AI Regulation Reference
AI Law Tracker
35 laws tracked across the EU, US federal government, US states, UK, and international bodies — filtered and explained for small teams.
Real-world enforcement actions and government lawsuits. Regulators worldwide are using existing and new powers against AI misuse. Decided cases show what violations look like in practice and what they cost. Cases marked Lawsuit filed are allegations a government has taken to court, not findings: no court has ruled on the claims yet.
Showing 28 of 28 cases · sorted by most recent
Eight state attorneys general (Arizona, Arkansas, Idaho, Iowa, Kansas, Montana, Nebraska and West Virginia) each sued OpenAI in their own state court on the same day. They allege OpenAI marketed ChatGPT as safe while it harmed children and deceived parents. The claims rest on state consumer protection law, such as Arizona's Consumer Fraud Act, Idaho's Consumer Protection Act and Iowa's Consumer Fraud Act; Arkansas, Montana and Nebraska also cite their children's privacy or online design laws.
Allegations, not findings. A government has filed these claims in court; no court has ruled on them.
Status: Pending as eight separate suits, with no ruling on the claims as of our October 16, 2026 check. Courts named by the states include Maricopa County Superior Court (Arizona), the Fourth Judicial District in Ada County (Idaho) and Lewis and Clark County (Montana). The states ask the courts to stop the practices they describe; Arkansas also seeks an order barring OpenAI from collecting minors' data.
After supervision by the ICO, ten of the largest foundation model developers operating in the UK made, or committed to make, data protection changes, including clearer transparency information, stronger mechanisms for people to exercise their rights and tougher assessments of safeguards. The ICO also confirmed enquiries with OpenAI, Anthropic, Meta and the UK AI Security Institute about recent agentic AI testing and deployment.
Outcome: No fine or formal order. The ICO says it is monitoring each developer's progress against its commitments, and it opened a six-week call for evidence on the data protection risks of agentic AI.
The AI Office's enforcement powers over general-purpose AI model providers became applicable on August 2, 2026. On August 29, 2026 it issued its first formal requests for information under Article 91 of the AI Act, covering model safety and security, independent external evaluations and post-market monitoring. On October 14, 2026, Executive Vice-President Henna Virkkunen confirmed the AI Office had sent requests on security, external evaluation and monitoring how models are used. Euronews and TechRepublic reported that the requests went to OpenAI and Anthropic after summer incidents in which their AI agents reached outside organisations.
Outcome: Information requests only, no penalties. Under Article 101, GPAI providers face fines of up to EUR 15 million or 3% of global annual turnover for ignoring a request or giving incorrect, incomplete or misleading answers.
After an inquiry it opened on its own initiative, Italy's Garante found that Character.AI, a generative AI service where users, including minors, create and chat with virtual characters, had shortcomings in its privacy notice and completed its data protection impact assessment and named its EU representative late. It also found problems with the safeguards for minors and the age verification procedures.
Outcome: €158,000 fine (decision of July 3, 2026, announced July 9). Character Technologies must make its age verification work, make the cooling-off period that stops blocked minors from re-registering effective, and set minors' profiles to private by default, then report its measures within 120 days of receiving the decision.
Florida's attorney general sued OpenAI and its CEO Sam Altman in the Tenth Judicial Circuit (Highlands County). The complaint alleges they released and marketed ChatGPT to the public, including children, while concealing serious risks and suppressing internal safety warnings. Its counts include violations of the Florida Deceptive and Unfair Trade Practices Act, negligence, strict liability and public nuisance.
Allegations, not findings. A government has filed these claims in court; no court has ruled on them.
Status: Pending, with no ruling on the claims as of our October 16, 2026 check. Florida seeks damages and an end to the practices it describes. On September 28, 2026 it moved for a temporary injunction that would, among other things, bar minors from using ChatGPT.
The FTC found Cox Media Group and two smaller marketing firms falsely claimed to offer an AI-powered 'Active Listening' service that targeted ads by capturing consumers' private conversations via their smart devices. Instead, the service consisted of reselling, at a significant markup, email lists obtained from other data brokers. They also falsely told customers that consumers had consented to voice data collection by accepting app terms of service.
Outcome: Total $930,000 in settlements: Cox Media Group $880,000; MindSift $25,000; 1010 Digital Works $25,000. The FTC made the orders final on August 27, 2026. They bar all three from making future misrepresentations about voice data collection, consumer consent, or AI capabilities.
Pennsylvania's Department of State sued Character Technologies in the Commonwealth Court of Pennsylvania. It alleges that chatbot characters on Character.AI claimed to be licensed medical professionals, including psychiatrists, which the state says is unlicensed practice of medicine under the Medical Practice Act. In one instance the state found, a chatbot said it was licensed in Pennsylvania and gave an invalid license number.
Allegations, not findings. A government has filed these claims in court; no court has ruled on them.
Status: Pending, with no ruling on the claims as of our October 16, 2026 check. Filed May 1, 2026 and announced May 5. The state asks for a preliminary injunction that stops the company from presenting its bots as licensed medical professionals.
Kentucky's attorney general sued Character Technologies, its owners and its Character.AI chatbot platform in Franklin Circuit Court. The complaint alleges the company put profits ahead of children's safety on a platform with a record of encouraging suicide, self-injury and isolation, and that it exposed minors to sexual content, in violation of the Kentucky Consumer Protection Act and the Kentucky Consumer Data Protection Act.
Allegations, not findings. A government has filed these claims in court; no court has ruled on them.
Status: Pending, with no ruling on the claims as of our October 16, 2026 check. Kentucky asks the court to force changes to the platform's practices and to award monetary damages. Character Technologies is now in bankruptcy proceedings, where Kentucky joined other attorneys general in a notice asking that any sale of the business protect children and consumers.
The FTC reopened and set aside its own 2024 consent order against Rytr, an AI writing tool the agency had charged with enabling fake reviews. The Commission found the original complaint did not satisfy the FTC Act's legal requirements and that the order unduly burdened AI innovation, citing the Trump administration's AI executive order and AI Action Plan.
Outcome: The 2024 Rytr consent order was vacated. The reversal signaled a lighter federal AI-enforcement posture: fraud and deception causing direct consumer harm remain enforceable, while orders seen as restricting AI capability face a more permissive environment.
The Australian Privacy Commissioner found Kmart's deployment of facial recognition in 28 stores (June 2020 to July 2022), used to identify refund fraud, breached Australians' privacy. The system captured the faces of every person who entered those stores and everyone who presented at a returns counter.
Outcome: Determination that Kmart breached Australians' privacy. Kmart stopped using the system in July 2022, when the OAIC investigation began. The Commissioner said the decision does not ban facial recognition.
The Massachusetts AG alleged that Earnest, a Delaware-based student-loan company, violated consumer-protection and fair-lending laws, including through AI models that could lead to disparate harm to Black, Hispanic, and non-citizen applicants and borrowers, and failed to test its models for disparate impact.
Outcome: $2.5 million paid to the Commonwealth. Earnest must implement a detailed corporate governance structure and robust written policies for responsible, legally compliant AI use, and stop using its 'Cohort Default Rate' variable and a 'Knockout Rule' based on immigration status.
The FTC alleged Workado marketed its AI Content Detector as '98% accurate' at detecting AI-generated text, when that figure came from academic content only; on general writing the model's accuracy was about 53%. Workado used the 98% figure without its own substantiating studies.
Outcome: Final order (approved August 28, 2025, after an April 2025 proposed order) bars Workado from making efficacy claims without competent and reliable evidence, requires it to keep supporting evidence, email eligible consumers about the order, and submit compliance reports one year after the order and every year for the following three years.
Italy's Garante found that, until February 2, 2023, the developer of the AI companion chatbot Replika had not identified a legal basis for its processing, had an inadequate privacy policy, and had no age verification despite saying minors were excluded.
Outcome: €5 million fine against Luka Inc. The Garante also reserved the right to open a separate proceeding on the lawfulness of the generative AI system's processing across its full lifecycle. Follows the February 2023 order blocking Replika in Italy. Final decision dated April 10, 2025.
Following its 2023 temporary ban, Italy's Garante concluded its ChatGPT investigation and found OpenAI processed personal data to train ChatGPT without an adequate legal basis, breached transparency obligations, had no adequate age verification for users under 13, and did not notify the authority of the data breach it suffered in March 2023.
Outcome: €15 million fine and an order to run a six-month public-awareness campaign in Italian media. On March 18, 2026 the Court of Rome (judgment No. 4153/2026) upheld OpenAI's challenge and annulled the decision, without ruling on the alleged violations: once OpenAI's Irish establishment was recognised in February 2024, the case belonged to Ireland's Data Protection Commission as lead authority. The Garante has temporarily removed the decision from its website.
The FTC alleged IntelliVision made false or unsupported claims that its facial recognition software had one of the highest accuracy rates on the market and performed with zero gender or racial bias. In reality it lacked supporting evidence and had trained on images of roughly 100,000 individuals, not the 'millions' it claimed.
Outcome: Final order (January 13, 2025) prohibits IntelliVision from misrepresenting the accuracy, efficacy, or bias performance of its facial recognition technology across genders, ethnicities, and skin tones unless it has competent and reliable testing to support the claims.
The FTC alleged Evolv deceptively advertised that its AI-powered Evolv Express scanners could detect all weapons and were more accurate than traditional metal detectors. Evolv's scanners are used in thousands of schools and other venues such as stadiums and hospitals.
Outcome: Stipulated order filed with the complaint in federal court in Massachusetts (the FTC's case page lists the case as pending). It bars Evolv from making unsupported claims about its products' weapons-detection ability via AI, and requires it to let certain K-12 school customers (contracts signed April 1, 2022 to June 30, 2023) cancel their multi-year contracts.
Australia's Privacy Commissioner found Bunnings unlawfully deployed facial recognition technology capturing the faces of everyone, likely hundreds of thousands of people, who entered 63 Bunnings stores in Victoria and New South Wales between November 2018 and November 2021.
Outcome: Determination with orders (November 2024). On February 4, 2026 the Administrative Review Tribunal set aside the finding that Bunnings breached APP 3.3: it held Bunnings could collect the data without consent to combat retail crime. It upheld the findings that Bunnings failed to notify customers (APP 5) and lacked proper policies and procedures (APP 1). The Privacy Commissioner did not appeal.
The FTC's 'Operation AI Comply' announced five law enforcement actions over deceptive AI claims and schemes. DoNotPay claimed to offer 'the world's first robot lawyer'; Ascend Ecom and Ecommerce Empire Builders sold AI-powered online store and income schemes; Rytr sold an AI 'writing assistant' that generated detailed fake consumer reviews; and FBA Machine (also Passive Scaling) promised guaranteed income from AI-powered storefronts.
Outcome: DoNotPay agreed to pay $193,000 and notify past subscribers. Rytr's proposed order barred it from selling any service promoted for generating consumer reviews (the FTC set that order aside in December 2025). The FTC said FBA Machine cost consumers more than $15.9 million; the store-scheme cases went to federal court.
DoNotPay marketed 'the world's first robot lawyer.' The FTC alleged the company did not test whether its chatbot's output matched a human lawyer's and did not hire or retain any attorneys. Part of Operation AI Comply.
Outcome: $193,000 settlement, made final on February 11, 2025. DoNotPay must notify consumers who subscribed between 2021 and 2023 about the limits of its law-related features, and may not claim it can substitute for any professional service without evidence.
In what the Texas AG called a first-of-its-kind healthcare generative AI investigation, it found Pieces Technologies' claimed 'severe hallucination rate' of '<1 per 100,000' was likely inaccurate and may have deceived hospitals. At least four major Texas hospitals sent patients' healthcare data to Pieces in real time so its product could summarize patients' conditions.
Outcome: Settlement. Pieces agreed to accurately disclose the extent of its products' accuracy and to ensure hospital staff using its generative AI products understand the extent to which they should or should not rely on them.
The Irish DPC, acting as X Corp.'s EU lead supervisory authority, applied to the High Court under urgent powers to halt X's use of EU/EEA users' public posts to train its Grok AI chatbot. The DPC said the processing gave rise to a risk to the fundamental rights and freedoms of individuals.
Outcome: X permanently undertook to cease using EU/EEA user data for Grok AI training. Proceedings were struck out after X agreed to the binding court undertaking. It was the first time the DPC, as lead supervisory authority, took such action under Section 134 of the Data Protection Act 2018. On April 11, 2025 the DPC opened a statutory inquiry into whether the posts X used to train Grok were lawfully processed.
The Dutch Data Protection Authority found Clearview AI processed, without a legal basis, personal data of people in the Netherlands, did not adequately inform data subjects, and did not respond to two access requests, in breach of the GDPR.
Outcome: €30.5 million fine (final decision May 16, 2024) plus four orders, subject to a penalty for non-compliance, to end the ongoing violations.
From 2012 to 2020, Rite Aid used AI facial recognition in hundreds of stores to flag suspected shoplifters. The FTC said the system produced false matches that led staff to accuse customers of wrongdoing, that its actions disproportionately affected people of color, and that Rite Aid did not test or document the system's accuracy.
Outcome: Rite Aid is prohibited from using facial recognition for surveillance for five years. It must delete, and direct third parties to delete, images collected by the system and any algorithms built from them, and implement an information security program overseen by top executives.
The EEOC alleged iTutorGroup programmed its recruiting software to automatically reject female applicants aged 55 or older and male applicants aged 60 or older, rejecting more than 200 qualified US-based applicants in violation of the Age Discrimination in Employment Act.
Outcome: $365,000 to be distributed to applicants who were automatically rejected because of age, plus training for those involved in hiring tutors, a new anti-discrimination policy, and injunctions against age- or sex-based hiring and against requesting applicants' birth dates.
Amazon retained children's voice recordings collected by Alexa indefinitely, even after parents requested deletion, in violation of the Children's Online Privacy Protection Act (COPPA). The FTC said COPPA does not allow companies to keep children's data to train their algorithms.
Outcome: $25 million civil penalty. The court entered the stipulated order on July 19, 2023. It requires Amazon to delete inactive child accounts and certain voice recordings and geolocation data, and prohibits it from using such data to train its algorithms.
Italy's data protection authority temporarily banned ChatGPT from processing Italian users' data, citing GDPR violations: no lawful basis for mass collection of training data, no age verification to prevent minors from accessing the service, and failure to provide adequate transparency about data collection. OpenAI had 20 days to report the measures it took, or face a fine of up to EUR 20 million or 4% of global annual turnover.
Outcome: ChatGPT was unavailable in Italy until April 28, 2023, when OpenAI reopened it after publishing a privacy notice on training data, adding a form to object to the use of personal data for training, and asking users to confirm their age, with a date of birth at sign-up. The Garante fined OpenAI in December 2024; a Rome court annulled that fine in March 2026 (see the December 2024 entry).
The UK ICO found that Clearview scraped images of UK residents from the web and social media into a global online database used for facial recognition, and that this processing was subject to UK data protection law.
Outcome: £7.5M fine and an enforcement notice (May 2022). Clearview appealed and the First-tier Tribunal ruled for Clearview on jurisdiction; in October 2025 the Upper Tribunal upheld three of the ICO's four grounds and sent the case back to the First-tier Tribunal to decide the substantive appeal. On December 19, 2025 the Upper Tribunal gave Clearview permission to appeal to the Court of Appeal. The fine is not final.
In the first application of South Korea's Personal Information Protection Act to an AI system, the PIPC found ScatterLab used roughly 9.4 billion KakaoTalk messages from 600,000 users of its other apps to train its 'Iruda' chatbot without explicit consent, exposed personal data on GitHub, and collected data of over 200,000 children under 14 without parental consent.
Outcome: KRW 103.3 million fine (about USD 93,000) plus corrective orders, across eight PIPA violations. Landmark case for AI training-data consent in Asia.
Status guide
Unfamiliar terms?
Conformity assessment, GPAI model, high-risk AI — all defined in plain English.
Browse the glossary →