On Thursday, January 8, 2026, Kentucky Attorney General Russell Coleman filed a civil suit in Franklin Circuit Court against Character Technologies and its two co-founders, Noam Shazeer and Daniel De Freitas. It is the first lawsuit any US state has brought against an AI chatbot company. The complaint describes Character.AI as “dangerous” and accuses it of preying on children’s inability to distinguish between real friends and artificial “friends.”
The timing matters as much as the target. Kentucky’s Consumer Data Protection Act took effect on January 1, 2026 — one week before the filing. With federal AI legislation stalled, a state attorney general has just demonstrated that existing consumer protection and privacy statutes can be aimed directly at an AI company.
The First State Lawsuit Against an AI Chatbot Company
According to the Kentucky Lantern, the complaint alleges violations of the Kentucky Consumer Protection Act, the Kentucky Consumer Data Protection Act, and other laws. It seeks $2,000 in civil penalties per count and a court order barring the company from “future false, misleading, deceptive or unfair” conduct. The two founders are named alongside the company — a detail that should not be missed, because it puts personal liability on the table for the people who shipped the product.
Coleman’s statement was blunt: “The United States must be a leader in the development of AI, but it can’t come at the expense of our kids’ lives.” His office estimates that “tens of thousands” of Kentuckians actively use Character.AI, including thousands under 18. The Record reports the platform has more than 20 million monthly users.
What the Complaint Alleges
The allegations fall into three buckets.
Data practices: no effective age verification, no parental controls, inadequate content filtering, and no parental consent for collecting personal data from children under 13. The suit claims the company concealed the fact that children’s data was used to improve the underlying LLM and generate subscription revenue.
Content: chatbots modeled on Sesame Street, Paw Patrol, Bluey, and Disney characters. The complaint alleges some engage in sexual conversations, “trivialize substance abuse, self-harm, aggression and violence,” and that bots posed as licensed mental health professionals, giving minors mental health advice with no professional degree behind it.
Remediation: Character.AI barred minors from open-ended chats in the US in November, but the suit says a child can bypass the restriction with a fake birthday, and that the newer Stories feature lets minors set up bots in explicitly romantic relationships and violent scenarios. The complaint also cites a 2023 podcast appearance in which Shazeer described the launch philosophy as “throw something out there and let people use it however they want.” In other lawsuits, the platform has been linked to the suicides of at least two teenagers.
A Week-Old Privacy Law Becomes the Enforcement Weapon
For developers, the legal route is the real signal. The Kentucky Consumer Data Protection Act, effective January 1, 2026, provides heightened protections for children under 13, including parental consent. The attorney general did not wait for AI-specific legislation — he aimed a week-old privacy statute at a conversational AI product. Privacy law is no longer a compliance document; it is a live enforcement instrument against AI companies, and any state with a comparable comprehensive privacy law can copy this playbook.
Character.AI’s Response
A company spokesperson said Character.AI is “reviewing these allegations,” that safety is its highest priority, that it went “well beyond legal requirements” by proactively removing open-ended chats for under-18 US users, and that it had been in communication with the attorney general’s office for months — calling the decision to litigate “disappointing.”
The problem is that those exact measures are what the complaint deems inadequate. A bypassable age gate and safety gaps in new features are now the state’s evidence. Product-level fixes that are never independently verified do not make a defense.
What It Means for AI Product Teams
Three practical consequences. First, state attorneys general are now active enforcers of AI child safety; at $2,000 per count, penalties compound quickly across millions of interactions. Second, the compliance surface just widened from content moderation to data governance — what child data you collect, why, and under what consent basis will be the focus of discovery. Third, the “companion” framing itself is on trial: anthropomorphism, role-play, and unlimited conversation are design choices that courts will now scrutinize. The line between a health experience shipped inside a controlled framework — the approach OpenAI took with ChatGPT Health — and “unlicensed mental health advice” is where the next wave of consumer AI litigation will be fought.
Sources
- Kentucky attorney general’s lawsuit says AI company ‘preys’ on youth — Kentucky Lantern
- Kentucky sues Character.AI, alleging it harms children and violates data law — The Record
- Kentucky AG Files Lawsuit Against AI Chatbot — Troutman Pepper
AI-assisted summary compiled from the sources above, reviewed by a human before publishing.