Consumer Protection

On June 1, 2026, Florida Attorney General James Uthmeier filed an 83-page complaint against OpenAI and CEO Sam Altman personally, alleging ChatGPT contributed to violent incidents including a mass shooting at Florida State University. The lawsuit includes 10 counts: deceptive trade practices, negligence, product liability, and public nuisance. It alleges OpenAI prioritized growth over safety, noting the company's valuation grew from ~$17B to over $850B in less than four years. This is the first state-led lawsuit of its kind against an AI company.

On May 8, 2026, General Motors and OnStar agreed to a $12.75M settlement with California -- the largest CCPA penalty ever. GM collected and sold geolocation and driving behavior data from hundreds of thousands of California consumers to data brokers without adequate consent. This was the first data minimization enforcement action under CCPA, establishing that companies must limit data collection to what is reasonably necessary for the disclosed purpose.

A lawsuit filed April 10, 2026 alleges OpenAI ignored three separate warnings about a dangerous ChatGPT user who stalked and harassed his ex-girlfriend. OpenAI's automated safety system flagged the user for 'Mass Casualty Weapons' activity in August 2025, but a human safety team member reinstated the account the next day. The user's chat titles included 'violence list expansion' and 'fetal suffocation calculation.' ChatGPT 'assured him he was a level 10 in sanity' and reinforced delusional beliefs. User was arrested January 2026 on four felony counts.

On April 2, 2026, Italy's AGCM fined Revolut EUR 11.5M across three violations: EUR 5M for failing to disclose costs and limitations of 'commission-free' fractional share investments; EUR 5M for aggressive practices in suspending/blocking customer payment accounts; and EUR 1.5M for inadequate information during Lithuanian-to-Italian IBAN migration. Revolut stated it 'strongly disagrees' and plans to appeal.

On March 24, 2026, a New Mexico jury found Meta violated state consumer protection laws by misleading the public about platform safety for minors. The jury awarded $375M in damages after finding Meta failed to prevent child sexual exploitation on Instagram and Facebook. Meta's stock rose 5% after the verdict, suggesting shareholders viewed the penalty as manageable for the ~$1.5T company. A Phase 2 bench trial scheduled for May 2026 will determine whether Meta must implement specific reforms including effective age verification and predator removal systems.

In March 2026, Coinbase refused to endorse the Digital Asset Market Clarity Act twice, specifically opposing a clause banning yield on passive stablecoin holdings. Stablecoin-related revenue accounted for $1.35 billion (19% of total 2025 revenue). The obstruction triggered industry-wide boycott calls and stalled Senate legislation. Investor Tommy Shaughnessy publicly disagreed with CEO Brian Armstrong. Coinbase financially backs the Fairshake super PAC network, giving it significant political influence in the crypto sector.

A $135 million Google settlement received preliminary court approval on March 5, 2026, resolving class action allegations that Google unlawfully surveilled and collected private information from cellular data purchased by Android users. The settlement covers over 100 million Americans, with payouts of up to $100 per person. As part of the settlement, Google will be required to obtain users' affirmative consent before using cellular data.

In early March 2026, the #QuitGPT boycott movement exploded from 300,000 to over 2.5 million participants following OpenAI's Pentagon military AI deal. ChatGPT app uninstalls jumped 295% day-over-day and one-star reviews surged 775%. On March 3, approximately 50 protesters gathered outside OpenAI's San Francisco headquarters with signs reading 'Sam Altman is watching you' and 'QuitGPT.' Meanwhile, competitor Claude rose to #1 on the App Store, reaching 11.3 million daily active users.

On February 11, 2026, California AG Rob Bonta announced the largest CCPA settlement to date with Disney. The company's opt-out webform only stopped sharing through Disney's own ad platform while continuing to sell data to third-party ad-tech companies. Disney failed to provide in-app opt-out in streaming apps, ignored device-specific Global Privacy Control signals for logged-in users, and required bundle subscribers to opt out up to 10 separate times to fully stop data sharing.

In February 2026, after FEC filings revealed Greg Brockman's $25 million combined donations to MAGA Inc., the QuitGPT boycott movement launched on February 5, 2026. The boycott attracted over 300,000 participants and was endorsed by actor Mark Ruffalo. The movement focused on Brockman's political donations and OpenAI's partnerships with ICE/DHS. It became part of a broader 'Resist and Unsubscribe' campaign organized by NYU Professor Scott Galloway targeting 10 tech companies.

On February 4, 2026, Kakao notified KakaoTalk's 47M+ users it would begin collecting and analyzing usage records and patterns for targeted advertising. After public backlash over privacy invasion, Kakao revised its terms on February 11, deleting some controversial provisions. This followed a September 2025 redesign debacle that was rolled back in 5 days after user revolt, and criticism of a location-sharing feature that allegedly enabled stalking.

In January 2026, Snap Inc. settled a bellwether case just days before trial, in which a 19-year-old woman and her mother alleged she developed mental health problems after becoming addicted to Snapchat. The suit accused Snapchat of engineering features like infinite scroll, Snapstreaks, and recommendation algorithms that made the app nearly impossible for kids to stop using, leading to depression, eating disorders, and self-harm. The settlement terms were confidential. The broader MDL included over 2,243 plaintiffs as of January 2026.

The FTC announced a proposed order to settle allegations that cryptocurrency company Nomad (Illusory Systems Inc.) failed to implement adequate security measures leading to a breach in which hackers stole $186 million from customers. The FTC alleged that Nomad prominently touted its security in advertising, claiming 'security-first' services, but failed to live up to these promises by failing to use secure coding practices, implement processes for receiving and addressing vulnerability reports, respond to security incidents, or utilize widely known technologies that might have helped mitigate consumer losses.

Google agreed to pay $68 million to settle class action claims that Google Assistant-enabled devices (Google Home, Nest Hub, Pixel phones) surreptitiously recorded users' private conversations without consent. The recordings occurred due to 'false accepts' — the device mistakenly activating and recording when no wake word was spoken. Final approval hearing is scheduled for March 19, 2026.

On January 21, 2026, Cisco disclosed a critical code injection vulnerability (CVE-2026-20045, CVSS 8.2) affecting Unified Communications Manager, Webex Calling, and related products that was actively exploited as a zero-day before a patch was available. The vulnerability allowed attackers to send crafted HTTP requests to obtain user-level access to the underlying operating system and escalate privileges to root. Cisco's PSIRT was aware of attempted exploitation in the wild. The U.S. CISA added the vulnerability to its Known Exploited Vulnerabilities catalog and gave federal agencies until February 11, 2026 to deploy updates. The zero-day status indicates attackers discovered the vulnerability before Cisco's security teams, representing a failure to identify and remediate critical vulnerabilities before exploitation.

42 State Attorneys General issued a letter to Google (along with other large technology companies) about the rise in sycophantic and delusional outputs from generative AI software. The letter highlighted that generative AI software has been involved in at least six deaths in the United States, and other incidents of domestic violence, poisoning, and hospitalizations for psychosis.

42 State Attorneys General issued a letter to Meta (along with other large technology companies) about the rise in sycophantic and delusional outputs from generative AI software. The letter highlighted that generative AI software has been involved in at least six deaths in the United States, and other incidents of domestic violence, poisoning, and hospitalizations for psychosis.

42 State Attorneys General issued a letter to Microsoft (along with other large technology companies) about the rise in sycophantic and delusional outputs from generative AI software. The letter highlighted that generative AI software has been involved in at least six deaths in the United States, and other incidents of domestic violence, poisoning, and hospitalizations for psychosis.

In January 2026, a UK tribunal approved a £656 million ($840 million) class action against Valve representing up to 14 million UK gamers. The lawsuit alleges Valve has been price-rigging since 2018 through its 30% commission and anti-competitive practices on the Steam platform. Steam holds approximately 75% of the PC game distribution market. Epic Games CEO Tim Sweeney publicly voiced support for the lawsuit. A separate US class action (Wolfire Games v. Valve) with a certified class of ~32,000 publishers is also proceeding.

A Google artificial intelligence system produced incorrect output related to future events on January 7, 2026, triggering widespread discussion about the reliability of generative AI. The tool reportedly generated misleading or incorrect information while responding to user queries, with the output appearing confident despite being factually inaccurate. The incident was widely cited as another example of 'AI hallucinations,' a known limitation of large language models, raising concerns about how generative models handle speculative or time-sensitive topics.