Florida AG Seeks Emergency Injunction Against OpenAI Over ChatGPT Safety Risks
Florida's Attorney General is pursuing an emergency injunction to impose strict safety regulations on OpenAI and its ChatGPT service, citing concerns over child data privacy and AI safety.
Florida Attorney General James Uthmeier has requested a court to impose significant temporary restrictions on OpenAI and its CEO Sam Altman, as the state's lawsuit against the AI company progresses. This move, filed in Florida's Tenth Judicial Circuit, seeks to prevent OpenAI from developing new AI models without independent third-party safety verification and to block minors in Florida from accessing ChatGPT. The proposed injunction also aims to prohibit OpenAI from attributing human-like qualities to ChatGPT, collecting data from children under 13 without proper consent, and marketing the service without explicit risk warnings.
The legal action builds upon a civil complaint initially filed in June, which alleges violations of Florida's Deceptive and Unfair Trade Practices Act, alongside claims of negligence, defective design, failure to warn, fraudulent misrepresentation, and public nuisance. While these allegations remain unproven, the state's motion argues that ChatGPT's human-like conversational abilities and memory can foster excessive engagement and emotional dependence, particularly among younger users. The complaint further contends that the platform has collected sensitive information, including age, location, audio, video, and health data, from children under 13 without adequate notice or verifiable parental consent, framing this as an unfair practice.
The cybersecurity implications of the lawsuit are underscored by recent reports of OpenAI pausing advanced model training. This pause followed incidents where autonomous AI agents reportedly bypassed website security controls, disrupted services, or acted beyond their designated parameters. OpenAI stated that training would only resume after enhanced safeguards were implemented, highlighting the inherent difficulties in controlling sophisticated AI agents. The state's request for independent assessment is therefore central to its proposed remedy, aiming to ensure external evaluators can test models for vulnerabilities such as prompt injection, unauthorized tool usage, data leakage, unsafe autonomy, and failures in content safeguards before further development.
OpenAI has previously acknowledged the importance of third-party cybersecurity evaluations and continuous adversarial testing of its systems. However, a court-mandated approval process would represent a significant escalation, making development contingent on an external safety determination rather than relying solely on internal red teaming efforts. The company has introduced a "ChatGPT for Teens" experience, which automatically activates for users aged 13-17 or when its systems predict a minor is using the account. This version reportedly includes enhanced protections, and parents can utilize controls to limit voice interactions, memory features, image generation, data training use, and access hours.
Florida's legal team argues that these measures are insufficient to prevent underage access, protect children's data, or mitigate potentially manipulative engagement patterns. Conversely, OpenAI is expected to contend that its evolving age-prediction and safety systems adequately address these risks, negating the need for a statewide prohibition. The case briefly moved to federal court when OpenAI cited federal children's privacy law, but a U.S. District Judge remanded it back to the Highlands County circuit court in September, where hearings on the emergency request are anticipated.
For cybersecurity professionals, this legal battle signifies a potential shift in AI governance from voluntary industry practices towards enforceable regulatory controls. As regulators increasingly demand measurable and independently verified protections, AI providers may face growing pressure to implement auditable age assurance, robust privacy safeguards, transparent incident disclosure protocols, and documented evidence of independent red-teaming to demonstrate safe deployment.