On Oct. 14, eight state attorneys general filed separate lawsuits against OpenAI in their respective state courts. According to copies of the petitions, the states allege that the company's ChatGPT chatbot violates state consumer protection laws. The states named include Iowa, Kansas, Nebraska, West Virginia and Arkansas, among others. The ChatGPT age verification lawsuits are drawing attention well beyond the courtroom, because they raise a practical question for everyday users: what personal information might you have to hand over to keep using an AI chatbot?
This post sticks to what has been reported so far. The source material available to us is limited, so we will not speculate about the specific remedies each state is seeking or how the cases will end.
What the Eight States Allege Against OpenAI
The core claim is straightforward. Each attorney general says ChatGPT violates their state's consumer protection laws. The suits were filed separately, each in its own state court, rather than as one combined action. That matters because each case will be argued under a different state's statutes and could move at a different pace.
The suits also put age verification in focus. Consumer protection claims involving minors often turn on whether a company knew, or should have known, that young people were using a product, and what safeguards it had in place. Reporting from other outlets indicates that the allegations touch on how ChatGPT interacts with teens and how minors' data is handled, though we have not independently confirmed the details of each petition.
OpenAI's terms of service, as described in other coverage, prohibit users under 13 and require those under 18 to have parental consent. The lawsuits appear to test whether those rules are enough without a stronger way to confirm who is actually typing.
What Age Verification Could Ask of ChatGPT Users
Age verification is not one single technology. Depending on how a company implements it, users could be asked to do one or more of the following:
- Upload a government-issued ID, such as a driver's license or passport
- Submit a selfie or short video for facial age estimation
- Link a payment card or other account tied to an adult
- Allow the service to infer age from usage patterns
Each method answers the same question, "Is this person an adult?", but each collects very different data to get there. Some approaches check a document once and discard it. Others may keep records for longer. Users usually cannot tell which is which without reading the fine print.
It is also worth noting that a chatbot is different from a typical website. People often share health worries, relationship problems, work documents and other sensitive details in conversation. Tying that history to a verified real-world identity changes the privacy picture considerably.
Privacy Tradeoffs of Handing Over ID or Biometric Data
Protecting children online is a legitimate goal, and few people dispute that. The tradeoff is that the tools used to check age can create new risks for everyone, including adults.
Data concentration. An ID scan or face image is more permanent than a password. If it is stored and later exposed, you cannot simply change it. Anyone who has dealt with a breach knows how hard cleanup can be, and our guide on how to recover financial losses after a data breach outlines the steps involved.
Biometric sensitivity. Face and body data is personal in a way that is difficult to reverse. The legal fight over genetic data shows how seriously states treat irreplaceable information. When 23andMe went bankrupt, 27 states sued to block the sale of customers' genetic data. That case involved a different kind of data, but it illustrates how quickly sensitive records can become a legal flashpoint when a company's circumstances change.
Linking identity to conversations. If a verified identity is connected to chat history, the data becomes more valuable to advertisers, hackers and anyone who can obtain it through legal process.
How State Privacy Laws and Lawsuits Are Shaping the Rules
States are increasingly acting where federal rules are thin. Attorneys general are using consumer protection statutes to pursue AI companies, and legislatures are passing privacy laws that limit how personal data can be collected and used.
Vermont is one example. Its comprehensive privacy law, S.71, was signed on June 16, 2026, and our explainer on the Vermont Data Privacy and Surveillance Act covers what it requires. The related coverage of Vermont's Senate Bill 71 explains how the law governs the way businesses collect, use, disclose, sell and protect residents' personal data.
The tension is clear. Lawsuits like these may push companies to collect more data to prove users are adults, while privacy laws push them to collect less. How courts and lawmakers resolve that tension will shape what age checks look like in practice.
What This Means For You
Nothing has been decided. These are allegations, and OpenAI has not been found liable for anything in the material we reviewed. But the direction of travel is worth watching, because you may eventually be asked to verify your age to use AI tools you already rely on.
If that happens, the key questions are not just whether to comply, but how the check works. Who performs it, the company or a third party? Is the ID or image deleted after verification? Is it used for anything else, such as training or marketing? Is the check tied to your chat history?
Key Takeaways
- Read the verification prompt and privacy notice before you upload anything.
- Prefer methods that confirm age without storing your ID or face image.
- Avoid sharing sensitive details in chatbot conversations, whether or not you have been verified.
- Use unique passwords and two-factor authentication on your AI accounts.
- Follow how the ChatGPT age verification lawsuits develop, since the outcomes could set expectations for other AI services.
To see how state rules are tightening data protections more broadly, start with our Vermont privacy law explainer, and check what any age-check system collects and how it stores it before you comply.
