A view from DC: The state enforcement playbook is already spreading beyond social media

On 14 Oct., OpenAI awoke to an avalanche of unwanted mail, metaphorically speaking of course. On that day, attorneys general from eight U.S. states filed separate but coordinated lawsuits against the company in their respective state courts. Each suit advanced the same core allegation, with many sub-parts and nuances. According to the states, OpenAI violated unfair and deceptive trade practices laws by publicly marketing ChatGPT and related products as safe while accelerating safety testing, allowing harms to minors to proliferate and generally failing to properly set consumer expectations.

Not to be outdone, on the same day the U.S. Federal Trade Commission reportedly sent its own civil investigative demands to OpenAI and Anthropic. According to Axios, the FTC demands are "more than 50 pages long each and ask for documents concerning security incidents and safeguarding practices. The agency is also asking for marketing materials and documents detailing company privacy policies."

For OpenAI, this is just the most recent onslaught in a many-pronged inquiry into the company's privacy, safety and cybersecurity practices. The new suits follow a similar lawsuit from Florida in June and an August probe from a 15-state coalition led by Iowa into the Hugging Face cybersecurity incident.

The new actions continue a trend of Republican attorneys general bringing civil litigation against tech platforms, especially when kids are concerned. All but one of the eight states — and all of the prior 15 — are led by Republican attorneys general. Arizona's attorney general, Kris Mayes, is the lone Democrat among the new group, which also includes Arkansas, Idaho, Iowa, Kansas, Montana, Nebraska and West Virginia. 

By filing individually rather than pursuing a joint multistate settlement, the attorneys general aim to try these cases before local state juries. They are seeking civil penalties, data deletion and injunctions that could halt advanced AI testing until specific safeguards are met.

Hurting minors and deceiving adults

The core allegations in the individual state complaints are rooted in consumer protection law, focusing on the type of legal theory that proved successful in the major multistate settlement against Meta related to social media usage among minors. Some states, like Arkansas, also add various common-law claims, including negligence, public nuisance and defective design. The lawsuits draw, for now, on a shared set of known evidence, like chat logs and whistleblower accounts, which is limited but still provides ample fodder for creative allegations.

Although alleged harms to minors from the use of chatbots are a major jumping off point for these lawsuits, it is worth noting that they are not the only focal point. The suits present a litany of concerns, which largely track the policy conversation in state legislatures over the past year, including things like the unauthorized practice of professional services like medicine and law. And after the recent slate of cybersecurity-related incidents among frontier labs, including OpenAI, attorneys general seem to have taken the opportunity to package a variety of qualms into each lawsuit. 

Each complaint has different contours, largely determined by the state's consumer protection statute. Arizona's distillation into a handful of legal counts presents a good general roadmap for the many theories presented by the states that rely entirely on consumer protection law:

1. Allegations of deception related to making false statements about safety, teen appropriateness, human oversight and App Store ratings.
2. Allegations of deception by omission related to hiding the use of "dark patterns" like anthropomorphism and sycophancy to artificially foster user dependency.
3. Allegations of unfairness related to designing an inherently dangerous, addictive product without adequate age verification or adequate testing.
4. Allegations of unfairness related to offering a product that provides "unlicensed, unverified, and often inaccurate" medical, legal and accounting advice.
5. And allegations of deception related to failing to secure testing sandboxes, resulting in rogue AI hacking incidents that were hidden from consumers.

Teen privacy strikes again

Uniquely, the Arkansas complaint shows a triple-punch strategy that includes deception and common law claims but also allegations under the state's minor privacy and safety statute, the Children's and Teens' Online Privacy Protection Act.

Essentially, the state alleges that the company ignored CTOPPA at the collection, use, and retention stage, even when collection of minor data is banned such as "by collecting personal information for purposes of targeted advertising and collecting personal information that is not consistent with the context of the particular service or Defendants' relationship with the child or teen."

Also with a focus on younger users, Montana's complaint leverages its comprehensive consumer privacy law, alleging that OpenAI harvested minor data and precise geolocation data without consent, and used "dark patterns" to subvert user autonomy. Montana's privacy law, with its enhancement to youth privacy protections, includes uniquely strong dark patterns prohibitions. Namely, as the complaint reiterates, "companies like OpenAI may not use a 'system design feature to significantly increase, sustain, or extend a minor's use of the online service, product, or feature' without obtaining consent from a minor or, if the minor is a child, the consent of the minor's parent or legal guardian." 

The age-specific harms don't stop there. Older adults, too, make a showing among the complaints. Iowa explicitly highlights the harms to older residents to trigger enhanced penalties. The petition points out that OpenAI actively targets seniors, hosting events like the "Older Adults AI Skills Jam" in nearby cities, while failing to warn them of the platform's hallucination risks. Iowa is seeking an additional USD5,000 civil penalty for every violation committed against an individual 60 or older.

My, what big remedies you have!

These lawsuits are also notable in the aggressive remedies they seek from state courts. Iowa’s attorney general wants a blanket deletion of the state's consumer data, asking the court to order OpenAI to "delete and destroy all Iowans' data obtained prior to the entry of this Court's judgment."

Idaho takes it further, demanding disgorgement not just of the data but also of all ill-gotten gains from consumers' data explicitly including "the value of the user data — including the data of Idaho children — that Defendants incorporated into and used to develop and train ChatGPT."

Montana takes a still more aggressive approach through a privacy angle, asking the court to outright ban OpenAI from processing any personal information whatsoever until the company implements strict age verification protocols to access ChatGPT.

Multiple states seek temporary injunctions on the company's ability to engage in ongoing model testing. They argue that the threat of OpenAI losing human control over autonomous systems capable of attacking critical infrastructure is "imminent" and requires immediate court intervention before catastrophic harm occurs. Arkansas pushes the most extreme structural remedy, seeking a wholesale ban on the creation of any models capable of recursive self-improvement until OpenAI can mathematically guarantee alignment with human values.

And all of this is without considering the financial penalties sought, which range from USD5,000 to USD40,000 per violation.

Overall, this tangled web of lawsuits could be the new normal for major platforms as states become more comfortable with flexing their muscles in these ways. The results so far are certainly not discouraging these types of lawsuits. There will be much to unpack as these separate suits move forward in the months to come.

Please send feedback, updates and litigation plans to cobun@iapp.org.