Eight U.S. states—Iowa, Kansas, Nebraska, West Virginia, Arkansas, Arizona, Idaho, and Montana—have filed separate lawsuits against OpenAI, alleging that ChatGPT poses significant risks to children and that the company has misrepresented the safety of its platform to consumers. According to Reuters, the lawsuits specifically target what the states characterize as deceptive marketing practices and inadequate safeguards for minors using the service. The coordinated legal action suggests growing consensus among state attorneys general that major AI companies are not adequately addressing child safety concerns. The suits come amid broader national debate over age verification mechanisms, content filtering, and whether AI systems like ChatGPT can reliably prevent exposure to harmful content. OpenAI has previously stated that ChatGPT requires users to be at least 13 years old, though enforcement mechanisms remain unclear. These lawsuits represent a significant escalation beyond individual complaints, indicating states view this as a consumer protection issue comparable to traditional tech platform regulation.
The bankruptcy of Character.AI has triggered a multi-state investigation led by New York Attorney General Letitia James, with 40 state attorneys general filing notices of interest in the proceedings. This coordinated response reveals deep concerns about how AI companies handle user data during financial collapse. Character.AI accumulated vast datasets through its conversational AI platform where users engaged in extended dialogues, potentially sharing sensitive personal information. The bankruptcy filing raises critical questions about data protection obligations when companies fail: Will user conversations be liquidated as assets? Can third parties purchase data from bankrupt AI firms? The scale of the investigation—involving 40 bipartisan state officials—indicates this is viewed as a systemic risk rather than an isolated incident. The Character.AI case has become a test scenario for how bankruptcy courts and regulators will handle AI-generated data assets, setting precedent for the industry.
Meanwhile, security researchers discovered that Eiliko, a cute robot toy marketed for children, transmits conversations to Chinese servers without transparent disclosure. The device's AI companion stores extensive user data on servers in China, creating potential privacy and security vulnerabilities. This discovery raises questions about compliance failures in hardware-based AI products and whether manufacturers adequately inform consumers about data flows. The incident suggests this may not be isolated to one product but representative of broader compliance gaps in connected toy manufacturing. Many AI-enabled consumer devices lack clear data privacy disclosures and implement minimal encryption for transmissions.
These simultaneous crises—state litigation against OpenAI, the Character.AI bankruptcy investigation, and Eiliko's data handling practices—signal that the AI industry still largely treats regulatory risk as a manageable public relations problem rather than a structural business challenge. Most major AI companies have not meaningfully altered product architecture, data retention policies, or disclosure practices in response to emerging legal and regulatory frameworks. Wall Street valuations of AI companies have not substantially declined despite litigation risks, suggesting investors believe either that regulation will remain limited or that litigation costs are acceptable operational expenses. However, the coordination among state attorneys general and the precedent-setting nature of these cases may fundamentally change that calculus. Companies may soon face mandatory compliance audits, substantial fines, and operational restrictions that affect core business models. The question for the industry is whether the current legal environment will force genuine structural reform or merely increase the cost of doing business while protecting companies' fundamental practices.