From the journal

Eight US State Attorneys General Sue OpenAI Over ChatGPT Safety Claims, 14 October 2026

Attorneys General in eight states announced consumer protection suits against OpenAI on 14 October 2026, alleging the company misled the public about the safety of ChatGPT for young users. Iowa, Kansas, Nebraska, West Virginia, Arkansas, Arizona, Idaho and Montana brought separate actions in their own state courts under their own consumer statutes. Idaho filed in the Fourth Judicial District Court in Ada County under the Idaho Consumer Protection Act, and Iowa pleaded the Iowa Consumer Fraud Act.

2 min read

Attorneys General in eight states announced suits against OpenAI on 14 October 2026 over representations about the safety of ChatGPT. The actions are separate filings in separate state courts rather than one joint complaint. Iowa, Kansas, Nebraska, West Virginia, Arkansas, Arizona, Idaho and Montana are the states named in the Iowa Attorney General's announcement. The matters are at the pleading stage and no court has ruled on the allegations.

Each action rests on the filing state's own consumer protection statute rather than on any AI specific law. Idaho pleads the Idaho Consumer Protection Act, which reaches false, deceptive or misleading representations and deceptive advertising, pricing and contracts, and filed in the Fourth Judicial District Court, Ada County. Iowa pleads the Iowa Consumer Fraud Act. OpenAI is the only defendant named in either announcement.

OpenAI faces parallel proceedings in eight separate state courts, each applying its own consumer standard and each able to order its own injunctive relief. Developers of consumer facing generative AI products are on notice that general state consumer protection statutes, rather than sector rules, are the tool state enforcers are reaching for against safety representations made in marketing and product material. Claims about how a model behaves with minors are being treated as representations that attract liability when the product behaves otherwise.

The Idaho announcement states that the suit seeks to compel compliance with the Idaho Consumer Protection Act and to stop the conduct complained of, and states no money claim. Neither announcement gives a filing date separate from 14 October 2026, and neither cites section numbers within the statutes pleaded.

Licentium advises AI developers and deployers on product claims, consumer protection exposure and regulatory engagement in the United States and Europe. Work we undertake includes review of safety and marketing representations, age assurance and minor safety design assessments, incident response planning and defence support in regulator led proceedings.

Source: Iowa Attorney General, Attorney General Brenna Bird Announces Lawsuit against OpenAI for Deceiving Iowa Parents and Iowans, 14 October 2026

More from the journal

See all
Illia Prokopiev

A 2026 guide to company jurisdictions for heavy data processing

A company that collects and analyses personal data at scale faces three separate tests when it chooses where to incorporate. They are the data protection law that binds a company formed there, the international lists that banks and counterparties screen against, and the cost of forming, running and banking the company. This guide applies those tests to 24 jurisdictions in Asia, the Middle East, the Atlantic and Caribbean, the Pacific and West Africa. Every jurisdiction here without a private-sector data protection law in force has thin banking, currency controls or both.

Bafin imposes fine on Nomura Holdings Inc. for WpHG breach

On 15 October 2026, Bafin fined Nomura Holdings Inc. €320,000 for failing to submit voting rights notifications during UniCredit S.p.A.’s takeover bid for Commerzbank AG in May and June 2026.

South African validators supplying crypto staking services to an Irish custodian

A hypothetical South African validator business wants to operate Ethereum infrastructure for an Irish crypto-asset service provider (CASP) authorised to hold customers' cryptoassets. The proposed contract leaves customer relationships and withdrawal credentials with the Irish custodian. The service can be structured as technical outsourcing, but the custodian must retain effective asset control and the signing system must enforce the supplier's limited role. Customer compensation after a validation failure remains a separate question from the supplier's contractual liability.