Texas Sues OpenAI, Alleging ChatGPT Was Sold as Safe While Its Risks Went Undisclosed

Texas Attorney General Ken Paxton sued OpenAI and its chief executive, Sam Altman, on Friday, October 23, 2026, accusing the company of marketing ChatGPT as safe and reliable while failing to warn Texans, and especially children, about the harms the chatbot can cause. The petition was filed in district court in Collin County and rests on two state laws: the Texas Deceptive Trade Practices–Consumer Protection Act (DTPA) and the Securing Children Online through Parental Empowerment Act, known as the SCOPE Act.

Everything in the petition is an allegation. No court has found that OpenAI violated either statute, and the remedies Texas describes are requests, not orders. Even so, the filing is worth close reading for anyone who deploys a conversational AI product, because the theory Texas is testing does not depend on a new AI statute. It relies on a decades-old consumer protection law and a children’s privacy law that already applies to a wide range of digital services.

What Texas is alleging

The petition names six OpenAI entities (OpenAI Global, LLC; OpenAI Foundation, formerly OpenAI, Inc.; OpenAI OpCo, LLC; OpenAI Group PBC; OpenAI Holdings, LLC; and OpenAI, LLC) along with Altman personally. In its announcement of the suit, Paxton’s office said OpenAI “misrepresented their artificial intelligence products and has given a careless introduction of ChatGPT to Texas and the world,” and that large language models can produce inaccurate or harmful output “without this risk being disclosed to users.”

The DTPA count lists the conduct Texas says was false, misleading or deceptive. According to the state’s original petition, the alleged practices include:

• failing to warn of ChatGPT’s dangers;
• offering a product with content unsuitable for children without adequate age verification, or without any age verification;
• making the product easily accessible to children without parental consent;
• including features that, the state says, promote compulsive and prolonged use, including by children;
• releasing the product without adequate safety testing;
• representing the product as reliable while it functions unreliably; and
• designing a product that “falsely represents itself as having human emotions and characteristics” to win trust and engagement.

The petition also points to product defaults. It alleges that ChatGPT’s default setting lets OpenAI improve the model using conversations users submit, and that a memory feature introduced in 2024, which references past conversations to tailor responses, “was on by default.” It further claims ChatGPT has “tens of thousands of users who are under 13 years of age” in Texas. OpenAI has not had a chance to answer those factual claims in court.

The children’s privacy count

The second count is where privacy teams should slow down. Texas alleges OpenAI violated Sections 509.051, 509.052, 509.054 and 509.101 of the SCOPE Act, and under Section 509.151 a SCOPE Act violation is treated as a deceptive act actionable under the DTPA. The state’s specific complaints are about verification and parental tools:

• Section 509.101 requires a “commercially reasonable method” to verify a parent’s identity and relationship to a known minor. Texas says OpenAI does not request or verify that information at all.
• Section 509.054 requires tools that let a verified parent supervise a known minor’s use of a service, including control over privacy and account settings. Texas says OpenAI does not provide tools to limit the sharing, disclosure or sale of a minor’s personal identifying information, or to control targeted advertising shown to a known minor.

The petition acknowledges that OpenAI introduced parental controls in September 2025 and launched a teen version of ChatGPT in August 2026. The state’s argument is that those measures are voluntary, depend on a parent linking accounts, and fall short of what the statute requires. That distinction, between offering a feature and meeting a legal standard, is the part most likely to matter to other companies.

What Texas wants the court to order

The relief Texas is seeking is broad. The petition asks the court to:

1. Temporarily and permanently enjoin OpenAI from the practices listed in the DTPA count.
2. Bar OpenAI from offering ChatGPT to minors in Texas.
3. Prohibit the release of any new AI model to Texas users unless an independent third-party evaluator, approved by the court, has reviewed its safety guardrails and approved its release.
4. Impose civil penalties of $10,000 for each DTPA violation, including those that also constitute SCOPE Act violations.
5. Order disgorgement of assets “as provided by law and equity,” plus interest, court costs, investigation costs and attorneys’ fees.

Texas states it seeks monetary relief over $1,000,000 and has requested a jury trial. The state also argues it does not need to prove consumer injury to recover civil penalties under the DTPA, citing Section 17.47 and Texas case law. The actual penalty figure, if any, would depend on how many violations the state can establish and on factors the statute lists, such as the seriousness of the conduct and the amount needed to deter future violations.

OpenAI’s response

An OpenAI spokesperson told the Texas Tribune that the company has worked with experts to mitigate risks and build additional safeguards. “Governments have an important role to play in setting robust safety standards for AI, and we’re committed to working with Texas and other states on advancing pragmatic AI policies that apply to the entire AI industry — not just one company,” the spokesperson said. As of this writing, no answer or other responsive filing was available to review.

Why this matters beyond OpenAI

Texas is not breaking new ground in its choice of tools. The Tribune reports that over the past year Paxton has sued or settled with Meta, TikTok, Snapchat and Roblox under the state’s consumer protection laws, alleging insufficient safeguards for Texans and especially children. We have tracked how that enforcement program is reshaping corporate compliance in Texas, and the OpenAI petition fits the same pattern: a general consumer protection statute, paired with a child-specific law, aimed at product design and marketing claims rather than a single data breach.

Texas is also not alone in focusing on OpenAI. Florida has taken its own action, which we covered in Florida’s suit over alleged ChatGPT risks to children and public safety. When two large states pursue overlapping theories against the same product, other companies selling chatbots into those markets should assume the same questions will eventually be asked of them.

The core legal idea is simple, and that is what makes it portable. A deceptive-practices claim does not require an AI-specific rule. It asks what a company told consumers about its product, what it left out, and whether the gap was material. A company that calls its assistant “safe,” “accurate” or “trusted” in marketing copy, onboarding screens or app store listings has made a representation that a state attorney general can test against the product’s actual behavior.

Where chatbot deployers are most exposed

Most companies reading this are not building frontier models. They are putting a vendor’s model behind a support widget, a shopping assistant, a tutoring tool or a wellness app. The petition still maps onto those deployments, because the allegations are about disclosure, defaults and minors, all of which the deploying company controls. Exposure tends to concentrate in a few places:

• Marketing claims. Statements about safety, accuracy or human-like care that the product cannot consistently support.
• Defaults. Conversation retention, model training on user inputs and memory features switched on without a clear, timely notice.
• Age signals. Services that are plainly used by teens, or by children under 13, without any meaningful age assurance or parental controls.
• Persona design. Assistants presented as having feelings or relationships, which the petition treats as a potential misrepresentation in its own right.

For a broader view of the state rules that already apply to conversational AI, see our guide to chatbot state laws and their compliance requirements. Companies with Texas users that have not looked closely at the children’s statute should start with our explainer on the Texas SCOPE Act.

A practical review for privacy and legal teams

None of the following is legal advice, and none of it guarantees an outcome in front of a regulator. It is a working list for teams that want to know whether their own chatbot could be described the way Texas describes ChatGPT.

1. Inventory every assistant you run. Include vendor-powered widgets, internal copilots exposed to customers and features embedded in third-party software. Record the model provider, the purpose, the user population and the data the system receives.
2. Trace the data flow for each one. Document what is collected in a conversation, who receives it (the model vendor, analytics tools, support platforms), why, how long it is kept and whether it is used for training. A privacy notice that says “we may use AI” is not a substitute for knowing these answers.
3. Compare marketing copy with test results. Pull every public claim about safety and accuracy and ask whether internal testing supports it. Where it does not, change the claim or add a clear limitation.
4. Check the defaults. If memory, history or training-on-inputs is on by default, confirm users are told before they share sensitive information and can turn it off without hunting for the setting.
5. Decide how you handle minors. If your terms say users must be 13 or 18 but nothing enforces that, assess whether you have actual knowledge of younger users and what the SCOPE Act or COPPA would require of you.
6. Write down escalation rules. Define topics, such as self-harm, that must route to a human or a safety resource, and test that the routing works in production, not only in a demo.
7. Keep evidence. A risk assessment completed at launch does not prove the controls still work after a model update. Re-test after material changes and keep the results.

Captain Compliance’s AI governance software is built for the record-keeping side of this work: a registry of AI systems, vendors and agents, risk and impact assessments, assigned guardrails such as human escalation and transparency language, and reassessment when a model, vendor or purpose changes. It supports the process. It does not decide whether a given chatbot complies with Texas law; that judgment still belongs to counsel and the people who know how the product behaves.

Frequently asked questions

Has a court found that OpenAI broke Texas law?

No. The petition filed October 23, 2026 contains the state’s allegations. OpenAI can contest them, and the case is at its earliest stage.

Is ChatGPT now banned for minors in Texas?

No. Barring OpenAI from offering ChatGPT to minors in Texas is one of the injunctions the state is asking for. It would only take effect if the court ordered it.

Why does a children’s privacy law show up in a lawsuit about AI safety?

The SCOPE Act imposes duties on digital service providers that have known minors as users, including parental verification and parental tools covering privacy settings and targeted advertising. Texas argues ChatGPT is such a service and that those duties were not met. Under the statute, a SCOPE Act violation is also a deceptive practice under the DTPA.

Our company only resells another vendor’s model. Are we exposed?

Possibly, depending on the facts. The DTPA claims focus on how a product is marketed and what users are told. A deployer controls its own claims, its notices, its defaults and how it treats minors, so those choices can create exposure regardless of who trained the model.

What penalties are possible?

The DTPA allows civil penalties of up to $10,000 per violation in actions brought by the attorney general, and Texas asks for that amount for each violation. The total would depend on how many violations the state proves, and the statute lists factors a jury must consider when setting the amount.

What is the independent evaluator Texas is asking for?

Texas wants the court to prohibit OpenAI from releasing new AI models to Texas users unless a court-approved, independent third party has reviewed the model’s safety guardrails and approved the release. It is a requested remedy, not a current requirement.

If Texas gets even part of what it is asking for, a state court could end up deciding when a general-purpose AI model is ready for release in one state. Whether judges accept that role is the open question, and companies building on these models will feel the answer quickly: in the disclosures they write, in the age gates they skipped, and in the safety claims their marketing teams can no longer make without proof.