Background: What Was Filed and Why
On June 1, 2026, Florida Attorney General James Uthmeier filed a civil complaint against OpenAI and its CEO Sam Altman in the Tenth Judicial Circuit, Highlands County. The action was brought exclusively under the Florida Deceptive and Unfair Trade Practices Act (FDUTPA), no federal claims were asserted. The complaint names five OpenAI corporate entities and Altman personally.
The complaint alleges four counts: unfair and immoral practices, unconscionable practices, deceptive practices, and COPPA violations routed through FDUTPA as state-actionable unfair trade practices. The State seeks damages, injunctive relief, civil penalties, and disgorgement.
The filing is notable on several grounds: it is the first state-led lawsuit of its kind against an AI company, i holds a CEO personally liable rather than pursuing only corporate entities, and it deliberately avoids federal claims, signaling an intent to build state-level enforcement precedent independent of federal action. This analysis examines the structural consequence of that approach: how civil litigation is becoming a parallel mechanism for building the same digital identity verification infrastructure that has stalled or faced constitutional challenge in state legislatures.
The Alleged Harms: Brief and Factual
The complaint’s factual allegations are extensive. CLA takes no position on their ultimate merit, as these are allegations in a civil complaint, not proven findings. Several of the specific harms alleged, including dangerous advice on drug combinations, weapons guidance, and self-harm content, involve behaviors that are, as a practical matter, also accessible through standard internet search engines. That observation is not a defense of OpenAI’s conduct; it is relevant to proportionality analysis when evaluating proposed remedies.
The complaint’s allegations regarding minors are the most legally significant for purposes of this analysis. The complaint alleges that ChatGPT has tens of thousands of users under the age of 13 in Florida alone, that the free tier has no age gatekeeping mechanism of any kind, that the paid tier collects age information without verifying it, and that no mechanism exists for parents to access their child’s conversation history absent voluntarily linking accounts, a step OpenAI does not require or prominently disclose.
What Parents Can Already Do
Before analyzing the proposed remedy, it is worth establishing what parental authority already permits and what most parents are not doing.
A parent who requires their child to use ChatGPT only under shared account credentials has full visibility into every conversation in that account’s history. A parent who sets router-level controls can block ChatGPT entirely until they decide otherwise. A parent who conditions device access on account transparency, ie: “the only way you use this tool is if I have access to the account”, is exercising legitimate parental authority that requires no government intermediary, no third-party vendor, and no state-mandated infrastructure.
Parents are largely not doing this. The more precise question is: why not? The complaint itself provides the answer. OpenAI does not prominently disclose that conversation history is retained and accessible. The memory feature which builds persistent cross-session profiles from user-provided data, was rolled out in 2024 and set to on by default, without prominent parental notification. The account-linking option that would allow some parental visibility exists but is not required, not prominently surfaced, and limited in scope even when used.
This is a transparency and disclosure problem. Parents cannot exercise authority they do not know they have, over tools whose data retention practices they have not been clearly informed of.
The Remedy Mismatch
The problem the complaint documents is a transparency and disclosure problem. The remedy that will be positioned as the solution, by legislators citing this case and by any consent decree negotiated in settlement, is an age verification and identity enrollment solution.
These do not match.
A disclosure mandate requiring OpenAI to clearly inform parents that conversation history is retained, that memory features are on by default, that account linking is available and how to enable it, and what data is collected from users under 13 addresses the documented harm directly. It requires no identity verification infrastructure. It does not create a database of verified user ages. It does not establish a third-party credentialing chain. It imposes a communications and design obligation on the platform, not an enrollment obligation on the user.
Age verification, by contrast, does not solve the transparency problem. A parent whose 14-year-old has been age-verified to use ChatGPT still has no automatic visibility into their child’s conversations. The verification establishes that the user is above a threshold age. It does not establish parental awareness, parental access, or parental oversight. It addresses a different problem entirely; platform liability for knowingly serving minors while leaving the documented transparency failure intact.
The remedy being positioned as child protection is, more precisely, platform liability protection. The infrastructure consequence falls on users and parents, not on OpenAI.
How the Litigation Track Builds What Legislation Couldn’t
CLA’s prior analytical work has focused on the legislative track for age verification infrastructure: bills in state legislatures and Congress that mandate age assurance mechanisms, create OS-level verification requirements, or compel app stores to collect and transmit age signals. But a parallel track has been developing alongside the legislative one: state attorneys general using consumer protection litigation to produce identical infrastructure outcomes through a fundamentally different mechanism. Florida v. OpenAI is the most prominent AI-specific instance of this pattern. It follows a line of cases that includes the Texas AG’s action against Discord under the Texas DTPA for knowingly allowing underage users without parental consent, and the 2023 multistate AG coalition suit against Meta, which explicitly sought algorithmic design changes and age verification as structural relief. In each case, the litigation track accomplished or is positioned to accomplish what the legislative track either could not pass or could not sustain against constitutional challenge.
A consent decree is a negotiated court order. It requires no legislative vote. It does not go through committee markup. It is not subject to the same First Amendment challenges that have complicated mandatory age verification legislation following Free Speech Coalition v. Paxton. It is not subject to repeal by a subsequent legislative session. It remains in effect until the defendant successfully petitions the court for modification, which is a high bar.
Critically, a consent decree that requires OpenAI to implement age verification as a condition of operating in Florida compels the platform to build and maintain that infrastructure, making the platform itself the enforcement point. This sidesteps Fourth Amendment concerns that would attach to government-operated verification systems. The infrastructure is privately held, privately operated, and privately maintained. The government’s role was simply to sue.
The durable consequence: age verification infrastructure that a legislature could not mandate without constitutional exposure, and could not sustain against a repeal vote, can be permanently embedded into platform operations through a single civil settlement. The Attorney General can accurately say “we did not mandate Digital ID, OpenAI agreed to it.” The infrastructure is identical, but the mechanism is different.
A Note on the Research Sources
The complaint cites Common Sense Media (CSM) three times as a research source for statistics on teen AI use and companionship. It’s important to be aware that CSM is not a neutral research organization. CSM is an active policy advocacy organization that has lobbied directly for age verification legislation, app store accountability bills, and the Kids Online Safety Act, which is the same category of legislation that Florida v. OpenAI is structurally positioned to advance through the consent decree mechanism.
CSM’s research arm produces studies that its advocacy arm then cites to justify the legislation it supports. When that research appears in a state AG complaint whose most likely remedy is age verification infrastructure, the loop is complete: CSM research supports the harm narrative that supports the lawsuit that produces the consent decree that delivers the policy outcome CSM has been seeking legislatively.
The Both-Ends Problem
State attorneys general are not waiting for legislatures. Florida v. OpenAI arrives as state legislatures across the country are actively considering age verification mandates, OS-level identity verification requirements, and app store accountability legislation. The litigation track and the legislative track are now operating simultaneously and they converge on the same infrastructure.
Legislatures build age verification infrastructure from the top down: mandating that platforms implement verification systems as a condition of legal operation. Litigation builds it from the bottom up: compelling platforms to implement verification systems as a condition of settlement. The platform’s experience is identical in either case. The infrastructure it builds is identical. The data it collects, retains, and becomes responsible for protecting is identical.
The difference is accountability. Legislation is debated publicly, amended through committee, subject to constitutional challenge, and reversible by subsequent legislatures. Consent decrees are negotiated privately, not subject to public amendment, significantly harder to challenge constitutionally, and designed to be difficult to reverse. The litigation track produces more durable infrastructure with less democratic accountability, and it produces it faster, with fewer points at which the public or their elected representatives can intervene.
That is not an incidental feature of this approach. It is the point.
What Is Actually Being Built
A disclosure mandate that clearly informs parents of their existing authority, requires prominent notification of data retention practices, and mandates accessible parental oversight tools addresses the documented harm without building identity verification infrastructure. That remedy is available, but it is not the one being pursued.
What is being pursued, through legislation in state capitols and through consent decrees in civil courts, is a persistent, platform-embedded identity verification architecture (a de facto Digital ID) that will outlast any individual lawsuit, survive changes in legislative majority, and be available for purposes well beyond the child safety justification that is funding its construction. The infrastructure is the constant, the justification is the variable.
Julie Barrett is the founder and president of Conservative Ladies of America, a 501(c)(4) constitutional conservative policy advocacy organization. CLA tracks technology legislation, including age verification, digital ID infrastructure, app store accountability, and AI policy, through a constitutional and parental rights lens. Learn more at conservativeladiesofamerica.com. Contact: [email protected]