A sub-series within Big Tech's War on Users Back in June I wrote Wait. Florida? because Florida had just become the first state to sue OpenAI over ChatGPT, and I had to read it twice. I said the broken clock was right, and I was still looking at it sideways. Yesterday it was eight more. Per Bloomberg Law, attorneys general from Arkansas, Arizona, Idaho, Montana, Iowa, Kansas, West Virginia and Nebraska each sued OpenAI on Wednesday, separately, in their own state courts. Bloomberg calls it a first-of-its-kind bipartisan effort: seven Republican AGs and one Democrat, Arizona's Kris Mayes. Iowa, Kansas, Nebraska and West Virginia held a joint press conference at the Iowa Capitol in Des Moines. The other four filed at home. Arkansas's own release quietly adds Utah to the pile. As of this morning nobody else's does, and Utah hasn't said a word, so I'm counting eight. The AGs said more could follow. Iowa's Brenna Bird put it about as plainly as you can: OpenAI told people all over the country that ChatGPT is safe, and "it is not." And that's just Wednesday. On Tuesday, a mother in Hawaii filed a proposed nationwide class action over her 12- and 16-year-olds' ChatGPT data. The Wednesday before that, a youth safety institute that OpenAI's own foundation helps pay for told OpenAI to keep teenagers off ChatGPT entirely. One week. Let's go through it. Same Paragraph, Different Letterhead Read the press releases back to back and you'll notice something. Iowa, West Virginia, Idaho and Montana share whole paragraphs almost word for word. ChatGPT as the first chatbot to reach widespread public use. Nearly half the American chatbot market. Designed to be overly agreeable and to fake human compassion. Arizona's has the first two as well. That's not a knock. That's what coordination looks like. It's the same playbook that got 47 states plus D.C. to the $18 billion Meta settlement this summer, which Bloomberg brings up in the same article. The difference is the courtroom. This isn't one big multistate case. It's eight separate suits under eight sets of state law, which, as Engadget points out, means eight different wish lists for remedies: Iowa: two counts under the Iowa Consumer Fraud Act, in Polk County. Arizona: the Arizona Consumer Fraud Act, in Maricopa County. Mayes says ChatGPT was built to keep young users engaged so OpenAI could collect their data. Arkansas: the Deceptive Trade Practices Act, the state's Children's and Teens' Online Privacy Protection Act, plus negligence, design defect, failure to warn, unjust enrichment and public nuisance. Montana: the Consumer Protection Act and the Consumer Data Privacy Act. Nebraska: per BNO News, its suit includes claims under the state's Age-Appropriate Online Design Code Act. Idaho: the Idaho Consumer Protection Act, in Ada County. West Virginia and Kansas: state consumer protection law. Now look for the one paragraph in those releases that isn't about kids. It's the rogue agents. Iowa, West Virginia, Idaho and Montana all include a version of the same line: OpenAI recently admitted its advanced models had "gone rogue" once agents were out on the internet, hacking into other companies and coordinating on how to deceive their own users. That's the list from Some Bad Things, showing up in a kids' safety suit. And it isn't decoration. Iowa's petition has exactly two counts. The first is about how ChatGPT was marketed and designed. The second is about deceptive practices in the testing of autonomous AI agents. Montana's release mentions that Attorney General Austin Knudsen already opened an investigation after the Hugging Face breach, and that back in May he asked the SEC to take a hard look at OpenAI's filings before any IPO. Arkansas goes furthest. Among the relief it's asking for is an injunction stopping OpenAI from further advanced AI testing, and from creating models capable of recursive self-improvement, until adequate safeguards are in place. In The Ill-Advised Moment I said that if safety were genuinely the priority, a lab would stop shipping until the guardrails were part of how the system worked, and that nobody in the industry was going to do that voluntarily. I was right about the industry. I just wasn't watching the states closely enough. Back on August 4th, a coalition of 15 attorneys general sent OpenAI a letter after the Hugging Face breach, asking it to stop the testing that caused it until it could show that testing was safe. Iowa, Kansas, Montana, Nebraska and Idaho all signed. So did Utah, which might explain how it ended up on Arkansas's list. Then on September 28th, two days before I published that post, Florida asked a judge for a temporary injunction that would block OpenAI from building new models without independent guardrails and keep minors off ChatGPT in the state while its case plays out. I missed it at the time. The motion leans on the same rogue agent incidents: Hugging Face, RubyGems, attempted hacks of US government sites, the Australian Medicare portal. It also argues this should be an easy call, since OpenAI's own leadership has publicly asked to be slowed down. Attorney General James Uthmeier's version for the cameras: "If Sam Altman meant what he said about slowing down, he can join our ask to the court." He hasn't. OpenAI did try moving Florida's case to federal court, though. Per TNW, a judge sent it back to state court this month. So Arkansas isn't the first to put "stop" in a filing. It's at least the third time states have asked, and the first time the ask came as one of eight lawsuits on the same day. I'd still bet against a state court granting it. But it isn't a one-off anymore. Read the Terms The tagline of this series is read the terms, they're more honest than the marketing. This week it's not a metaphor. It's basically the complaint. Here's what OpenAI's Terms of Use say: "You must be at least 13 years old." If you're under 18, you need a parent or guardian's permission. Per Iowa's petition, OpenAI's privacy policy says its services aren't directed at children under 13. Thirteen. Ask your parents. That's the deal, in writing. Here's what the marketing says, according to the states: Iowa's petition includes an OpenAI LinkedIn post from April 9 titled "ChatGPT Helps Keep Teens Safe by Default." OpenAI's parent resources page used to say ChatGPT was "Built with safety in mind." Iowa says that's since been taken down and replaced with claims about age-appropriate protections by default and a product that encourages critical thinking. Montana's release includes a screenshot of a social media ad assuring parents ChatGPT is safe for teens. Nebraska Attorney General Mike Hilgers said at the press conference that OpenAI has marketed ChatGPT as safe for kids under 13. Kids who, per OpenAI's own terms, aren't supposed to be there at all. Then there's the App Store. Iowa says ChatGPT's listing claimed a 12+ rating until Apple changed its rating system in 2025, and claims 13+ now. Apple builds that rating from the developer's own answers to a questionnaire, and lets developers pick something stricter. Iowa notes that Grok and Claude chose higher ratings. OpenAI didn't. So which is it? Not for under-13s, or safe for them? Now the gate. According to Tuesday's class action, filed in San Francisco federal court, creating an account only requires entering an age over 13 to proceed. That's it. One of the plaintiffs was 12 when she signed up earlier this year. The complaint says ChatGPT asked her age, she told it she'd just turned 12, and the conversation kept going. She ended up sending it selfies, asking it to rate her looks, and talking about her insecurities, her diet and her body. The terms said 13. The product asked. She answered honestly. Nothing happened. And the parental permission part? The terms say it's required. The suit says OpenAI doesn't validly get it, because a kid clicking through a screen isn't a parent agreeing to anything. That matters, because the rest of the terms are doing a lot of work. There's mandatory arbitration. There's a class action waiver. There's a liability cap: the greater of whatever you paid in the last 12 months, or one hundred dollars. The suit wants the court to say those terms don't bind kids at all, because kids can't agree to them without a parent. Then there's the ask that got the headlines. The plaintiffs want every kid whose data was used to train the models paid in OpenAI equity, or the cash equivalent, in proportion to how much data was taken. The complaint points out that OpenAI has talked a lot about sharing the wealth its models create, and offers this lawsuit as a convenient opportunity. Per Bloomberg, OpenAI's valuation is now up to $1.4 trillion, which is the number I was chewing on two weeks ago. It's a long shot. It's also the first time I've seen anyone try to put a price on what a twelve-year-old's selfies were worth to a training run. Fifteen Minutes, Zero Alerts Back to last Wednesday, October 7th. Common Sense Media's Youth AI Safety Institute rated ChatGPT for Teens an Unacceptable Risk. ChatGPT for Teens is the default teen experience OpenAI launched on August 18th, with parental alerts, a study mode, less friend-like behavior and age prediction. The institute ran more than 4,000 prompts against accounts registered to 13- to 17-year-olds, before and after launch, and had child psychiatrists and a pediatrician review the responses. Some of it worked. Sexual roleplay refusals got more consistent. The rest: Testers spent up to an hour on new, parent-linked accounts talking about suicidal thoughts, self-harm and disordered eating. The parents got zero alerts. ChatGPT missed more than one in four crisis referrals the psychiatrists said were warranted. Age prediction never moved adult-registered test accounts into the teen experience, even after testers said they were 13 and the bot acknowledged it. OpenAI's response, per KQED, was that a lot of the testing may have happened before the parent link had fully activated, which apparently takes about three hours. Common Sense says some accounts were linked longer than that, and it stands by the results. Here's the detail that makes this hard to wave off. Per KQED, the institute is funded in part by the OpenAI Foundation, the nonprofit that controls OpenAI. The two even partnered on a California kids' AI safety ballot measure back in January. This isn't a hostile critic. It's a group OpenAI helps pay for, telling OpenAI its teen product doesn't work. The director's response to the funding question: "They're the one that created the problems. Why shouldn't they help fund it?" Fair. Iowa's petition already cites that report. It's a week old and it's sitting in a footnote. The petition also cites reporting that OpenAI's age prediction was at one point misclassifying minors as adults about 12% of the time, and a Common Sense survey showing 58% of 9- to 12-year-olds use AI chatbots, ChatGPT included. Nine-year-olds. Remember, the terms say 13. Now set that next to what OpenAI told Bloomberg about the class action. Teens on average spend less than 15 minutes on ChatGPT. About 90% use it for learning, information and skill-building. And the lawsuit "risks pushing teens toward products with fewer safeguards or reduced parental controls." Averages don't hurt kids. The tail does. The kid in the tail is the one spending an hour talking about self-harm while the parent alert doesn't go off. Montana's release walks through two of those kids: the teenager whose suicidal thoughts ChatGPT validated instead of steering him toward help, and the one who asked whether Xanax would help with kratom nausea and got a yes with no warning. I went through the Florida version of that list back in June. It hasn't gotten shorter. Arkansas Attorney General Tim Griffin put the whole thing in one line. OpenAI says ChatGPT is safe, and "the consequences of that assurance are lives lost and people harmed." Not Just One Company OpenAI's statement to Bloomberg is worth reading closely. Spokesperson Drew Pusateri said the company has already built industry-leading age-specific protections and will keep adding more, like parental controls and break reminders. He said it's committed to working with states on pragmatic AI policies that apply to the whole industry, "not just one company." The class action statement says almost the same thing: a misguided suit that singles out OpenAI. And per TNW, Pusateri gave Florida the same answer in September. Rules for the whole industry, not aimed at one company. That's the line. Not "we got it wrong." Not even "we disagree with the facts." Why us? I wrote about this exact move in Got Milk? on Monday. Everybody wants rules for the whole industry. Nobody wants the lawsuit with their name on it. A rule for everyone is a policy discussion. A lawsuit with your name on it is discovery. To be fair, the states aren't pretending OpenAI is the only one. Florida said in June it was looking at other platforms. Iowa's petition spends real time comparing ChatGPT to Claude and Grok, on App Store ratings and on studies of how often each model goes along with harmful requests. They're not ignoring the rest of the industry. They're using it as the control group. And per Engadget, OpenAI has endorsed the federal Kids Online Safety Act. That's not hypocritical on its own. A single federal standard is a lot easier to live with than nine state courts and nine sets of remedies. I suspect that's the point. Two Stories The series description for TheranasAI says Elizabeth Holmes didn't go to prison for building something fake. She went for telling investors one story while the documents told another. In Some Bad Things I pointed out she was acquitted on the patient counts. The law ended up protecting the investors, not the people who got bad results. That's what's different about Wednesday. These aren't lawsuits arguing that AI is dangerous in the abstract. They're consumer fraud cases. The argument is that OpenAI told parents one story (safe by default, built with safety in mind, fine for teens) while its own documents told another. The terms. The privacy policy. The incident reports it published itself. That's the Theranos shape. One story in the marketing, another in the paperwork. Only this time, the people who were told the first story aren't investors. They're parents. And for once, they're the ones who got the lawyers. OpenAI's product works. I keep saying that because it matters. That's not the comparison. The comparison is the arrangement. The terms told you who this was for. Thirteen and up. Parents' permission under eighteen. A hundred dollars if anything goes wrong. The marketing told parents it was safe by default. A twelve-year-old clicked Continue anyway, and nobody on the other end checked. Eight states read the terms. Part of the ongoing TheranasAI series, a sub-series of Big Tech's War on Users. Read the terms. They're more honest than the marketing.