The States Sue Where Congress Won’t

Key points

• Eight US state attorneys general sued OpenAI in their own courts on 14 October 2026 under existing consumer-protection and privacy laws; Montana asks a judge to bar OpenAI from processing personal data until ChatGPT verifies users’ ages.
• Pennsylvania passed its Artificial Intelligence Deceptive Advertising Act (SB 806) on 7 October, sending it to Governor Josh Shapiro; two New Jersey Assembly committees take up AI bills on 19 October; New York’s data-centre moratorium bill has yet to reach Governor Kathy Hochul.
• Executive Order 14365 seeks federal preemption of conflicting state AI laws but excludes child-safety and data-centre rules from its legislative proposal, and a public tracker of the stalled FY2027 defence bill records no preemption clause.

On 14 October 2026 eight American states sued OpenAI, each in its own courts under laws written long before generative AI. Arizona, Arkansas, Idaho, Iowa, Kansas, Montana, Nebraska and West Virginia accuse the maker of ChatGPT of deceiving parents about the chatbot’s safety and of harming children, NBC News reported. In the same fortnight Pennsylvania passed an AI advertising bill and New Jersey listed four AI bills for committee discussion, while Congress’s annual defence bill sits in the Senate until after the 3 November midterms. For any government that buys, deploys or regulates chatbots, the working rulebook is being set by attorneys general and state legislators. This piece sets those actions, drawn from the filings and bill texts, against the federal government’s own preemption plan.

Eight suits rest on consumer law that already exists

Iowa’s Attorney General Brenna Bird, joined at the Iowa Capitol by West Virginia’s JB McCuskey, Nebraska’s Mike Hilgers and Kansas’s Kris Kobach, said the group, which she called bipartisan, chose to sue state by state so each could use its own consumer-fraud statute, Iowa Capital Dispatch reported. Hilgers was blunt: “I want to make sure that Nebraska parents are on a Nebraska jury …”

Montana’s 97-page complaint in State of Montana ex rel. Knudsen v. OpenAI Global, LLC et al., filed in the First Judicial District Court for Lewis and Clark County, pleads six causes of action: two under the Montana Consumer Protection Act, one under the Montana Consumer Data Privacy Act, plus negligence, design defect and failure to warn. It alleges ChatGPT asks for neither proof of age nor affirmative consent before collecting sensitive data. Montana seeks $10,000 per consumer-protection violation, $7,500 per privacy violation and an injunction barring OpenAI from processing personal information until it requires age verification. It also asks the court to confine the deployment and testing of advanced models to “a secured, independently verified testing environment” and to make OpenAI report to the attorney general any model or agent that escapes its intended controls.

Iowa’s petition cites suits by parents over the deaths of teenage children, according to Iowa Capital Dispatch; Montana’s complaint recounts deaths that are the subject of separate litigation. None of the allegations has been tested in court.

OpenAI defends its safeguards. Drew Pusateri, its spokesperson, said in a written statement that the company has “built industry-leading age-specific protections into our product that many other AI products lack” and wants policies covering the whole industry rather than one company, according to NBC News.

Kobach cast the suits as a substitute for Congress. “Regulating AI through legislation and just hoping that someday, somehow, we have a standard … is a fool’s errand,” he said, per NBC.

Three statehouses are writing new duties of their own

Pennsylvania is closest to a new statute. The House gave Senate Bill 806 final passage by 163 votes to 40 on 7 October, after a 48–2 Senate vote on 10 June; the General Assembly’s record shows no executive action yet. Under the final text, Printer’s No. 1808, an advertiser who knowingly, recklessly or wilfully uses synthetic content to mislead consumers about a product’s nature, origin or authenticity must carry a clear and conspicuous AI disclosure. Parody, satire, commentary, obvious fiction and text-only content are exempt. The attorney general or a district attorney can seek an injunction, and courts can impose a fine of up to $3,000. The sponsor, Senator Nick Pisciottano, said consumers “deserve to know if AI is being used to create a false impression”; NetChoice, an industry group, warned that “rules this prescriptive” could swamp short videos and audio spots, MediaPost reported. Because the bill covers advertised goods and services, synthetic political advertising of the kind examined in Slopaganda falls outside it.

In New Jersey, the legislative calendar shows the Assembly Science, Innovation and Technology Committee meeting at 1:00 pm today in Trenton for invited testimony on AI, with four bills listed “for discussion only”, so no vote. The weightiest, A5090, the GAI Accountability Act, would fine the owner, operator or developer of any generative-AI platform reachable from New Jersey $20,000 per violation if it failed to stop the platform from conduct that would be a listed crime, from murder to creating child sexual abuse material, if a person did it, or from supplying information that would amount to aiding one. Reasonable preventive efforts are a defence; the attorney general enforces. At 10:00 am the Assembly Public Safety and Preparedness Committee takes up A5607, on content and data-privacy duties for chatbot providers.

New York’s decision rests with one person. The Senate passed A11560, the Responsible Data Center Development Act (companion S10642), by 43 votes to 17 on 4 June, and its site records no delivery to the governor. The bill would bar the Department of Environmental Conservation from permitting data centres with peak demand of 20MW or more for a year, then require host-community hearings and an environmental impact report. The bill is expected on Hochul’s desk by year-end, and its sponsor, Senator Kristen Gonzalez, is “looking forward to working with the governor’s office on a conversation about chapter amendments”, she told City & State in an interview published by Route Fifty.

The federal preemption plan leaves the states’ strongest ground alone

Executive Order 14365 of 11 December 2025 told the attorney general to create an AI Litigation Task Force whose “sole responsibility” is to challenge state AI laws at odds with federal policy, and asked White House advisers to draft legislation preempting such laws. Yet Section 8(b) says that draft “shall not propose preempting otherwise lawful State AI laws relating to” child safety, AI compute and data-centre infrastructure (bar generally applicable permitting reform), or state procurement and use of AI.

The attorney-general suits are child-protection cases under general consumer law, and New York’s bill is a data-centre permitting measure: both sit on ground the administration’s own proposed legislation would leave alone. Pennsylvania’s advertising rule and New Jersey’s developer-liability bill do not, which makes them likelier targets. The carve-outs bind only the legislative proposal, however; the Task Force may still challenge any state AI law it judges unlawful.

Congress has not acted. The House passed H.R. 8800, its FY2027 National Defense Authorization Act, on 22 July; a Senate cloture vote on proceeding to S. 4784 failed 50–46 on 14 July; and the Senate returns the week of 9 November, with a compromise expected in December and government funding due to expire on 11 December, according to the NDAA.AI tracker. The tracker records no state-AI preemption clause; AI & GPP has not checked the full bill texts. Preemption would have to arrive as a late addition. The contest set out in California v Washington now has more players.

What buyers and regulators should do now

Public bodies running or buying citizen-facing chatbots should treat Montana’s requested remedies as a checklist: age assurance, consent before sensitive data is collected, and prompt notice when a model escapes its controls. Contracts can demand all three now, whatever the courts decide; The State’s Chatbot Has Opinions explored the risks of a state-branded assistant. Agencies placing synthetic-media advertising in Pennsylvania should prepare disclosures in case Shapiro signs SB 806.

Watch today’s New Jersey hearings, Shapiro’s decision, OpenAI’s responses to the eight complaints and the December NDAA text, where any preemption language would surface before the 11 December funding deadline.

Questions this answers

Why are US states suing OpenAI rather than waiting for a federal AI law?
The attorneys general say Congress has failed to act; Kansas’s Kris Kobach called hoping for a legislated standard “a fool’s errand”. Suing under existing consumer-protection laws lets each state act now in its own courts, NBC News reported.

What would Pennsylvania’s SB 806 require of advertisers?
Advertisers could not use AI-generated or AI-altered content to mislead consumers about a product’s nature, origin or authenticity without a clear and conspicuous disclosure. Parody, satire and text-only content are exempt; fines run up to $3,000, under the bill text.

Will federal law override state AI rules this year?
Not yet. The FY2027 defence bill awaits a December compromise and the NDAA.AI tracker records no preemption clause. Executive Order 14365 seeks preemption but excludes child-safety and data-centre rules from its legislative proposal.

Sources

1. Eight states sue OpenAI over ChatGPT’s alleged harms to users — NBC News, 14 October 2026
2. Iowa Attorney General Brenna Bird, other AGs move to sue OpenAI in state courts — Iowa Capital Dispatch, 14 October 2026
3. State of Montana ex rel. Knudsen v. OpenAI Global, LLC et al., Complaint — Montana Department of Justice, 14 October 2026 (PDF)
4. Senate Bill 806 Information, 2025–2026 Regular Session — Pennsylvania General Assembly, last action 7 October 2026
5. Senate Bill No. 806, Printer’s No. 1808 (Artificial Intelligence Deceptive Advertising Act) — Pennsylvania General Assembly, as amended 10 June 2026
6. Pennsylvania Passes Bill Requiring Disclosure Of Misleading AI In Ads — MediaPost, 8 October 2026
7. Legislative Calendar — New Jersey Legislature, posted 16 October 2026
8. Assembly No. 5090, GAI Accountability Act (as introduced) — New Jersey Legislature, 14 May 2026 (PDF)
9. Senate Bill S10642, Responsible Data Center Development Act — New York State Senate, actions to 4 June 2026
10. Kristen Gonzalez and the fight to regulate AI — Route Fifty, 9 October 2026
11. Executive Order 14365, Ensuring a National Policy Framework for Artificial Intelligence — The White House, 11 December 2025
12. FY2027 NDAA Status: Not Passed, Lame Duck — NDAA.AI, status as of 1 October 2026, page dated 16 October 2026