Why states are suing OpenAI, and what the complaints say about your ChatGPT data

The Morse teamPublished November 2, 20268 min read

At least ten states have sued OpenAI over ChatGPT as of November 2, 2026: Florida on June 1, eight more on October 14, and Texas on October 23. Most of their claims are about safety, but the complaints also allege that OpenAI collects and trains on users' conversations by default, that its promise not to "knowingly collect" data from children under 13 is false, and that it handles minors' data in ways four states' own privacy and child-safety laws forbid. These are allegations, and we found no ruling on any of them.

We read all nine October complaints and the Texas attorney general's press release on November 2, 2026, along with OpenAI's US privacy policy and its help pages on data controls, age prediction, and parental controls. OpenAI deserves credit on two points its own pages make plain. The training switch is easy to find, and parental controls don't let parents read a teen's chats.

Which states are suing OpenAI?

Florida went first. Attorney General James Uthmeier sued OpenAI and Sam Altman on June 1, 2026, in Florida's Tenth Judicial Circuit, alleging among other things that "ChatGPT collects data from minors without meaningful parental oversight" (Florida Attorney General).

On October 14, 2026, the attorneys general of Arizona, Arkansas, Idaho, Iowa, Kansas, Montana, Nebraska, and West Virginia each filed a separate suit in their own state's courts. Texas followed on October 23, 2026, in Collin County, naming Altman as a defendant too (Texas Attorney General).

Al Jazeera's explainer and most wire stories count "eight states," which leaves out Florida, four months earlier, and Texas, nine days later.

What do the lawsuits say OpenAI does with your data?

Seven of the October complaints repeat the same core allegation, nearly word for word. Iowa's reads: "Unless the user opts out, the product uses consumer conversations to train itself, thereby giving OpenAI access to data that users share with ChatGPT regardless of its sensitivity or confidentiality." It adds that "OpenAI's default setting is to collect this data" (Iowa petition).

The default itself isn't in dispute. OpenAI's own help page says that on personal Free, Plus, and Pro accounts, "data sharing is enabled by default," and that you can turn off Improve the model for everyone and keep your history (OpenAI). The states' claim is about notice. Arizona alleges that OpenAI "hides this disclosure in a data privacy policy that may never be accessed by an Arizona consumer it collects data from" (Arizona complaint).

The complaints make three more data claims:

• Memory. The complaints say ChatGPT's memory feature, introduced in 2024, was "on by default," and that it builds detailed memories from personal details users shared earlier.
• Sensitive topics. They say OpenAI invites people to share health records and finances. Arizona's complaint says Arizonans are "consistently" invited to "exchange sensitive personal information such as healthcare records with ChatGPT."
• Teens' secrets. Arizona alleges that OpenAI failed to disclose that ChatGPT "was designed to encourage minors to share personal information exclusively with it" rather than with parents or friends.

We cover how ChatGPT's training works, and how to switch it off, in does ChatGPT train on your data.

The privacy claims, state by state

Built from the filings, read November 2, 2026. Every claim is an allegation.

The rest of each complaint is about safety, including suicide and self-harm, sycophancy, rushed testing, and advice ChatGPT got wrong.

What do the states say about children's data?

They say OpenAI's privacy policy promises something its product doesn't check. OpenAI's US privacy policy says its services are "not directed to, or intended for, children under 13," and "We do not knowingly collect Personal Data from children under 13" (OpenAI). West Virginia calls that "false and misleading when made because Defendants collect data from all users by default, employ no age verification, and are aware from widely reported data that children under 13 regularly use ChatGPT." Texas puts a number on it, alleging "tens of thousands of users who are under 13 years of age" in the state.

The complaints quote OpenAI's privacy policy for people outside the United States, the version "updated Feb. 6, 2026." That page tells US readers to read OpenAI's separate US policy instead (OpenAI). The US policy carries the same under-13 sentences, and adds that "Users under 18 must have permission from their parent or guardian."

Arizona's complaint also cites a Wall Street Journal report that OpenAI's age prediction was at one point "misclassifying minors as adults about 12% of the time." OpenAI's help page says age prediction looks at signals such as "general topics you talk about, the times of day you use ChatGPT," and how long the account has existed, and that adults it flags can prove their age through Persona, a third-party verification service (OpenAI). So ChatGPT uses the topics of your chats to estimate your age.

Which states cite their own privacy laws?

Four go beyond consumer fraud:

• Montana brings a full count under its Consumer Data Privacy Act. It alleges OpenAI processes minors' data without consent, collects minors' precise geolocation, collects "the sensitive data of adults prior to seeking their consent," and fails to give "a reasonably accessible, clear and meaningful privacy notice."
• Nebraska says OpenAI breaks its Age-Appropriate Online Design Code by failing to "minimize the collection of data from covered minors," to keep targeted ads away from them, and to set the most protective defaults.
• Texas says OpenAI has no "commercially reasonable method" to verify a parent, and no tools that let a verified parent limit how a teen's personal information is shared or used for targeted ads. It adds: "In no event can a parent request access to what information a child has provided ChatGPT."
• Arkansas asks the court to declare that OpenAI violated the state's Children and Teens' Online Privacy Protection Act and to stop it collecting and using children's and teens' personal information.

What does OpenAI say?

OpenAI spokesperson Drew Pusateri told Al Jazeera the company "built industry-leading age-specific protections into our product that many other AI products lack," and that "we're committed to working with states on advancing pragmatic AI policies" (Al Jazeera).

OpenAI's own pages answer some of the data points. Its parental controls FAQ says linking accounts "does not give a parent or guardian access to a teen's conversations, chat history, or real-time activity" (OpenAI). Its age prediction page says OpenAI "will not show ads" to an account in ChatGPT for Teens. Its US privacy policy says it doesn't share data for targeted advertising "for users we know to be under 18 years of age."

What can ChatGPT users do while the cases run?

Three steps help now, whatever the courts decide. This isn't legal advice.

• Training: open your account menu, choose Settings, then Data controls, and turn off Improve the model for everyone (OpenAI).
• Memory: in Settings, then Personalization, turn off memory or delete what it saved. OpenAI says it "may retain logs of deleted saved memories for up to 30 days" (OpenAI).
• Anything sensitive: keep it out of a saved chat. Deleted chats leave OpenAI's systems within 30 days, with legal exceptions we cover in is ChatGPT private.

Before Florida sued, its statewide prosecutor opened a criminal investigation after reviewing chat logs between ChatGPT and the Florida State University gunman (Florida Attorney General). Chats stored on a company's servers can be pulled into court, as we explain in can AI chats be subpoenaed.

How Morse keeps your chat history on your device

Every data claim in these complaints starts with conversations collected by default, kept on OpenAI's servers, and fed into training unless you find the switch. Morse is built not to store your chats.

There's no training switch to find, because Morse doesn't train AI on your content, sell your data, or show ads. Your chat history is stored only in your browser, encrypted, not on Morse's servers, and Morse's servers don't keep messages or log their content. Morse is for adults only: users confirm they're 18 or older.

• Private, the default, for everyday chats you'd rather no host keep. Open-weight models like DeepSeek, Kimi, and GLM, plus Grok, run under zero data retention agreements Morse has with its inference, search, and other providers. Where a provider confirms zero retention on each reply, Morse checks it.
• E2EE, for anything no one should read. Your browser checks the enclave's proof that it's genuine before anything leaves your device, then encrypts the message so only that enclave can read it. Morse's servers relay text they can't read. The guarantee rests on the enclave hardware and attestation working as designed.
• Anonymous, to use GPT without OpenAI knowing it's you. Morse's proxy removes your account, email, and IP address and sends the message under Morse's own account. The provider still sees the text and may keep it for a limited time to check for abuse, under its own policy, so leave names out.

Because Morse doesn't store chats, it usually has very little to give authorities. Clearing your browser or deleting your account deletes your chats for good, and Morse can't recover them either, so keep a copy of anything you need.

You can try a chat from the Morse home page without an account, or start free with no card. End-to-end encrypted chats come with Pro, at $19 a month.