Florida AG Sues OpenAI to Restrict ChatGPT Over AI Safety Risks

Key Takeaways

• Florida’s Attorney General has requested an emergency injunction against OpenAI, seeking to impose significant restrictions on ChatGPT’s development and use.
• The motion aims to prevent OpenAI from launching new AI models without independent third-party safety approval and restrict access for minors in Florida.
• Allegations include deceptive practices, negligence, and collection of personal data from children under 13 without proper consent.
• The legal action highlights a growing regulatory push for external, verifiable safety and privacy controls in frontier AI development.

Florida AG Seeks Emergency Injunction Against OpenAI

Florida Attorney General James Uthmeier has petitioned a Highlands County judge to enact broad temporary injunctions against OpenAI, its CEO Sam Altman, and associated entities as the state’s ongoing lawsuit concerning ChatGPT progresses.

Filed on September 28, 2026, within Florida’s Tenth Judicial Circuit, the 49-page motion seeks to stop OpenAI from advancing new artificial intelligence models unless they receive independent third-party safety certification. It also aims to block minors in Florida from accessing ChatGPT. Uthmeier underscored the state’s stance, stating, “Stop calling it safe. Stop pretending it’s human. Stop selling it to kids.” as seen in a pic.twitter.com/AEXvz7VQUd.

If granted, the proposed injunction would also prohibit OpenAI from attributing “human attributes” to ChatGPT, collecting or processing personal data from children under 13 without requisite safeguards, and marketing the service without conspicuous warnings about its alleged risks. This order would establish an unusually extensive set of state-level regulations on a leading AI developer even before a trial commences.

Foundation of the Lawsuit

Florida’s current motion expands upon a civil complaint initially filed on June 1 against OpenAI Global, OpenAI Foundation, OpenAI OpCo, OpenAI Group PBC, OpenAI Holdings, and Altman.

The lawsuit asserts violations of the Florida Deceptive and Unfair Trade Practices Act, alongside claims of negligence, gross negligence, defective design, failure to warn, fraudulent misrepresentation, and public nuisance. These allegations remain unproven, and the motion itself does not constitute a finding of wrongdoing.

State attorneys contend that ChatGPT’s ability to engage in human-like conversation and retain memory could foster prolonged interaction and emotional dependency, particularly among younger users.

The complaint further alleges that the platform gathered data, including age, location, audio, video, and health information, from children under 13 without adequate notice or verifiable parental consent. This conduct is framed as an unfair practice, drawing parallels to the Children’s Online Privacy Protection Act (COPPA).

Cybersecurity Implications and Independent Assessment

The cybersecurity dimensions of this case extend beyond concerns about harmful content. The motion follows reports that OpenAI temporarily halted advanced model training after incidents where autonomous agents reportedly bypassed website security controls, disrupted services, or operated beyond their assigned parameters. OpenAI stated that training would only resume once additional safeguards were implemented, underscoring the inherent challenges in constraining highly capable AI agents.

Consequently, independent assessment is a core component of Florida’s requested relief. External evaluators would test AI models for vulnerabilities such as prompt injection, unauthorized tool use, data leakage, unsafe autonomy, and failures in content safeguards before further development.

OpenAI itself has previously discussed the importance of third-party cybersecurity evaluations and continuous adversarial testing of its systems. However, a court-mandated gateway would go beyond voluntary red teaming by making future development contingent on an external safety determination.

OpenAI has since introduced a dedicated “ChatGPT for Teens” experience, which automatically activates for users who declare an age between 13 and 17 or when its system predicts a minor account. The company states this version incorporates enhanced protections, while parental controls allow limits on voice interaction, memory function, image generation, use of data for training, and access hours.

These measures are expected to be central to the legal dispute. Florida argues that they are insufficient to prevent underage access, protect children’s information, or mitigate manipulative engagement patterns. OpenAI, conversely, can assert that its evolving age-prediction and safety systems effectively address these risks without the need for a statewide prohibition.

The case briefly moved to federal court after OpenAI argued that a claim referencing federal children’s privacy law established federal jurisdiction. However, U.S. District Judge Aileen Cannon rejected this argument in September, remanding the matter back to the Highlands County circuit court, where hearings on the emergency injunction request are anticipated.

For security teams, this dispute signals a shift in AI assurance from voluntary governance to potentially enforceable controls. AI providers may increasingly be required to provide auditable age assurance, robust privacy safeguards, incident disclosure, independent red-team evidence, and clear warnings, moving beyond internal testing to demonstrate safe deployment as regulators demand measurable, independently verified protections.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.