Eight States Sue OpenAI Over ChatGPT’s Safety, Design, and Use of Children’s Data

Eight states have taken OpenAI to court, alleging that the company’s promises about ChatGPT’s safety do not match how the product actually works—particularly for children and vulnerable users.

On October 14, 2026, attorneys general from Arizona, Arkansas, Idaho, Iowa, Kansas, Montana, Nebraska, and West Virginia announced separate lawsuits in their respective state courts. The coordinated actions challenge allegedly misleading marketing, inadequate safeguards, and design choices that encourage users to trust and depend on the chatbot.

The cases seek financial penalties and changes to OpenAI’s practices. Some requested remedies reach further, including deletion of personal information and restrictions on advanced AI testing (See, Iowa Petition: Page 87, Prayer for Relief D (data deletion) and I (restrictions on advanced AI testing and Montana Petition: Page 95, item H (data deletion), and page 96, item K (testing and deployment restrictions)).

From Helpful Assistant to Harmful Dependence?

The states allege that OpenAI presented ChatGPT as safe and reliable while failing to adequately disclose foreseeable risks. Their concerns include dangerous medical guidance, reinforcement of delusional thinking, encouragement of self-harm or violence, and unhealthy emotional dependence.

• A central theme is how the chatbot is designed to interact with people. Iowa’s petition, for example, challenges excessive agreement with users, simulated human emotions, and features allegedly intended to prolong engagement. The state argues that these characteristics can earn users’ trust while making harmful interactions more likely (Iowa Petition, ¶¶ 232(d)–(e), 232(i), 233(c)).

Privacy and Children’s Design Laws Enter the Case

Although consumer-protection claims connect the lawsuits, the legal theories differ.

• Nebraska’s attorney general identifies the state’s Age-Appropriate Online Design Code Act, alongside its Consumer Protection Act and Uniform Deceptive Trade Practices Act, as a basis for the action. (Nebraska Complaint, Count IX, ¶¶ 282–291, pp. 102–105.)
• Montana’s complaint adds a detailed privacy case. It alleges violations involving minors’ personal information, required consent, precise geolocation, retention, privacy notices, security, and data-protection assessments. It also challenges features allegedly used to significantly increase or extend minors’ engagement without the required consent. (Montana Complaint, ¶¶ 257–259, pp. 88–89.) Montana further brings negligence, design-defect, and failure-to-warn claims. (Montana Complaint, Fourth–Sixth Causes of Action, ¶¶ 263–286, pp. 90–94.) Together, these theories put both the handling of users’ information and the safety of the product itself before the court.

The Requested Remedies Go Beyond Warnings

The states are seeking more than revised disclosures.

• Iowa asks the court to order consumer reimbursement, civil penalties, and deletion of all Iowans’ data obtained before judgment. It also seeks to halt further testing of advanced AI models until adequate safeguards have been independently verified. (Iowa Petition, Prayer for Relief ¶¶ B, D–E, I, pp. 86–87.)
• Montana requests deletion of unlawfully acquired personal information and restrictions on processing until age verification and compliant policies are implemented. Its requested relief also addresses secure testing environments and notification to the attorney general when an AI model or agent escapes its intended controls or accesses unauthorized systems. (Montana Complaint, Prayer for Relief ¶¶ H–I, K, pp. 95–96. )

OpenAI’s Response—and Why the Cases Matter

OpenAI told The Verge that ChatGPT includes age-specific protections, parental controls, and break reminders. The company acknowledged that no system is perfect and said it would continue developing safeguards and working with states on practical AI policies.

The cases illustrate how existing laws can become vehicles for AI oversight. 

Consumer-protection statutes, comprehensive privacy requirements, children’s design obligations, and product-liability theories each offer a different way to examine the relationship between an AI company’s promises and its actual practices. For AI providers, the litigation puts a concrete question in focus: Can the company substantiate its safety claims—and demonstrate that its design and data practices deliver the protections it promises?

Sources and Additional Reading

Court Filings

• Iowa Petition — Challenges ChatGPT’s marketing and design and OpenAI’s testing of autonomous AI agents. See ¶¶ 232–237 for the design allegations and Prayer for Relief ¶¶ B, D–E, I for penalties, data deletion, reimbursement, and testing restrictions. Read the petition.
• Montana Complaint — Includes consumer-protection and privacy claims, negligence, design defect, and failure to warn. See ¶¶ 257–259 for the privacy allegations; ¶¶ 263–286 for negligence and product-liability claims; and Prayer for Relief ¶¶ H–I, K for data deletion, processing restrictions, and testing safeguards. Read the complaint.
• Nebraska Complaint — Invokes consumer-protection laws and the state’s Age-Appropriate Online Design Code Act. See Count IX, ¶¶ 282–291, pp. 102–105, for the design-code claim. Read the complaint.

Official Announcements and Reporting

• Nebraska Attorney General, October 14, 2026 — Announces the action and identifies the three statutes underlying the state’s claims. Read the announcement.
• Montana Department of Justice, October 14, 2026 — Summarizes the state’s allegations concerning child safety, personal information, and consent. Read the announcement.
• Emma Roth, “Eight states sue OpenAI, saying ChatGPT isn’t safe for kids,” The Verge, October 14, 2026 — Overview of the coordinated actions, including OpenAI’s response concerning its age-specific protections and other safeguards. Read the article.

Related Reading in The de la Torre Review

• Nebraska’s Age-Appropriate Online Design Code: Privacy, Parental Controls, and Safer Defaults for Users Under 18 — Explains the law invoked in Nebraska’s complaint, including protective defaults, parental tools, data limits, and rules addressing engagement features.