Kentucky AG Files Lawsuit Against AI Chatbot
On January 8, the Kentucky attorney general (AG) announced its first lawsuit for violations of the Kentucky Consumer Data Protection Act (KCDPA) against an artificial intelligence (AI) chatbot company. The lawsuit claims the defendant engaged in unfair, false, misleading, or deceptive acts and practices, particularly through the unfair collection and exploitation of children’s data.
Background
The defendant is responsible for designing, building, marketing, and distributing an AI chatbot marketed as a product for interactive entertainment. The company boasts over 20 million monthly active users and more than 180 million monthly website visitors. Their platform allows users to create, customize, and converse with various chatbots, including both real and fictional characters, catering to a wide audience, including children.
Allegations
The complaint asserts that the platform’s features are unsafe for children, citing:
- Easy account creation without effective age verification.
- Chatbots designed to emulate humans, creating grave and detrimental harm due to the platform’s design.
- Lack of disclosure regarding risks associated with the use of AI chatbots.
- Ineffective chat filters, which expose users to harmful content, including:
- Sexually explicit conversations.
- Promotion of suicidal or self-harm ideations.
- Encouragement of drug, substance, and alcohol use.
The AG’s complaint primarily focuses on violations of Kentucky’s general consumer protection law, particularly the KCDPA. The AG alleges that the defendant failed to implement effective age-gating, parental consent, or identity-verification mechanisms to prevent children under 13 from accessing the platform.
Consumer Data Privacy Violations
According to the KCDPA, which took effect on January 1, sensitive data includes personal data collected from children under 13. The KCDPA mandates businesses to obtain verifiable parental consent prior to processing personal data of known children. The AG contends that the defendant did not provide adequate notice or collect parental consent as required.
Additionally, the complaint alleges violations of Kentucky’s statutory and constitutional privacy protections, as well as instances of unjust enrichment.
Relief Sought
The AG seeks injunctive relief rather than monetary compensation for its KCDPA claim. Before taking action for violations, the AG must provide a 30-day written notice to the business, allowing time to address the alleged violations. The complaint does not specifically mention this right-to-cure requirement.
In a statement, the AG emphasized, “The United States must be a leader in the development of AI, but it can’t come at the expense of our kids’ lives.” This lawsuit indicates a proactive approach by the AG to enforce the KCDPA and protect vulnerable populations.
