Summary: Kentucky Attorney General Russell Coleman sued Character Technologies and founders Noam Shazeer and Daniel De Freitas on January 8, 2026, in the first state lawsuit against an AI chatbot company. The complaint cites consumer protection and data privacy laws, alleges weak age verification and inadequate child safeguards, and seeks penalties and injunctive relief. Character.AI says it is reviewing the allegations and had removed open-ended chats for under-18 US users.
Thursday, January 8, 2026: Kentucky Attorney General Russell Coleman walked into Franklin Circuit Court with a civil complaint against Character Technologies and its two co-founders, Noam Shazeer and Daniel De Freitas — the first time any US state has sued an AI chatbot company. The filing brands Character.AI “dangerous” and accuses it of preying on children’s inability to tell real friends from artificial “friends.”
The timing talks as loudly as the target. Kentucky’s Consumer Data Protection Act took effect January 1, 2026 — one week before the suit landed. With federal AI legislation going nowhere, a state attorney general has just demonstrated that consumer protection and privacy statutes already on the books can be aimed straight at an AI company.
The First State Lawsuit Against an AI Chatbot Company
Per the Kentucky Lantern, the complaint alleges violations of the Kentucky Consumer Protection Act, the Kentucky Consumer Data Protection Act, and additional statutes, seeking $2,000 in civil penalties per count plus a court order barring “future false, misleading, deceptive or unfair” conduct. Both founders stand named beside the company — a detail worth pausing on, since it places personal liability on the table for the people who shipped the product.
Coleman’s statement skipped the diplomacy: “The United States must be a leader in the development of AI, but it can’t come at the expense of our kids’ lives.” His office estimates “tens of thousands” of Kentuckians actively use Character.AI, thousands of them under 18; The Record reports the platform serves more than 20 million users a month.
What the Complaint Alleges
The allegations sort into three buckets.
Data practices: no effective age verification, no parental controls, inadequate content filtering, and no parental consent for collecting personal data from children under 13. The suit claims the company concealed that children’s data fed improvements to the underlying LLM and generated subscription revenue.
Content: swarms of chatbots modeled on Sesame Street, Paw Patrol, Bluey, and Disney characters. The complaint alleges some engage in sexual conversations, “trivialize substance abuse, self-harm, aggression and violence,” and that bots impersonated licensed mental health professionals, handing minors mental health advice with no degree behind it.
Remediation: Character.AI barred minors from open-ended chats in the US in November, yet the suit says a child can sidestep the restriction with a fake birthday, and that the newer Stories feature lets minors build bots into explicitly romantic relationships and violent scenarios. The complaint also quotes Shazeer from a 2023 podcast describing the launch philosophy as “throw something out there and let people use it however they want.” Elsewhere in litigation, the platform has been linked to the suicides of at least two teenagers.
A Week-Old Privacy Law Becomes the Enforcement Weapon
For developers, the legal route is the loudest signal. The Kentucky Consumer Data Protection Act, live since January 1, 2026, extends heightened protections to children under 13, parental consent included. The attorney general declined to wait for AI-specific legislation — he pointed a week-old privacy statute at a conversational AI product. Privacy law has stopped being a compliance binder; it is now a live enforcement instrument against AI companies, and every state holding a comparable comprehensive privacy law can photocopy this playbook.
Character.AI’s Response
A spokesperson said the company is “reviewing these allegations,” that safety is its highest priority, that it went “well beyond legal requirements” by proactively removing open-ended chats for under-18 US users, and that it had spent months communicating with the attorney general’s office — labeling the decision to litigate “disappointing.”
The trouble is that those exact measures are the ones the complaint deems inadequate. A bypassable age gate and safety holes in new features now serve as the state’s evidence. Product-level fixes that never pass independent verification do not assemble into a defense.
What It Means for AI Product Teams
Three consequences. First, state attorneys general have become active enforcers of AI child safety; at $2,000 per count, penalties stack quickly across millions of interactions. Second, the compliance surface has stretched from content moderation into data governance — what child data you collect, why, and under what consent basis will anchor discovery. Third, the “companion” framing itself is on trial: anthropomorphism, role-play, and unlimited conversation are design choices courts will now inspect one by one. The line between a health experience shipped inside a controlled framework — the route OpenAI took with ChatGPT Health — and “unlicensed mental health advice” is where the next wave of consumer AI litigation will be fought.