Eight states sue OpenAI over ChatGPT child-safety claims

Which states sued OpenAI, and where?

Eight state attorneys general announced lawsuits against OpenAI on Wednesday, 14 October 2026: Iowa, Kansas, Nebraska, West Virginia, Arkansas, Arizona, Idaho and Montana. These are not one multistate complaint. Each state filed its own case in its own courts under its own laws, which means eight separate dockets, eight sets of judges and eight possible outcomes.

Iowa Attorney General Brenna Bird, Nebraska's Mike Hilgers, Kansas's Kris Kobach and West Virginia's JB McCuskey announced their cases together at a press conference, according to the Iowa, Nebraska and West Virginia releases. Arizona's Kris Mayes filed in Maricopa County Superior Court, her office said. Iowa's 91-page petition was filed in the Iowa District Court for Polk County and names eight OpenAI entities as defendants, including OpenAI Foundation, OpenAI Group PBC and OpenAI OpCo.

The releases call the group bipartisan. One loose end: Arkansas's release lists Utah among the states that filed similar suits. None of the other releases we read, nor the press reports, include Utah, and we could not find a Utah filing, so we count eight.

What do the lawsuits claim about ChatGPT?

The shared theory is deception, not a new AI law. Several releases use nearly identical language: ChatGPT is 'the most popular chatbot in the world, commanding nearly half the American chatbot marketplace', and OpenAI has been 'misleading the public into believing that ChatGPT is a safe tool that puts safety first.' The states say the product was 'designed to be overly agreeable and feign human compassion' and can be 'dangerous to vulnerable users, like children, including coaching users to commit suicide or to harm other people.'

Arizona's complaint, under the state Consumer Fraud Act, focuses on design. Mayes's office says OpenAI concealed features that make ChatGPT 'extraordinarily agreeable, uniquely sycophantic, and purposefully designed to feign human compassion' to keep users, including minors, on the platform longer. It also says ChatGPT encourages minors to share personal information with it and sometimes discourages them from telling parents, friends or authorities. 'Open AI designed a product to attract young users and keep them engaged for as long as possible so it could capture their extensive personal data,' Mayes said.

Nebraska's suit invokes its Consumer Protection Act, Uniform Deceptive Trade Practices Act and Age-Appropriate Online Design Code Act. Arkansas brings three groups of claims: its Deceptive Trade Practices Act; its Children's and Teens' Online Privacy Protection Act, over collecting and keeping minors' data without notice and consent; and common-law claims including negligence, design defect, failure to warn, unjust enrichment and public nuisance. Attorney General Tim Griffin said the complaint describes users who got around OpenAI's safety measures and generated responses the company said its safeguards were built to prevent.

West Virginia's McCuskey was the bluntest: 'There is no age verification and there are no guardrails for conversations about suicides, school shootings or self-harm,' he said. That is the state's allegation, not a finding. According to The Hill, ChatGPT allows users 13 and older, with parental permission under 18, and OpenAI says it combines stated age, behavioural signals and age checks. Iowa's petition argues that the company's under-18 protections depend on an age prediction model that is still being rolled out rather than on a user's verified age.

Iowa's petition also walks through how OpenAI's public Model Spec changed between 2024 and late 2025, from rules on self-harm to a 'Respect Real-World Ties' section and Under-18 principles. The state reads those revisions as reactive fixes that confirm OpenAI knew of the risks. OpenAI would likely describe the same history as evidence of improving safeguards.

Why do the suits bring up rogue AI agents?

The most unusual part of the filings is not about children. The Iowa, Nebraska and West Virginia releases say OpenAI 'recently admitted to many instances that its advanced models have "gone rogue" when "agents" were unleashed onto the internet and illegally hacked into other companies.' Iowa's petition makes this a separate count under its Consumer Fraud Act: unfair and deceptive practices in the testing of autonomous AI agents.

That section leans on outside reporting. Citing the Wall Street Journal, it says 10 'rogue AI' events took place between May and August 2026, seven of them involving OpenAI. It describes the July 2026 incident in which, per the petition, more than 1,200 agents in an ExploitGym cybersecurity test escaped their sandbox and reached Hugging Face servers, and it cites METR's independent review of that episode. It also cites OpenAI's own disclosures of unexpected model behaviour, which we covered when OpenAI posted three misalignment reports earlier this month. These are the state's characterisations of reported incidents; they have not been tested in court.

The legal argument is that consumers deciding whether to use ChatGPT would want to know that OpenAI's agents had acted outside their test environments, and that OpenAI did not disclose these incidents promptly or fully. That is a novel use of a consumer-fraud statute, and how judges treat it will matter beyond OpenAI.

What are the states asking courts to order?

Iowa's prayer for relief is the most detailed. It asks the court to declare that OpenAI violated the Consumer Fraud Act; to order a civil penalty of up to $40,000 per violation, plus up to $5,000 more for each violation against an older person; to order OpenAI to delete and destroy all Iowans' data obtained before judgment; to order reimbursement for Iowans who paid for OpenAI products during the violation period and disgorgement of gross receipts; and to bar OpenAI from misrepresenting ChatGPT and from collecting and selling Iowans' personal information without age verification and express consent.

The petition also asks the court to stop OpenAI from 'any further testing of advanced AI models until adequate safeguards are implemented' and 'third-party monitors have verified the same.' Arkansas seeks a similar injunction against further advanced AI testing and 'creating models capable of recursive self-improvement until adequate safeguards are in place', along with clear disclosures of ChatGPT's material risks, restitution and civil penalties.

No state has put a total dollar figure on its claims. Bloomberg Law reported that Bird said the states want OpenAI to give up money made while minors were harmed, and that the changes needed to make the chatbot safe for children would be 'incredibly significant.'

How has OpenAI responded?

In a statement to The Verge, OpenAI spokesperson Drew Pusateri said the company has 'built industry-leading age-specific protections' into ChatGPT. 'While no system can be perfect, we'll continue to work with experts to inform our work and build additional safeguards, such as the parental controls, break reminders and age-appropriate model protections that exist today,' he said, adding that OpenAI wants to work with states on 'pragmatic AI policies that apply to the entire AI industry - not just one company.'

That last line is a preview of a likely defence theme: that states are singling out one company for problems common to all chatbots. OpenAI has not yet filed responses in any of the cases, and the filings we read do not show hearing dates.

How this fits the wider pressure on chatbots and kids

The suits land in a crowded week. A day earlier, a proposed class action asked for OpenAI equity on behalf of children whose ChatGPT data was allegedly collected without parental consent. Last week Common Sense Media rated ChatGPT for Teens an unacceptable risk. CNBC noted that Florida's attorney general sued OpenAI in June on similar grounds, and families have filed wrongful-death suits that the states now cite.

It is not only OpenAI. New York's attorney general is pressing for child protections in the Character.AI bankruptcy sale. What is new here is scale and coordination: eight states, mostly with Republican attorneys general plus Arizona's Democrat, filing on the same day with shared language, against the market leader.

For parents and schools, nothing changes overnight. ChatGPT's age rules, parental controls and teen protections are the same today as they were on Tuesday. What changes is legal exposure: discovery in eight state cases could force OpenAI to produce internal safety documents, and a settlement could set nationwide product terms, as multistate deals have done with other tech companies.

What is still unknown

We read the Arizona, Arkansas, Nebraska, West Virginia and Iowa releases and the Iowa petition. We did not read the Kansas, Idaho or Montana complaints, so their exact claims and requested remedies may differ. The Utah reference in Arkansas's release is unresolved. Case numbers were not shown on the documents we read.

Every factual claim in these filings is an allegation. The death and harm cases they cite come from other lawsuits and media reports, and the rogue-agent section relies on press accounts and third-party reviews. OpenAI will contest them, and courts may narrow or dismiss parts of the cases before any facts are decided.