KEYPOINT: A recent putative class action filed in the U.S. District Court for the Northern District of California against OpenAI highlights the challenges artificial intelligence (AI) providers face in restricting minors’ access to their services, and underscores the importance of maintaining guardrails that actually enforce a service’s terms and conditions.
The complaint, a first of its kind, argues that minors could not have legally consented to the use of ChatGPT and its collection and use of their data to train its large language models (LLM). The complaint further alleges that, because minors could not have consented, OpenAI was improperly and unjustly enriched from the extensive sensitive and confidential minors’ data it was designed to elicit to advance the model. While the complaint presents a novel legal argument regarding consent and AI usage, and the allegations are unproven at this time, the filing of the complaint raises important questions about regulatory compliance for AI used by minors, as well as the importance of implementing and enforcing algorithmic guardrails.
Link to The Complaint The Complaint
On October 13, 2026, Jane Doe, on behalf of her minor children, MC1 and MC2,1 filed Jane Doe v. OpenAI Foundation, et al.,2 a 439-paragraph complaint against OpenAI Foundation, OpenAI OpCo, LLC, OpenAI Holdings, LLC, and OpenAI Group PBC (collectively, OpenAI).
The complaint’s theory of liability generally has four components. The first component focuses on minors, including MC1’s and MC2’s usage of ChatGPT. The complaint alleges that minors’ use of chatbots, including ChatGPT, is very prevalent, citing research showing that more than half of all teens ages 13 and 14 use chatbots. The complaint further alleges that this usage is exploitative, as the chatbots are designed to promote continued usage and to elicit confidential and sensitive information. Specifically, the complaint alleges that ChatGPT is intentionally programmed to speak in the first person, mirror minors’ communication styles, engage in a sycophantic way, use its “memory” to learn from communications, and “chatbait” or solicit further communications through follow-up questions or offers to continue the conversation. Importantly, the complaint alleges that ChatGPT is programmed with the above even when the user informs the agent that it is a minor, and below the age required by ChatGPT’s terms and conditions.
The second component focuses on the alleged illicit motive for ChatGPT’s exploitative features. Plaintiffs allege that ChatGPT intentionally allows this conduct to occur because of the invaluable and irreplaceable training data it is receiving. The complaint alleges at length both the importance of training data for AI models and the great value ChatGPT is gaining, in the quality of the model and the corresponding market share and value of its company.
The third component is where the novel legal theory is introduced. Anticipating that OpenAI will argue that it has consent to collect and use any data shared with or generated by ChatGPT pursuant to its terms and conditions and privacy policy, plaintiffs rely on multiple California statutes to argue that minors are incapable of meaningfully entering into and consenting to OpenAI’s agreements. First, plaintiffs argue that Section 1568.5 of the California Civil Code precludes OpenAI from relying on minors’ representation of their parents’ consent. The complaint alleges that despite OpenAI’s terms and conditions requiring all users to be at least 13 years old and to have the consent of their parent or legal guardian, OpenAI takes no action to ensure parents actually consent. Instead, plaintiffs allege OpenAI relies solely on the user’s agreement to the terms and conditions at enrollment as representation that the minor has received parental consent, a reliance the California statute precludes. Second, plaintiffs argue that California Family Code Sections 6701(a) and (c) require any contract between a minor and ChatGPT be void ab initio. Plaintiffs assert that both sections of the California statute, which have been in existence in some form for at least 150 years, preclude minors from entering into “a contract relating to any personal property not in the immediate possession or control of the minor” or from entering into a contract that involves a “delegation of power.” As framed by plaintiffs, all of the inputs and outputs of ChatGPT constitute personal property that the minor did not possess or control at the time the minor agreed to OpenAI’s terms and conditions and privacy policy, and therefore the terms and conditions and privacy policy are void ab initio.
The fourth component addresses the unjust nature and potential remedy for OpenAI allegedly using minors’ personal property for its own gain without legal right to do so. Plaintiffs assert that OpenAI’s intentional exploitation of minors for its own gain and without consent amounts to unjust enrichment. Citing to early 20th century case law, plaintiffs assert that since there is no way to untrain OpenAI’s algorithms to remove millions of minors’ data, plaintiffs and the putative class are entitled to compensation based on the value of the model, which could be distributed either through ownership shares in the model or cash value based on token usage.
Reliant on the foregoing, the complaint seeks the certification of a nationwide class defined as “[a]ll person in United States who clicked ‘Continue’ on ChatGPT’s Terms of Use when they were under 18 years old and subsequently provided one or more tokens of data to OpenAI through ChatGPT from November 2022 through the present.” On behalf of plaintiffs and the putative class, the complaint seeks declaratory relief under California Civil Code § 1568.5 and California Family Code § 6701(a) and § 6701(c), and relief for unjust enrichment.
Link to Parallel Regulatory Scrutiny: The Multistate AG Actions Parallel Regulatory Scrutiny: The Multistate AG Actions
The Doe complaint does not stand alone. On October 14, 2026, one day after it was filed, the state attorneys general (AG) of Arizona, Arkansas, Idaho, Iowa, Kansas, Montana, Nebraska, and West Virginia each filed a separate lawsuit against OpenAI in their own state courts, rather than joining a single consolidated action. The bipartisan suits were announced jointly at a press conference in Des Moines, and they build on an enforcement effort that began in June 2026, when Florida AG James Uthmeier sued OpenAI alleging that it knowingly released an unsafe product. None of the states’ allegations has been adjudicated, and OpenAI disputes them, pointing to age-specific safeguards such as parental controls, break reminders, and age-appropriate model protections.
Notable Distinctions. Although each complaint is anchored in consumer protection law, several states layer on privacy- and child-specific statutory claims. Montana pleads two counts under the Montana Consumer Protection Act and one under the Montana Consumer Data Privacy Act, together with common-law negligence, design-defect, and failure-to-warn counts. Montana’s privacy count relies on Mont. Code Ann. § 30-14-2811, which bars a controller that actually knows or willfully disregards that a user is a minor from using a “system design feature to significantly increase, sustain or extend a minor’s use” of an online service without the required consent, which must come from a parent or guardian for users under 13. Nebraska invokes its Consumer Protection Act, its Uniform Deceptive Trade Practices Act, and its Age-Appropriate Online Design Code Act. Arkansas asserts claims under its Children and Teens’ Online Privacy Protection Act, along with common-law claims for negligence, strict liability for design defect and failure to warn, unjust enrichment, and public nuisance.
Requested Relief. The remedies sought are notable for their prospective, operational reach. Beyond civil penalties and damages, the states seek disgorgement of profits generated from young users, deletion of certain user data, limits on collecting minors’ data, and injunctions requiring changes to how ChatGPT operates. Montana, for instance, seeks penalties of $10,000 per Consumer Protection Act violation and $7,500 per privacy violation, deletion of personal information acquired in violation of its privacy law, and a bar on further processing until OpenAI requires age verification. Arkansas asks the court to bar further advanced AI testing until adequate safeguards are in place and to require clear and conspicuous disclosure of ChatGPT’s material risks. Data deletion of this kind is the regulatory analogue to the Doe plaintiffs’ argument that OpenAI cannot “untrain” its models, and it raises the prospect of algorithmic disgorgement as a remedy.
Significance of the Coordinated, Separate-Filing Approach. The decision to file eight parallel actions, rather than a single multistate suit, is strategic. OpenAI now faces eight procedural regimes, judges, and discovery schedules. Documents and admissions produced in one proceeding may surface in others, and private plaintiffs, such as those in Doe, frequently draw on government complaints and discovery. Separate filings also create a risk of divergent rulings on how state consumer protection laws apply to AI chatbots. More broadly, the suits confirm that state AGs are not waiting for AI-specific legislation. Instead, they are applying the same UDAP and children’s privacy playbook previously deployed against social media platforms.
Link to Practical Takeaways: Aligning Prompt and Response Controls With Terms Practical Takeaways: Aligning Prompt and Response Controls With Terms
Closing the Gap Between Policy and Model Behavior. For businesses using AI in consumer-facing products, the complaint’s most instructive allegation is the disconnect between OpenAI’s stated eligibility rules and the model’s alleged behavior. Plaintiffs allege that the model elicited and acknowledged a disqualifying age but continued the interaction, potentially turning a written policy into evidence of knowledge and nonenforcement. Companies should therefore treat terms as product requirements: controls should detect eligibility-related disclosures, trigger an appropriate response, limit solicitation of sensitive information from minors, and ensure system instructions and default settings align with published terms.
Closing the Gap Between Policy and Model Behavior. For businesses using AI in consumer-facing products, the complaint’s most instructive allegation is the disconnect between OpenAI’s policy and the model’s alleged behavior. Plaintiffs allege that the model elicited and acknowledged a disqualifying age but continued the interaction, potentially turning a written policy into evidence of knowledge and nonenforcement. Companies should therefore treat terms as product requirements, not only as legal disclosures. Controls should detect eligibility-related statements, such as a disclosed age below the minimum, and trigger a defined response, whether that is ending the session, routing the user to a restricted experience, or initiating a verification step. Likewise, output-side controls should prevent the model from soliciting categories of sensitive information, such as health, body, or weight data, from users who are flagged or likely to be minors and ensure system instructions and default settings align with published terms.
Documenting Design, Testing, and Updates. Controls are only as defensible as the records supporting them. Companies should document how eligibility and sensitive-data controls were designed, tested against realistic conversations, and updated as models evolved — particularly because the complaint alleges that sycophantic behavior persisted across successive releases. More broadly, the lawsuit reflects a shift toward challenges to AI product design rather than isolated outputs. The § 1568.5 theory, in particular, could affect any online service that relies on a minor’s self-attestation of parental consent. Until courts resolve these theories, businesses should assume that model conversations may be scrutinized as evidence of what they knew about users and should align model behavior with the promises in their terms.
AG Takeaways and Recommended Next Steps. The coordinated state actions extend these lessons beyond foundation-model developers. Because the states rely on generally applicable consumer protection and children’s privacy laws, not solely AI-specific legislation, any company that integrates a chatbot or generative AI feature into a consumer-facing product may face similar scrutiny. The complaints underscore three points: public safety and privacy representations may create enforcement risk; engagement-oriented design may itself be actionable; and a user’s age disclosure during a model conversation may establish legally relevant knowledge. Companies deploying third-party models should not assume that vendor safeguards or terms will insulate their own representations, configurations, or data practices.
Companies that develop or deploy consumer-facing AI should consider the following steps:
- Substantiate public claims. Inventory statements about AI safety, accuracy, privacy, and safeguards, and confirm that each is accurate and supported by documented testing.
- Assess minors’ use and data. Determine whether minors use — or are likely to use — the product; map the data collected, retained, and used for training; and evaluate age-assurance measures under applicable law.
- Review design and governance. Assess engagement features, test parental controls, and maintain procedures for identifying and deleting minors’ data when required.
- Strengthen vendor diligence and contracts. Obtain evidence of vendor safety testing and protections for minors, and clearly allocate responsibility for age assurance, training-data use, deletion, and regulatory cooperation.
- Prepare for investigations and litigation. Preserve relevant communications, testing records, and risk assessments, and coordinate responses across jurisdictions.
1 MC1 is alleged to be a 12-year-old girl who has used ChatGPT since February 2026, and MC2 is alleged to be a 16-year-old boy who has used it since January 2026. Both reside in Hawaii. ↩
2 Jane Doe v. OpenAI Foundation, et al., No. 3:26-cv-11781 (N.D. Cal. filed Oct. 13, 2026). ↩