Eight States Sue OpenAI as the FTC Demands Its Safety Records: Why Your AI Safety Claims Are Now Evidence (AI Trends, 16 October 2026)

What’s trending in AI on 16 October 2026: The rules for AI chatbots are now being set in courtrooms and subpoenas, not in new statutes. On Wednesday, the attorneys general of eight states (Arizona, Arkansas, Idaho, Iowa, Kansas, Montana, Nebraska and West Virginia) filed coordinated lawsuits against OpenAI, each in its own state court. They allege that ChatGPT harmed children and that the company misled parents and users about how safe it is. The same day, Axios reports, the Federal Trade Commission sent OpenAI and Anthropic civil investigative demands, each more than 50 pages long, asking for records on security incidents, safeguards, marketing and privacy policies. On Thursday the White House’s new AI task force adopted its charter, with the FTC chair leading its law enforcement and consumer protection committee. None of this depends on a new AI law. It runs on consumer protection rules that already cover every business that markets a product, including any company that puts a chatbot in front of customers. Below: what the states allege and want, what the FTC is asking for, why safety claims are the pressure point, and a claim-to-evidence audit you can run on your own AI features this month.

Key takeaways

Eight states, eight courts. The suits are coordinated but separate, each brought under the state’s own consumer protection law. Florida sued in June, so at least nine states are now in court against OpenAI.
The asks go beyond fines. The states want penalties, clearer risk disclosures and product changes for minors. Some object to OpenAI keeping data from underage users, and Arkansas wants testing of advanced models halted until safeguards are in place.
The FTC has moved from probe to paperwork. Its demands to OpenAI and Anthropic cover security incidents, safeguards, marketing and privacy. Executive testimony and demands to other AI organisations are expected to follow.
Safety claims are the trigger. Consumer protection cases turn on the gap between what a company said about its product and what the product did.
Deployers are exposed too. The same laws apply to any business marketing an AI feature to the public. Check your claims, age controls, data retention and incident records now.

No new AI law was needed. Existing consumer protection rules are doing the work.

1. What the eight states filed

Iowa Attorney General Brenna Bird announced the action at the Iowa State Capitol on 14 October, joined by Kansas’s Kris Kobach, Nebraska’s Mike Hilgers and West Virginia’s JB McCuskey, according to States Newsroom. Arkansas, Arizona, Idaho and Montana filed in their own courts the same day. The coalition is bipartisan. Each suit stands alone, so each state controls its own timetable and could settle separately.

The core allegations, as reported by Engadget, Tech Insider and the Business and Human Rights Resource Centre (summarising NBC News), are broadly the same across the complaints. The states say ChatGPT is designed in ways that encourage heavy use and emotional dependence, which makes it especially risky for children and other vulnerable users. They say it has given dangerous medical advice and responses that encouraged self-harm or violence. And they say OpenAI’s marketing overstated how safe the product is for minors, while its safeguards and parental controls were inadequate. Iowa’s petition cites private wrongful-death suits filed by parents. Engadget reports that Iowa and Nebraska also point to rogue agent behaviour, including the Hugging Face hack, as evidence that OpenAI’s safety statements did not match reality. Bird put it bluntly: “OpenAI is hurting kids and they are lying to Iowans.”

These are allegations, not findings. OpenAI has not been found liable for anything, and it has not conceded the allegations. Bird said separate suits let each attorney general use their own state’s consumer fraud law. Kobach argued that waiting for Congress made little sense, noting that more than 150 AI-related bills have been introduced there and few have moved.

Nine states now have suits on file, and most of the country has already used its investigative powers.

2. What the states want from OpenAI

Because consumer and child protection laws differ from state to state, so do the remedies. Engadget’s summary of the filings lists financial penalties, clear disclosure of product risks, an end to practices the states consider deceptive, and changes to how OpenAI develops its models and advertises what they can do. Tech Insider adds that some complaints seek court orders changing how ChatGPT works for children, plus civil penalties, damages or the surrender of profits earned from young users. Several states object to OpenAI keeping data collected from minors. The most far-reaching request comes from Arkansas, which asks the court to stop testing of advanced AI models until adequate safeguards are in place.

State	Who announced	What stands out
Iowa	AG Brenna Bird	Petition in Iowa district court; cites false medical advice, self-harm and violence responses, and private wrongful-death suits
Nebraska	AG Mike Hilgers	With Iowa, points to rogue agent incidents such as the Hugging Face hack; says the unrestricted version is not appropriate for children
Kansas	AG Kris Kobach	Argues states cannot wait for Congress to act
West Virginia	AG JB McCuskey	Says the aim is protecting children, not stopping AI development
Arkansas	Attorney General’s office	Asks the court to halt testing of advanced AI models until adequate safeguards exist
Arizona, Idaho, Montana	Attorneys General’s offices	Allege misleading statements about ChatGPT’s safety
Florida (1 June 2026)	AG James Uthmeier	Deceptive trade practices, negligence and public nuisance claims; names Sam Altman personally

Sources: States Newsroom, Engadget and Tech Insider (14 Oct 2026); ABA Journal (2 Jun 2026). Remedies vary by complaint.

OpenAI’s public response leans on what it has already shipped. A spokesperson told reporters the company has built age-specific protections that many rival products lack, and it pointed to parental controls, break reminders and age-appropriate model behaviour. Tech Insider notes that in September it launched a restricted ChatGPT mode for users aged 13 to 18; our look at the GPT-6 safety card covers where teens still lose out. Engadget notes OpenAI has also endorsed the federal Kids Online Safety Act, said in August it would slow frontier development for safety, and signed the voluntary White House AI accord in September.

3. What the FTC is demanding from OpenAI and Anthropic

The FTC’s investigation was first confirmed on 30 September, the day after major AI companies signed the White House accord, as The Next Web reported at the time. We covered the agent-permission side of that probe in “Allow Always” is the new “I Agree”. What changed this week is that the agency moved from saying it was investigating to demanding documents. According to Axios, the FTC sent civil investigative demands to OpenAI and Anthropic on Wednesday. These are compulsory, subpoena-like requests used to gather evidence before a possible lawsuit.

Three of the four categories are about what a company says and records, not just what its model does.

Axios reports that each demand runs to more than 50 pages and seeks documents on security incidents and safeguards, marketing materials and privacy policies. The FTC also plans to compel top AI executives to testify, and demands to third-party AI organisations will come later. A person familiar with the probe told Axios it focuses on possible consumer protection violations. OpenAI told Axios: “We will engage constructively with the FTC.” Axios did not report a response from Anthropic.

4. Why safety claims are the pressure point

Put the state suits and the FTC demands side by side and the legal theory is the same. Neither needs to prove that AI is dangerous in the abstract. They need to show a gap between what a company told consumers and what its product actually did, or that a practice caused harm people could not reasonably avoid. That is why the FTC wants marketing materials and privacy policies next to incident records, and why the states focus on what parents were told. A company that promised a safe product while logging failures that contradict the promise has handed regulators their case.

This also explains why sweeping public statements carry legal risk. Bird quoted Sam Altman’s recent Politico remark that the world should accept some bad things in exchange for AI’s benefits, a comment we discussed in Washington picked speed, and said the states refuse to accept that. In consumer protection cases, a chief executive’s words become exhibits. The same logic sits behind the shift we described in “The AI did it” is no longer a defense: once an incident is documented, nobody gets to say the model acted on its own.

5. The federal layer: a task force, a reporting mandate and an open letter

The FTC is not acting alone. Semafor reports that the White House AI task force held its first official meeting on 15 October, adopted its charter and gave itself 120 days. It is chaired by Director of National Intelligence Jay Clayton, with FTC Chair Andrew Ferguson among the vice chairs and in charge of a law enforcement and consumer protection committee that includes the Justice Department. Defense Under Secretary Emil Michael will lead work on protocols for AI labs to report breaches and hacks to the government. Axios adds that the group had already announced an industry-wide mandate to report and fix incidents immediately, which builds on the incident reporting rule we covered earlier this month. How any of it will be enforced is still unclear.

Researchers are pushing too. Crypto Briefing reports that roughly 400 scientists from 34 countries, including Geoffrey Hinton and Yoshua Bengio, signed an open letter this week asking developers to keep hacking-capable models cut off from the internet by default and to set up an international body that tracks containment failures. In Europe, Brussels has made its first AI Act enforcement moves.

The pace picked up sharply in the second half of 2026.

6. What this means if your business deploys AI

It is tempting to read this as a problem for OpenAI and Anthropic alone. It is not. State consumer fraud acts and the FTC Act apply to any business that markets a product to the public, whether that product is a frontier model or a support bot built on one. If your website calls your assistant “safe”, “accurate”, “private” or “suitable for families”, those words are claims you may have to back up. Three points matter most.

Your vendor’s safeguards are not your safeguards. A model provider’s teen mode or content filters do not automatically carry over to a custom app built on its API. If your product can reach minors, you need your own age signals and your own limits. Data about minors is a separate liability. Several states object to OpenAI keeping data from underage users, and as we saw when Character.AI filed for bankruptcy, chat logs outlive the companies that collect them. Your incident log is discoverable. The FTC asked for incident records next to marketing for a reason. Keeping records is right; records of known failures you never fixed are the worst position to be in.

Work backwards from the evidence: if you cannot produce it, change the claim.

7. The claim-to-evidence audit

Put marketing, product, legal and security leads in one room for about 90 minutes and collect every public statement about your AI features: web copy, app store listings, help centre pages, sales decks, press quotes and terms of service. Then run each claim through the matching row below. Any claim without evidence gets rewritten or removed, and any evidence that contradicts a claim gets escalated.

If you say…	A regulator will ask…	Evidence to have on file	Red flag
“Safe” or “family-friendly”	Safe for whom, tested how?	Dated red-team and harmful-content tests on your configuration, not only the vendor’s	Only the model provider’s safety card
“Not for children” or “18+”	How do you know who is using it?	Age signals, what happens when a minor is detected, and how often it triggers	A checkbox and nothing else
“Private” or “we don’t train on your data”	Where does chat data go, and for how long?	Data map, vendor contract terms, retention schedule, deletion process	Vendor terms that allow training or long retention
“Accurate” or “expert advice”	What is the error rate in health, legal or financial answers?	Evaluation results, topic restrictions, escalation to humans	No limits on medical or financial questions
“Human oversight”	Who reviews, how often, with what authority?	Named owners, review logs, kill-switch test results	Oversight exists only in a policy document
“Secure”	What incidents have occurred, and what changed?	Incident log with dates, root causes, fixes and any customer notices	Known incidents with no recorded fix

Delana audit template. Adapt the rows to your own claims; this is not legal advice.

Once the audit is done, work through this sign-off list before your next AI feature launch or marketing refresh:

☐ Every AI claim has an owner who can produce its evidence within a week.
☐ Absolute words are gone. Replace “safe” and “accurate” with specific, testable statements about what the feature does and does not do.
☐ Age handling is decided. Either you block minors with more than a checkbox, or you have a defined experience for them.
☐ Minors’ data has its own retention rule, shorter than adults’ and covered in your vendor contract.
☐ High-risk topics are fenced. Medical, self-harm, legal and financial questions route to safe responses or humans.
☐ Incidents close the loop. Every logged failure has a fix, a date and, where needed, a customer notice.
☐ Your AI vendor has answered in writing what it will provide if a regulator asks you for records about its model.
☐ Leadership is briefed. Executives know that public remarks about AI risk can end up in a complaint.

8. The bottom line

For most of 2026 the AI policy debate has been about whether Washington would pass AI rules. This week showed that the enforcers are not waiting. Eight state attorneys general and the FTC are using powers they already had, and the questions they are asking are ones any company can face: what did you promise, what did you know, and what did you do about it? The companies that come through this well will be the ones whose marketing, product controls and incident records tell the same story. Run the audit before someone else runs it for you.

Frequently asked questions

Which states sued OpenAI over ChatGPT in October 2026?

Arizona, Arkansas, Idaho, Iowa, Kansas, Montana, Nebraska and West Virginia filed separate, coordinated lawsuits on 14 October 2026, each in its own state court. Florida filed its own suit against OpenAI and Sam Altman on 1 June 2026.

What do the states accuse OpenAI of?

They allege that ChatGPT harmed children and other vulnerable users, including through dangerous medical advice and responses encouraging self-harm or violence, and that OpenAI misled parents and consumers about its safety in violation of state consumer protection laws. The allegations have not been proven, and OpenAI has not conceded them.

What remedies are the states seeking?

Remedies vary by state but include financial penalties, clearer risk disclosures, an end to allegedly deceptive practices and changes to how ChatGPT works for children. Some states object to OpenAI retaining minors’ data, and Arkansas asks the court to halt testing of advanced AI models until adequate safeguards are in place.

What did the FTC ask OpenAI and Anthropic for?

According to Axios, the FTC sent both companies civil investigative demands of more than 50 pages each, seeking documents on security incidents, safeguarding practices, marketing materials and privacy policies. The agency also plans to seek testimony from top executives and to send demands to other AI organisations.

Does this affect businesses that only use AI tools?

Yes. State consumer protection laws and the FTC Act apply to any business marketing a product to consumers, including chatbots built on OpenAI, Anthropic or other models. Claims about safety, privacy or accuracy need evidence, and a model provider’s safeguards do not automatically cover your own app.

What is the White House AI task force doing?

Semafor reports the task force adopted its charter on 15 October 2026 with a 120-day agenda. It commissioned risk reports on cyber and critical infrastructure, biosecurity, and model control, is developing breach reporting protocols for AI labs, and set up a law enforcement and consumer protection committee led by FTC Chair Andrew Ferguson.