Eight US states sue OpenAI over ChatGPT's *consumer protection* breaches

The allegations

On 7 January 2025, attorneys general from California, Illinois, the District of Columbia and five other US states filed a lawsuit against OpenAI ^[1]. They claim ChatGPT violated state consumer protection laws by deceiving users, harming children and using manipulative design to collect personal data.

The complaint says OpenAI knew minors were using ChatGPT, didn't implement adequate safeguards and misrepresented the chatbot's capabilities and limitations ^[1]. It alleges the service used dark patterns—design tricks that steer people towards choices that benefit the company rather than the user—to harvest data. The states are asking for civil penalties, an injunction and restitution for affected users.

OpenAI has said the claims are without merit ^[1].

Why it matters outside the courtroom

The case is in its early stages, so there's no ruling yet. What makes it relevant beyond the parties is the evidence question it raises.

When someone claims a chatbot deceived them, promised something it shouldn't have or exposed a child to harm, what's the record? Often, the customer has a screenshot. The company may have logs, or it may not. Even when logs exist, they're kept by the same organisation that's being questioned. That's like asking someone to mark their own homework.

It's the same problem that came up in the 2024 Air Canada case, where a customer relied on a chatbot's incorrect answer about bereavement fares ^[2]. The airline admitted the chatbot's words were misleading, and the tribunal ordered compensation. The customer had a screenshot. The airline offered no evidence to the contrary.

Screenshots are the customer's evidence. If your AI talks to customers, it's worth deciding who keeps the record before someone else does.

What EU law says

The EU AI Act, which began applying on 2 August 2024, has a straightforward transparency rule. Article 50 says providers must design AI systems that interact with people so that the person knows they're talking to an AI, unless it's obvious ^[3]. There are exceptions for authorised crime detection and certain biometric systems, but for customer-facing chatbots the rule is clear.

That obligation falls on the provider—the one who develops or has the system developed and puts it on the market. It's been in force since 2 August 2026.

Article 50 doesn't say how you prove you met it. It asks for the notice, not for a way of showing later that the notice was given. That's a separate question, and one a company might want to answer before a regulator or a tribunal asks it.

The everyday comparison

Think of it like a receipt. When you buy something, the shop gives you one. If you dispute the purchase later, you bring the receipt, and the shop checks its records. Both sides have something to point to.

With a chatbot, the customer gets the answer on screen and can take a screenshot. That's their receipt. The company's receipt is whatever it kept at the time. If it kept nothing, or if what it kept can be quietly edited afterwards, the customer's screenshot is the stronger record.

A receipt works because it's created when the transaction happens, not when the dispute starts. The same goes for chatbot records: seal the answer when it's sent, and you have something you can check later without asking anyone to trust you.

What a digital witness seals

Here, the thing to seal is each answer the chatbot sends, or each conversation when it closes. That includes the notice that the person was talking to an AI, if Article 50 applies.

Sealing takes a fingerprint of the record, not the content itself, so the conversation never leaves your systems. The fingerprint goes to WitniumChain, which seals it in a way that any later change would show. You get a witness ID back. If the answer is questioned months later, anyone you share the record with can calculate the fingerprint again and check it against the sealed one. Match means nothing has changed. No match means something has.

What it shows is that the record of what the chatbot said, and when, hasn't been altered since it was sealed. Anyone can check that, without needing to trust the company or take your word for it.

What it doesn't show is that the answer was correct, lawful or within the chatbot's intended scope. It doesn't settle whether the company is bound by what the chatbot said. Those are questions for the terms, the regulator or a court. The witness just establishes the starting point: what was actually said.

You'd seal the answer when it's sent, or the conversation when it ends. The first 2,000 witnesses a month are free. You can do it through the REST API, the SDK or the MCP server. The content stays with you; only the fingerprint is sealed.

How it would work

1. Your chatbot sends an answer to the user.
2. At the same time, it calculates a fingerprint of the answer and sends that to WitniumChain, getting a witness ID back.
3. Months later, if the answer is disputed, you produce the record, calculate the fingerprint again and share the witness ID. The other side checks whether the fingerprints match.

What this means for you

If you run a customer-facing chatbot, three questions are worth asking now:

1. Can you show what your chatbot said on a given day, in a way that holds up when someone questions it?
2. If Article 50 applies to you, can you demonstrate that the notice was given?
3. Who keeps the record: you, the customer or both?

The OpenAI lawsuit is at an early stage, and we don't yet know how it will turn out. But the evidence question it raises isn't new. It came up in the Air Canada case. It will come up again.

Decide how you'll answer it before the question arrives.

What to watch

Article 50 of the AI Act has been in force since 2 August 2026. If your AI interacts with people, check that the transparency notice is in place and that you have a record of it.

The US lawsuit against OpenAI will take time to resolve. In the meantime, every company with a customer-facing AI ought to be asking the same question the case raises: if a customer disputes what your chatbot said, whose record holds up?

Sources

1. Complaint filed by attorneys general of California, Illinois, D.C. and five other states against OpenAI, Associated Press, 7 January 2025, https://apnews.com/article/openai-lawsuits-chatbot-chatgpt-artificial-intelligence-f29fa6c206cfe41d46ba38ee7be78218
2. Moffatt v. Air Canada, 2024 BCCRT 149, Civil Resolution Tribunal of British Columbia, 14 February 2024, https://decisions.civilresolutionbc.ca/crt/crtd/en/525448/1/document.do
3. Article 50 of Regulation (EU) 2024/1689 (AI Act), European Commission AI Act Service Desk, https://ai-act-service-desk.ec.europa.eu/en/ai-act/article-50
4. Air Canada chatbot case report, CTV News BC, 16 February 2024, https://bc.ctvnews.ca/air-canada-s-chatbot-gave-a-b-c-man-the-wrong-information-now-the-airline-has-to-pay-for-the-mistake-1.6769454