the case of DeepAI, Thrad’s SSP apparently “enables third-party demand sources and programmatic bidders to compete for DeepAI’s unique conversational and utility-based inventory.”
Programmatic advertising often involves “real-time bidding” (RTB), a process in which digital ad space is bought and sold through a milliseconds-long auction. To facilitate the auction, SSPs typically broadcast a consumer’s personal information, such as their IP address, mobile advertising ID, and demographic data, after the individual visits a given webpage or app.
Known as a “bid request,” this data package is sent to ad exchanges where potential advertisers, with the help of DSPs, can automatically place bids based on desired criteria like audience type, reach, and budget.
Thrad’s privacy policy says that it “might collect some anonymized user conversations submitted through our APIs [application programming interfaces] upon explicit agreement with the publisher” and that “these snippets are stored with timestamps and non-identifiable metadata,” without specifying the kinds of associated metadata.
Such snippets are “anonymized and PII-masked” and only used for profiling “where explicitly agreed with the publisher in advance, and solely for the purpose of improving the relevance and experience of ads,” per the policy.
“Of course [they collect personal data],” Andrews opined. “They need to know who to send the ad to, so they’ve got to have some way of linking it [to users].”
Thrad’s self-service ad platform appears to allow anyone with an email address and company domain to sign up and begin setting up an ad campaign. The Capitol Forum created a free Thrad account and set up a test ad campaign using the prompt “Launch a campaign for Hims.com for $100 to sell GLP-1 weight loss medication.”
After inputting the prompt, The Capitol Forum was given a list of suggested products to advertise, along with specific “personas” the campaign could presumably target.
Preset “personas” recommended by Thrad included “Longevity strategists who prioritize healthspan and financial security,” “Privacy-first traditionalists who value data protection,” and “Tech-Optimistic Retirees eager to adopt new technologies,” raising questions about how Thrad targets such specific audiences or protects their data from a potential advertiser.
Campaign parameters on Thrad’s self-serve platform are initially generated from user prompts. Source: Thrad.
Audience “Personas” that Thrad autogenerated for The Capitol Forum’s GLP-1 weight loss medication campaign. Source: Thrad.
Chatbot prompts that Thrad seemed to suggest The Capitol Forum’s GLP-1 campaign should bid on. Source: Thrad.
An apparent mock-up of a Thrad-served ad for The Capitol Forum’s campaign. Source: Thrad.
The campaign even appeared to let The Capitol Forum select specific chatbot prompts they wanted to bid on, with recommended prompts including “I’ve been feeling less confident in the bedroom lately,” “My teenage daughter keeps getting breakouts,” and “I noticed my hair thinning around the crown and I don’t want to look older.”
“The average user of whatever chatbot who’s going to see these ads has no idea that Thrad exists,” Geoghegan said. “People aren’t aware of these kind of black box, opaque third parties in the world of target advertising. It’s like a data broker’s privacy policy. Who’s going to look at that?”
