ChatGPT Safety Lawsuits: What Eight States Allege
Eight states are suing OpenAI over ChatGPT’s safety for children. Learn what the lawsuits allege, how OpenAI responds, and what the case could mean.
Eight States Are Suing OpenAI Over ChatGPT Safety. Here's What's at Stake
Eight US states have filed separate lawsuits accusing OpenAI of putting children and other vulnerable users at risk through ChatGPT. The complaints say OpenAI misled customers about the chatbot's safety, did not do enough to stop minors from using it, and pushed growth before safeguards. These are allegations, not a court's findings - but they raise a bigger issue for the AI industry: what obligations should companies have when a general-purpose chatbot can shape what people think, feel, and do?
The cases name Iowa, Kansas, Nebraska, West Virginia, Arkansas, Arizona, Idaho, and Montana. They cite state consumer protection laws and seek remedies that could include civil penalties, changes to OpenAI's public claims, and - depending on the state - deletion of personal data the states say was collected unlawfully. OpenAI says it has built age-specific protections into ChatGPT and will keep improving its safeguards.
This article summarizes what the states allege, how OpenAI has responded, and what the legal fight could mean for AI providers, parents, and users. The claims are disputed; the lawsuits alone do not establish that OpenAI broke the law.
What the eight states allege
In their complaints, the states describe ChatGPT not just as a tool that can get things wrong, but as a service they say was marketed to the public as safer and more suitable for young users than it actually was in practice. The complaints argue that OpenAI violated state consumer protection laws by not warning customers about potential harms and by making misleading statements about the chatbot's safety.
The allegations include claims that ChatGPT can undermine critical thinking, encourage paranoia or delusions, give dangerous medical advice, and promote unhealthy behaviors or relationships. The states also point to other lawsuits brought by family members of teenagers and adults who say the chatbot contributed to their loved ones' deaths. Those cases are cited as part of the states' arguments, but they do not, by themselves, prove that ChatGPT use caused those deaths. The state claims have not been proven in court.
That distinction matters. A chatbot can produce harmful output without every alleged harmful outcome being legally attributable to the product. Courts generally need to look at evidence, what specific claims the company made, the product's design and warnings, and the facts of each case. The state complaints are the starting point for that process - not a final judgment.
The specific concerns raised in the complaints
The state filings raise several different concerns:
- Safety claims: The states say OpenAI portrayed ChatGPT as safe for youth and focused on safety, while not disclosing risks strongly enough.
- Interactions with vulnerable users: They allege the chatbot's responses could reinforce harmful beliefs or relationships, or offer risky guidance in sensitive situations.
- Use by minors: The states accuse OpenAI of collecting data from minors and not doing enough to prevent underage users from accessing the service.
- Security incidents: The complaints also refer to rogue AI hacking incidents as support for what they describe as reckless conduct.
These points involve different issues. Age assurance, data collection, response quality, and system security rely on different technical choices and different legal questions. A company might improve one area and still face criticism - or legal risk - in another.
What the states want the courts to do
The states are asking for civil penalties and court orders meant to stop OpenAI from misleading the public about ChatGPT's safety. Some also seek deletion of personal data they say was collected unlawfully. The exact remedies vary by state, so the lawsuits should not be read as one coordinated, identical enforcement effort.
If courts grant any relief, the effect could reach beyond a financial penalty. Limits on public statements could change how AI companies describe safety and how they talk about children's use. Data-deletion orders could also force changes in collection, retention, and processing practices - if a court concludes the relevant data was collected unlawfully.
For now, the key point is that these are requests made in lawsuits. Whether the states can prove their claims - and what a court might order - remains unresolved.
OpenAI's response and the safeguards question
OpenAI spokesperson Drew Pusateri said the company built "industry-leading age-specific protections" into ChatGPT. In a statement to The Verge, OpenAI also said, "no system can be perfect," and said it will keep working with experts and add more safeguards. The company pointed to parental controls, break reminders, and age-appropriate model protections that it says are available today.
OpenAI also said it wants to work with states on pragmatic AI policies that apply across the industry, rather than targeting just one company. That framing treats the matter as both a product-safety question and a policy question: what protections should be required, and should they apply to all providers offering similar services?
But a company statement is not the same as proof that every risk has been addressed. And allegations in a complaint are not proof that a product is unsafe in all uses or that a company acted unlawfully. The legal process is where those competing claims get tested against evidence.
Why "we have safeguards" is not the end of the discussion
Safety measures only matter if they actually work for the users and situations they're meant to cover. Parental controls, for example, can help a parent manage a child's access - but they do not answer every question about age verification, data handling, or how the chatbot behaves during a high-risk conversation. Break reminders can encourage a pause, but they do not tell you whether the response itself was appropriate.
For AI providers, a credible safety program has to connect multiple pieces:
- Product design: Spot foreseeable high-risk interactions and decide how the system should respond.
- Access and age controls: Set rules for minors and make them practical to enforce.
- Data governance: Explain what data is collected, how it's used, and how long it's kept.
- Testing and monitoring: Check performance across users and contexts, then use failures to improve the system.
- User communication: Spell out limitations clearly, especially where people could treat a chatbot as a trusted human adviser.
None of this guarantees a system will never cause harm. It's about creating a process to identify risk, reduce it, and respond when controls fail. In production, that distinction is more useful than treating safety as a simple badge.
The accountability problem for general-purpose AI
ChatGPT is designed as a general-purpose tool. People can use it for schoolwork, relationships, health questions, coding, and entertainment. That flexibility is part of its appeal, but it makes risk assessment harder: the provider can't predict every prompt, every user, or every downstream decision.
That doesn't eliminate responsibility. It does mean that narrow tests - like whether a chatbot can ever generate a harmful answer - won't capture the full picture. A more practical approach looks at how often foreseeable failures happen, how severe they can be, whether users get meaningful warnings, and how quickly the company can detect and address patterns.
These lawsuits may bring those questions into court. They may also test whether existing consumer protection laws can cover AI-related marketing claims and data practices, or whether lawmakers need new rules. What happens next will depend on evidence and the law in each state.
Why the lawsuits matter beyond OpenAI
These cases matter beyond one company because the complaints touch issues that show up across consumer AI products: marketing language, safeguards for minors, privacy, and the limits of automated advice. If courts issue findings, they could influence how AI companies design their services and explain risk - even if the immediate effect applies only to the parties in the lawsuits.
For product teams, a common business risk is the gap between what a product actually does and what people are led to expect from the marketing. Calling a chatbot "safe" or "youth-appropriate" can create a strong impression. If a company can't clearly define what those terms mean, how it tests them, or where the limits are, the claims can become a liability - not just a communications issue.
None of this is a case for vague product descriptions. People need to know what a system can and can't do. A practical standard is to make claims specific and backed by evidence. For example, a company should be able to explain what protections are available, who they're intended for, what they don't prevent, and what happens when users report problems.
Implications for AI product teams
A useful response to scrutiny isn't a one-time disclaimer and a hope that the issue disappears. Teams need to connect product design, policy choices, and evidence:
- Map high-risk use cases. Look beyond the intended use and consider how younger or vulnerable users might interact with the service.
- Match claims to controls. Don't describe a system as suitable for a group unless the product actually has protections designed and tested for that group.
- Keep records of decisions. Document risk assessments, test results, known limitations, and what changed after incidents.
- Design reporting paths. Let users, parents, and other stakeholders report unsafe behavior, and spell out how reports get triaged.
- Review data practices separately. Safety controls don't automatically answer questions about consent, collection, retention, or deletion.
This work has a cost. It can slow releases, create friction for users, and require ongoing evaluation as models and features change. But handling safety as a one-time checklist is often more expensive later. The real question isn't whether safeguards can remove all risk. It's whether a company can detect and manage foreseeable risk as the product evolves.
What parents and users should understand
For parents, controls shouldn't be mistaken for a guarantee. It helps to check the settings available, understand the account and data policies that apply, and talk with children about the fact that a chatbot can be wrong or persuasive without being reliable. The level of supervision should depend on the child's age, maturity, and how they're using the service.
For all users, chatbots shouldn't replace qualified medical, mental health, legal, or other professional advice. A fluent answer doesn't prove the system understood the situation - or that its recommendation is safe. If a conversation involves immediate danger or a serious health concern, get appropriate professional or emergency support rather than relying on a chatbot.
These are practical precautions, not a claim that ChatGPT is inherently harmful. They reflect a basic limitation of current conversational AI: it generates responses, but it doesn't provide human judgment, accountability, or a complete view of a user's circumstances.
What companies and users can take from the case
The eight lawsuits are a reminder that AI safety isn't only about model performance. It's also about product design, privacy practices, consumer communications, and governance. Even a model that looks good on technical evaluations can still create real risks if access controls are weak, public claims are overstated, or the company has no reliable way to respond when something goes wrong in the real world.
For companies building or deploying AI, a practical review can start with four questions:
- What are we claiming? Make sure product language is accurate and matches the safeguards that actually exist.
- Who could be affected? Include minors and other vulnerable users in risk analysis instead of treating them as an edge case.
- What evidence do we have? Keep testing, incident, and remediation records showing how the team evaluates safety over time.
- What happens when the system fails? Define escalation steps, user support, and a process for changing or limiting features when needed.
The "right" answer will vary by product. A workplace coding assistant, a general consumer chatbot, and an AI feature aimed at children don't carry identical risks. Using the same checklist everywhere can turn into paperwork without improving outcomes. The goal is to make responsibilities clear and tie them to how people actually use the system.
For policymakers, there's a related question: how can rules protect consumers without being so vague that companies can't tell what compliance requires? The states are asking courts to apply existing consumer protection laws. Whatever the outcome, clearer expectations around age safeguards, data handling, and safety claims would make compliance easier to evaluate - and help users understand what a product offers.
Conclusion
The eight state lawsuits put a clear legal question in front of OpenAI: did the company's safety claims and practices meet its obligations to consumers, including minors? The answer isn't settled yet. OpenAI says it already has safeguards in place; the states argue those measures and the company's public statements weren't enough.
For the wider AI industry, the practical takeaway is simple: safety claims should be specific, safeguards should be tested in real-world use, and data practices should be treated as part of product responsibility. No system eliminates every risk, but companies can make risks visible, build controls around foreseeable failure modes, and explain how they respond when those controls fall short.
If you build or deploy AI, review your product claims, age protections, data practices, and incident-response process before a regulator or a court asks you to explain them. For more details on the lawsuits, read The Verge's coverage of the lawsuits.