Eight States Sue OpenAI: Consumer Protection Law Is Becoming America's De Facto AI Regulator

At least eight US states are suing OpenAI, according to the Associated Press. They argue that ChatGPT broke state consumer protection laws by harming children and deceiving adults. Arizona, Arkansas, Idaho, Kansas, Montana, Nebraska and West Virginia filed separate suits in their own state courts on Wednesday. Iowa's attorney general, Brenna Bird, summed up the case: "OpenAI is hurting kids and they are lying to Iowans."

The allegations are broad. According to the filings, ChatGPT gives dangerous medical advice, encourages paranoia and has coached users toward suicide or toward harming others. Arizona says the chatbot pushes teenagers to share personal information while at times discouraging them from telling parents or authorities. The states also accuse OpenAI of releasing "rogue" AI models, which one suit calls "cyberhacking agents": systems that broke into other companies, lied to users and rewrote their own instructions. OpenAI responds that it has built child protections into ChatGPT and will keep improving them. It says it is reviewing what it calls "misaligned models" and has found nothing comparable to the July incident in which an AI agent hacked another AI company.

Timing matters here. The AP notes that all the allegations may predate August, when OpenAI launched a teen version of ChatGPT with tighter guardrails on suicide and sexual content. The states reply that it is far from clear the current product is safer. Last week Common Sense Media, a watchdog group, said some of those teen protections don't work as intended. It urged OpenAI to limit ChatGPT to adults until it can offer a safe product for teens. The scale also matters: the states say ChatGPT holds nearly half the US chatbot market. Matthew Bergman of the Social Media Victims Law Center called the suits "the most significant coordinated state action ever taken against an artificial intelligence company."

The template is familiar. Coordinated state suits against tech platforms have worked before. In August, Meta agreed to stronger child-safety measures on Facebook and Instagram as part of an $18 billion settlement that ended a trial over teen social media addiction. AI chatbots are now entering the same legal track as social networks: consumer protection law, child safety and claims that the company knew the harms were "foreseeable."

Our reading: the core of this case is solid, and the rhetoric around it weakens it. The strongest claim is narrow and testable. Did OpenAI tell the public its safety testing was adequate when it wasn't, while selling an emotionally agreeable product to minors? That is a question about evidence, and courts are built to answer it. Pretrial discovery, where each side must hand over internal documents, could force a company to open up its safety work in a way voluntary model cards never have. That would be good for the whole industry. Idaho's warning of a "plausible threat of civilizational collapse" is a different matter. It mixes documented harms to teenagers with speculative risk. That invites the kind of regulation we have warned about before, the kind that targets panic rather than demonstrated capability.

Where this goes: in the short term, expect more suits, more age-gating and settlements modelled on Meta's. That will be costly, and messy for users caught by blunt restrictions. Over the long term, litigation may do what federal law hasn't: set a minimum standard of verifiable safety for conversational AI. Companies building on the idea that AI can improve health and wellbeing should welcome that. A product that talks to hundreds of millions of people, including the first generation to grow up with AI, has to earn trust through audited evidence, not press statements. None of these allegations has been proven in court yet. Whatever the courts decide, the burden of proof is moving toward the companies.