State Attorneys General Launch Probe Into OpenAI Practices

A coalition of state attorneys general has opened an investigation into OpenAI, the company behind ChatGPT, according to a report from TechCrunch. The probe, whose specific states remain unidentified, is examining a broad range of practices including the company’s advertising policies and its handling of sensitive health data. This marks a significant escalation in the regulatory pressure facing leading AI firms, moving beyond federal inquiries to include state-level enforcement actions.

The Scope of the State Investigation

The investigation appears to be wide-ranging, with questions covering everything from how OpenAI markets its products to how it manages health-related information that might pass through its systems. While the exact legal theories being pursued are not yet public, state attorneys general often leverage consumer protection statutes and data privacy laws in such probes. For OpenAI, this means potential exposure to multiple overlapping regulatory regimes, each with its own standards for transparency, consent, and data security. The involvement of multiple states suggests a coordinated effort, possibly modeled on previous joint actions against major tech platforms over privacy violations.

Implications for AI Governance and Compliance

This development signals a critical shift in the AI regulatory landscape. Until now, much of the focus has been on federal initiatives like the White House’s AI Bill of Rights or the EU’s AI Act. State attorneys general, however, have a proven track record of using their authority to extract significant concessions from technology companies. They can demand internal documents, compel testimony, and negotiate consent decrees that impose lasting operational changes. For AI companies, this means compliance can no longer be a one-size-fits-all strategy. Each state may have different definitions of deceptive advertising or different thresholds for what constitutes protected health information. The investigation also raises questions about how AI firms handle data that users inadvertently share during interactions, a gray area that existing privacy laws do not clearly address.

What Practitioners and Decision Makers Should Watch

For AI practitioners and corporate leaders, the key takeaway is that regulatory risk is becoming a boardroom issue. Companies building or deploying large language models should immediately review their data handling practices, especially regarding any health-related data that might be inferred from user inputs. Advertising and marketing teams need to ensure that claims about AI capabilities are substantiated and not misleading. The investigation also underscores the importance of proactive transparency. Companies that wait for regulators to act may find themselves in a reactive posture, whereas those that voluntarily adopt clear policies and third-party audits may mitigate some of the enforcement risk. Additionally, the lack of clarity about which states are involved makes it prudent to assume that any state with a strong consumer protection office could be next.

The Broader Signal for the AI Industry

This state-level investigation is not an isolated event. It reflects a growing impatience among regulators who see federal efforts as moving too slowly. The attorneys general are positioning themselves as guardians of consumer rights in the AI age, and their actions could set precedents that ripple across the entire industry. For OpenAI, the immediate challenge is to navigate this probe while continuing to scale its products. For the rest of the ecosystem, the message is clear: the window for self-regulation is closing, and the era of active enforcement has begun. The outcomes of this investigation could shape how AI companies approach advertising, data privacy, and health information for years to come.

Source: TechCrunch AI