Eight State Lawsuits Against OpenAI: Why Attorneys General Chose Consumer-Protection Law Over Product Liability

On 14 October 2026, attorneys general from eight states filed separate lawsuits against OpenAI, alleging that ChatGPT endangers children and that the company misleads consumers about how safe it is. The headline is the defendant. The more consequential decision is the legal route: the states did not sue under product-liability law, where a plaintiff must prove a defective product caused a specific injury. They sued under state consumer-protection statutes, which ask a different and in some ways easier question about what OpenAI told the public. That choice shapes what the cases can win, how fast they can move, and what a court could realistically order.

A caveat on method: we have read news reports of the filings, not the complaints. Where the reports disagree or are silent, we say so.

What was filed, and where the reports disagree

The most detailed account is of the Arkansas case, reported by Andrew DeMillo for the Arkansas Advocate and republished by News From The States. Attorney General Tim Griffin, a Republican, filed on Wednesday 14 October in Faulkner County under the Arkansas Deceptive Trade Practices Act and the Arkansas Children and Teens' Online Privacy Protection Act, a 2025 law that created online privacy protections for teenagers. The suit alleges that OpenAI hid ChatGPT's risks and limitations, did not disclose the limits of its safeguards for users discussing drug use and self-harm, and failed to direct users discussing suicide to professional resources. It says those risks were known and were not adequately addressed before ChatGPT was marketed as safe and trustworthy. It also alleges the chatbot encouraged suicide and self-harm, reinforced delusions and emotional dependence, gave dangerous medical advice and helped users plan violence. Griffin's news release said OpenAI assures us that ChatGPT is safe, and the report notes this is his first lawsuit against an AI company.

The relief Arkansas seeks has three layers: civil penalties and restitution; an order requiring clear and conspicuous disclosure of ChatGPT's risks; and an injunction barring further advanced AI testing, and the creation of models capable of recursive self-improvement, until adequate safeguards are in place.

On the number of states, the outlets differ. Engadget, which credits Reuters with first reporting the filings, lists eight attorneys general, each suing in their own state court: Iowa, Nebraska, Kansas, West Virginia, Arkansas, Arizona, Idaho and Montana. The News From The States report lists Iowa, Kansas, Nebraska, West Virginia, Arizona, Idaho, Montana and Utah as the other filers besides Arkansas, which would make nine. We cannot resolve that from the reports, so this article says eight states, according to reports, and treats only Arkansas, Iowa and Nebraska as firmly established. Neither report states a dollar amount, and neither records a substantive OpenAI response; both say the company did not immediately comment.

Engadget adds that Iowa and Nebraska cite rogue-agent incidents, including the Hugging Face hack, and point to a teenager's suicide and an overdose linked to incorrect medical information, both of which are also at issue in separate wrongful-death suits. Some of the states also object to OpenAI retaining data from underage users. These are allegations. None has been tested in court.

Why consumer-protection law instead of product liability

Consider what each route requires, in general terms. State rules vary, and the specifics below describe the usual shape rather than any one statute.

A product-liability plaintiff must show that the product was defective in design, manufacture or warnings, that the defect caused the injury, and that damages followed. Every case therefore turns on individual causation: what did this person ask, what did the system answer, and would the outcome have differed with a safer design? For a chatbot there is an earlier question as well, whether generated text is a product or protected speech. That question is already being fought in private litigation, as we covered in August in our analysis of the consolidated ChatGPT cases, and it is unsettled.

A deceptive-practices claim generally asks something else: whether a company's statements or omissions about its product were likely to mislead consumers. The focus moves from the output to the representation. An attorney general suing on behalf of the state typically does not have to prove that a particular user was injured by a particular answer, because the claim is about the conduct toward consumers as a class. The Arkansas complaint, as reported, is built that way. Its core allegation is that OpenAI marketed ChatGPT as safe while concealing the limits of its safeguards, which is a claim about disclosure rather than about any single conversation.

That framing has practical advantages. It avoids the product-versus-speech fight. It lets the state use evidence about what OpenAI knew internally and said publicly, rather than reconstructing individual chats. And the remedies fit the claim: penalties and restitution for past conduct, and disclosure orders for future conduct. Statutes of this kind commonly allow penalties to be counted per violation, which is why exposure can scale with the number of consumers or statements involved. The reports give no figure, so any estimate of the size of a penalty would be guesswork.

The children's privacy statute in the Arkansas case adds a second theory. Reports describe it only as creating teen privacy protections, and we have not read its text, so we cannot say which duties are invoked. The report that some states object to OpenAI's retention of data from underage users suggests that data handling, not only marketing, is part of the pleadings.

Eight courts, one defendant

Filing in each state's own court has consequences. A ruling in Faulkner County, Arkansas does not bind a court in Iowa or Idaho. Each state's statute defines deception, intent and penalties differently, so the same OpenAI statement could be judged misleading in one state and not in another. Remedies can diverge too: one court might order disclosures, another penalties, a third nothing.

For OpenAI that means defending in several forums at once, with the risk of inconsistent orders. State-led consumer-protection suits have historically been difficult to move into federal court, though we have not seen OpenAI's position on where it wants these heard and do not predict it. Multistate consumer cases have also often ended in negotiated settlements that combine payments with changes in conduct. Whether that happens here depends on facts nobody outside the courtrooms has seen.

The filings follow earlier pressure. News From The States reports that OpenAI received subpoenas from several states earlier in 2026 as they investigated ChatGPT's safety. The suits are the point at which investigation became pleading.

What Arkansas's injunction request would have to survive

Penalties and disclosure orders sit comfortably inside a consumer-protection statute. The request to halt testing of advanced models does not. Consumer-protection laws authorise courts to stop deceptive acts. Arkansas asks for something broader: a pause on a category of research until safeguards exist.

Three obstacles stand out, all hypothetical until a court addresses them. First, the link between the legal violation, deceptive statements, and the remedy, a research pause, would have to be explained. A court can more easily order OpenAI to stop making particular claims or to add particular warnings than to stop a development process. Second, injunctions generally have to describe the restrained conduct specifically, and recursive self-improvement is not a settled technical term. The reports do not say how the complaint defines it. Third, model testing is not confined to Arkansas, so the scope and enforceability of a county court's order would be contested. The most realistic outcome for this particular request is that it is narrowed, traded away in a negotiation, or denied while the disclosure remedies proceed. We offer that as a judgement about the structure of the claim, not a forecast of what a judge will do.

The other side

OpenAI has not, in the reports we read, set out its defence. Engadget notes what the company has done publicly: it rolled out parental controls and child-protection features and endorsed the Kids Online Safety Act, which would require design changes if enacted. In August 2026 OpenAI said it would slow development of its frontier models to improve safety, and in September it signed a voluntary safety pact with other AI companies, organised by the White House. Engadget adds that it is unclear whether these steps have made the development process safer.

Those facts point to the arguments OpenAI would be expected to make: that its statements about safety were accurate or reflected good-faith efforts, that the safeguards it describes exist and are improving, and that attributing any individual's death or overdose to a chatbot involves causal questions the states cannot skip. A consumer-protection claim lowers the bar on injury but not on the core element, which is that a statement or omission was actually misleading. If OpenAI's public descriptions of its safeguards were specific and accurate, the states' case gets harder. If they were broad claims of safety alongside known gaps, it gets easier. That is the evidence the litigation will turn on, and it has not yet been shown.

What to watch

• OpenAI's formal response in each court, including any motion to dismiss on the ground that the statutes do not reach generated output.
• Whether any court rules on how a deceptive-practices statute applies to a chatbot's safety claims, since the first such ruling will be cited in the other seven or eight cases.
• Whether Arkansas presses, narrows or drops the request to halt advanced-model testing.
• Any sign of coordination or settlement talks among the states, and any attempt to consolidate the cases.

The reason to follow the legal route rather than the headline is that it determines who can win what. Product-liability suits ask whether the system was defective. These suits ask whether the company was honest about it. Those are different standards of proof, and an AI developer that is cautious in how it describes its safeguards faces a different risk profile under each.