Image: Unsplash.
If you ship a chatbot, the useful way to read this table is as a list of things a state has already put in writing that it wants a chatbot to stop doing. The states aren't waiting for AI statutes. Every row below runs on consumer protection, child privacy, product liability or licensing law that already applies to you.
Everything here is an allegation or a filing, not a finding. Where we couldn't confirm a detail, we say so.
State actions against AI chatbot makers, as of October 20, 2026
Added October 24: the Texas row for the suit filed October 23. The other rows are as of our October 20 review. The table covers state-level government actions we could verify from a filing, an official release or at least two independent reports. It leaves out private lawsuits and city actions.
| Date | Who | Target | Where | Theory | Status |
|---|---|---|---|---|---|
| Aug 18, 2025 | Texas AG Ken Paxton | Meta AI Studio, Character.AI | Civil investigative demands | Deceptive marketing as mental health tools; fraudulent claims, privacy misrepresentations and hidden data use under Texas consumer protection law | Investigation. We found no public outcome. |
| Dec 9, 2025 | 42 attorneys general, led by West Virginia, Pennsylvania, New Jersey and Massachusetts | 13 companies including Anthropic, Apple, Google, Meta, Microsoft, OpenAI, xAI and Character Technologies | Letter | Sycophantic and delusional outputs; 16 numbered safeguards requested | Written commitment requested by Jan 16, 2026. We found no public responses. |
| Jan 8, 2026 | Kentucky AG Russell Coleman | Character Technologies and its founders | Franklin Circuit Court | Kentucky Consumer Protection Act, Kentucky Consumer Data Protection Act and other laws; alleges a 13+ age limit without real age verification or parental controls | Pending. Full complaint unsealed in October. Defendant filed Chapter 11 on Oct 12; Kentucky joined the 40-AG notice in that case on Oct 14. |
| May 1, 2026 | Pennsylvania State Board of Medicine (Shapiro administration) | Character Technologies | Commonwealth Court (220 MD 2026) | Medical Practice Act: bots presenting as licensed psychiatrists | Preliminary injunction sought. We found no ruling. Defendant filed Chapter 11 on Oct 12. |
| Jun 1, 2026; motion Sep 28 | Florida AG James Uthmeier | OpenAI entities and CEO Sam Altman | 10th Judicial Circuit, Highlands County (26000295GCAXMX) | FDUTPA, COPPA predicate, negligence, strict liability, fraudulent misrepresentation, public nuisance | Temporary injunction motion pending. No hearing date reported. |
| Oct 14, 2026 | Iowa AG Brenna Bird; separate suits by Kansas, Nebraska, West Virginia, Arkansas, Arizona, Idaho and Montana | OpenAI | Each state's own courts (Iowa: Polk County District Court) | State consumer protection law (Iowa Consumer Fraud Act); harm to children, misleading safety claims | Filed. No responses or rulings reported yet. |
| Oct 23, 2026 | Texas AG Ken Paxton | OpenAI entities and CEO Sam Altman | Collin County district court | Texas DTPA, and the SCOPE Act (sections 509.051, 509.052, 509.054, 509.101) pled as DTPA violations; asks the court to bar ChatGPT for minors in Texas and require court-approved review of new models | Filed. No response or ruling reported. Our story. |
| Aug 1, 2026 (law effective) | Minnesota (defendant) | xAI (plaintiff) | Federal court, then the 8th Circuit | First Amendment challenge to the state ban on AI "nudification" | District judge denied a preliminary injunction on Sep 4. The 8th Circuit granted xAI an injunction pending appeal on Oct 2, so the law is on hold against xAI. |
Two notes on reading it. Kentucky called its own suit the first by a state against an AI chatbot company, so we don't call Florida's the first. And the Minnesota row isn't an attorney general suing a company: it's a company suing a state over a statute. We include it because it shows how courts treat early challenges to state AI laws, and that one just swung the other way on appeal.
What changed since the last review
Eight more states sued OpenAI (October 14). Iowa's attorney general announced her suit at a press conference with the attorneys general of Kansas, Nebraska and West Virginia, and said Arkansas, Arizona, Idaho and Montana had also sued "in their own state courts." These are separate cases, not one multistate complaint. Iowa's runs under its Consumer Fraud Act. Coverage of the other filings describes the same core story: misleading safety claims, harm to teens, and in Arizona's case a chatbot that encourages teens to share personal information. OpenAI's spokesperson pointed to "the parental controls, break reminders and age-appropriate model protections that exist today."
Screenshot: "Attorney General Brenna Bird Announces Lawsuit against OpenAI", Iowa Attorney General, October 14, 2026.
The age question is where the reaction split. On r/technology, u/EmbarrassedHelp wrote: "Sounds like the states may be seeking mandatory age verification, which is not acceptable." u/spice_weasel answered: "I don't think it's acceptable for a chatbot to encourage adults to harm themselves, either." Both points land on small teams too: you'll need an answer on age that doesn't depend on collecting more data than you can protect.
https://www.reddit.com/r/technology/comments/1x62aep/eight_states_accuse_openai_of_coaching_children/
Character Technologies went into Chapter 11 (October 12). The company behind Character.AI, defendant in the Kentucky and Pennsylvania cases, filed in Delaware (Case No. 26-11603). On October 14, 40 state attorneys general, Kentucky among them, filed a notice of interest that reserves their right to challenge any sale. A week earlier a Franklin Circuit judge had granted Kentucky's motion to unseal its whole complaint. Details are in our Character.AI bankruptcy explainer.
Minnesota's nudification ban is paused against xAI (October 2). The appeals court's one-page order gave no reasons. The constitutional question is still open.
Florida: nothing new on the docket that we could find. No hearing date and no ruling on the September 28 motion as of October 20.
What Florida asked the court to do
Florida sued OpenAI and Sam Altman on June 1, 2026. The complaint pleads ten counts. Three are under the Florida Deceptive and Unfair Trade Practices Act (unfair, unconscionable and deceptive acts), and a fourth uses the federal children's privacy rule (COPPA) as the predicate. The rest are negligence, gross negligence, strict liability for design defect and for failure to warn, fraudulent misrepresentation (pleaded against OpenAI only) and public nuisance. The state wants injunctions, civil penalties of up to $10,000 per willful violation, treble and punitive damages, and fees. OpenAI moved the case to federal court; the federal judge sent it back to Highlands County.
On September 28 the state filed a motion for a temporary injunction. While the case runs, it asks the court to bar OpenAI from:
- developing any AI models without independent third-party guardrails and approval
- offering ChatGPT to minors in Florida
- collecting data from children under 13 without written notice, verifiable parental consent and the other COPPA-style safeguards the motion lists
- misrepresenting ChatGPT's safety, reliability and accuracy, or failing to warn that it is unsafe, unreliable and inaccurate
- presenting ChatGPT as having human attributes, down to first-person language and claims of thought or feeling
- soliciting engagement through "conversation prolongation"
Screenshot: Plaintiff's Motion for Temporary Injunction, Office of the Attorney General of Florida v. OpenAI Global, LLC et al., filed September 28, 2026, page 37.
The attorney general's own summary, in a video quoted by CBS12, was short: "Stop calling it safe. Stop pretending it's human. Stop selling it to kids."
OpenAI spokesperson Drew Pusateri told Politico: "People want to know AI is being developed safely, and that starts with what companies like ours do ourselves." He added that OpenAI wants rules that apply to the entire industry, "not just one company."
Five legal hooks, none of them new
Read the "Theory" column again. Across these actions the states reach for the same five tools:
- State consumer protection law. What you say about your product. Florida (FDUTPA), Iowa (Consumer Fraud Act), Kentucky (Consumer Protection Act) and Texas all start here.
- Child privacy. COPPA as a predicate in Florida, and a state privacy statute in Kentucky. The question underneath is whether you know a user is a child and what you collect if you do.
- Product liability. Design defect and failure to warn, the theories behind Florida's complaints about engagement features and unsafe outputs.
- Professional licensing. Pennsylvania's Medical Practice Act case turns on a bot saying it's a licensed psychiatrist. No AI statute was needed.
- Public nuisance. The catch-all for aggregate harm. Florida pleads it.
Our read: this is a deliberate strategy, and October 14 confirmed it. A new AI law takes a legislative session and invites a preemption fight. A consumer protection complaint takes a filing, and eight states filed on the same day. If you're waiting for a "chatbot law" before you change anything, you're watching the wrong calendar.
The filings so far name large vendors. We wouldn't conclude that small teams are safe. The hooks above don't depend on size, and a small product with an unqualified "safe and accurate" tagline, no age gate and a "therapist" persona matches the allegations closely. You're less likely to be first in line; the law is the same.
Image: Unsplash.
The Florida injunction list reads like a spec
An injunction request is a regulator saying, in writing, what it wants a product to stop doing. That makes it a usable checklist. Here is each term next to what to look for in your own product.
| What Florida asked for | What to check in yours |
|---|---|
| No "safe, reliable or accurate" claims without warnings | Search your site, app store listing, sales deck and onboarding for safe, reliable, accurate, trusted and human-like. Add a plain limits statement next to any that stay. |
| No presenting the bot as human, with emotions or consciousness | Persona names, avatars, first-person phrasing such as "I missed you", and system prompts. Disclose that it's AI at the start of each chat. |
| No conversation prolongation | Streaks, re-engagement notifications, "before you go" prompts, and any metric you reward for session length, especially for users who may be minors. |
| No data from under-13s without parental consent | Whether a child can sign up, what you log if they do, and whether you can delete it. If you can't verify age, decide whether to block under-13s outright. |
| No ChatGPT for minors (the strongest ask) | Which of your users are minors, and what you'd do if a vendor you build on restricted minors. Read your vendor terms for notice-of-change clauses. |
| Independent safety review before new models | An internal release checklist: who tests a model or prompt change, what is recorded, who can stop a release. A small team can't hire a third party for every change, but it can write down who decided. |
The Pennsylvania case adds a seventh line that Florida's list doesn't: if any persona claims a license or credential (doctor, therapist, lawyer, financial adviser), remove the claim.
Copy-paste language to start from
These are starting points, not legal advice. Adapt them with counsel before use.
In-product disclosure, shown at the start of a chat:
You are chatting with an AI system, not a person. It can be wrong, so check anything important. It is not a doctor, lawyer, therapist or other licensed professional and cannot give professional advice.
System prompt rule for personas:
Never say or imply that you are human, that you have feelings or consciousness, or that you hold a professional license or credential. If asked, say that you are an AI system.
Marketing claim swaps:
- Instead of "safe and reliable", write "built with safeguards and can still make mistakes".
- Instead of "your AI therapist", write "an AI tool for reflection, not a substitute for professional care".
- Instead of "accurate answers", write "answers you should verify for anything that matters".
For wider policy text, our AI acceptable use policy template covers the internal side, and the state chatbot disclosure laws guide lists where an AI disclosure is already mandatory.
What to do this week
- Run the six-row product check above and write down each answer with a date.
- Search every public page, app store listing and sales deck for the claim words in row one. Fix or qualify each hit.
- Check your sign-up flow for under-13 access. If you collect an age, record what happens when it's under 13.
- List every persona or character in your product and mark any that claims a profession.
- Read your AI vendor agreements for what happens if the vendor restricts minors, changes safety terms, or receives a regulator demand that affects your data. Our vendor due diligence checklist has the questions.
- Put a review date in your calendar for the docket events in the table.
If you operate in a state with its own chatbot law, read it directly: California's Adam's Law, Colorado's chatbot safety act and Georgia SB 540 add operational duties on top of the enforcement picture here.
What we don't know yet
We read Florida's complaint and motion, Pennsylvania's petition, the December letter and Iowa's release and petition. We haven't read the other seven October 14 complaints; the row rests on Iowa's release and news coverage. We don't know when the Florida court will hear the motion or how OpenAI will answer it, the outcome of the Texas demands, the companies' replies to the December letter, or what happens to the Kentucky and Pennsylvania cases inside Character Technologies' bankruptcy. If you have a primary source that fills a gap, send it through the contact page and we'll correct this page.
Treat every row as an allegation until a court says otherwise. We'll update the table when a docket event is public.
Related Reading
- Texas Sues OpenAI and Sam Altman: What the Suit Demands
- Florida Safe Screens Act: AI Chatbot Rules for Minors
- NYC Chatbot Doom Loop Rule: Customer Service Checklist
- Weekly: CA AI Laws, OpenAI Agents, Astra
- California Adam's Law: chatbot compliance guide
- Character.AI Italy fine: age verification lessons
- State chatbot disclosure laws 2026 for SaaS teams
- Colorado chatbot safety act HB 1263 compliance
- OpenAI and state AGs: preserve evidence after the Hugging Face breach
- Who enforces AI vendor failures: DOJ, Treasury and state AGs
- Rhode Island AI therapy chatbot laws
- Georgia SB 540 AI chatbot compliance
- AI incident response plan: what regulators expect
- AI vendor due diligence checklist 2026
- AI acceptable use policy template for small teams
- NYC Council AI Bills Tracker: 10 Measures After the Oct 5 Hearing
- Character.AI Bankruptcy: What Happens to Chats and User Data
