42 state attorneys general just subpoenaed OpenAI. The questions they’re asking are the exact questions we raised four months ago.
The bottom line, before you read another word: On June 12, 2026, a coalition of 42 state attorneys general led by New York AG Letitia James served OpenAI with the broadest coordinated state-level subpoena ever issued to an AI company. It covers advertising, user engagement, consumer and health data, treatment of minors and seniors, internal policies, and the way ChatGPT itself is designed. It landed four days after OpenAI quietly filed for a trillion-dollar IPO.
This Isn’t One Lawsuit. It’s the Floodgates.
For most of the past year, OpenAI has handled legal pressure the way a heavyweight handles a jab. One state. One grieving family. A Florida AG who said enough on June 1.
Each one was containable. A trillion-dollar company can absorb 18 consolidated wrongful-death suits and promise to “engage constructively.”
What it cannot easily absorb is 42 state attorneys general acting together, at the same moment, under the same consumer protection statutes.
That happened on June 12.
From the subpoena, as reviewed by The Wall Street Journal:
The document demand covers “advertising, user engagement and retention, handling of consumer and health data, activities involving minors and elderly individuals, deep learning algorithms, model bias, and company policies.”
That isn’t a list. That’s the entire surface area of the business.
Why a 42-State Coalition Is Structurally Different
Most regulatory action against tech starts with a single regulator or a single state. Both are survivable. A 42-state coalition is not, for four reasons every business owner should understand.
1. State AGs have teeth federal regulators often don’t. Under each state’s Unfair and Deceptive Acts and Practices statute, attorneys general can investigate, subpoena, fine, and seek injunctive relief without waiting for anyone in Washington.
2. The subpoena reaches inside the model itself. Tucked into the document list is a demand for records on model sycophancy — the industry term for chatbots that tell users what they want to hear instead of what’s true. Six months ago, “is your AI’s flattery a consumer protection violation?” was a thought experiment. Today it’s a subpoena.
3. The timing was deliberate. OpenAI filed its confidential S-1 with the SEC on June 8, targeting a valuation of up to $1 trillion. The subpoena arrived four days later. Securities law requires disclosure of material legal risk, which means OpenAI’s IPO prospectus now has to lead with the sentence, “By the way, 42 states are investigating us.”
4. The legal playbook is well-worn. The same UDAP framework states used to investigate Meta and TikTok over addictive design is now pointed at AI. The lawyers running it are experienced. The historical outcome is settlements measured in billions.
The Subpoena, in Plain English
| What They’re Asking For | What That Actually Investigates |
|---|---|
| Advertising practices | Whether OpenAI’s marketing matched the product’s real behavior. False advertising at scale. |
| User engagement and retention | “Addiction-by-design” — did OpenAI deliberately build ChatGPT to be habit-forming for vulnerable users? |
| Consumer and health data | What happens to the private conversations users pour into the system. Sound familiar? |
| Minors and seniors | The two demographics consumer advocates flag as most vulnerable to AI persuasion. |
| Internal company policies | Governance documents, safety testing, pre-launch review. What did they know, and when? |
| Deep learning models and sycophancy | Whether the way the model was designed to please users is itself a deceptive practice. |
A Reminder of What We Said in February
In our February 10 article, we walked through what happened the day OpenAI flipped on advertising inside ChatGPT.
The short version: every conversation users had ever had — health questions, business strategy, legal worries, personal confessions — was already being used to power ad targeting. Opting out only stopped future data. The data already processed was already in the system, already shared with advertising partners.
In February, that was an editorial position. Today, 42 state attorneys general are demanding documents on those exact issues: handling of consumer data, health information, advertising practices, user engagement.
Same questions. Now with subpoenas attached.
Why a Trillion-Dollar IPO Makes This Worse
OpenAI’s public response was that it intends to “engage constructively.” That phrasing is the language of a company trying very hard not to spook IPO investors. The problem is the math doesn’t work.
- Securities law forces disclosure. A 42-state coalition is material risk by any honest reading. Every analyst on the road show will see it. Every journalist will write about it. The investigation becomes the headline, not the footnote.
- State AG investigations don’t move fast. They typically take 18 to 36 months. The legal cloud will hang over the company through exactly the post-IPO period when public companies need clean stories to grow into their valuations.
- Settlement math is brutal. The 2022 Google location-tracking multi-state settlement was $391 million. Meta’s multi-state settlements have collectively cleared $1 billion. OpenAI is staring at the same machinery, at a much larger scale.
The trillion-dollar valuation doesn’t insulate OpenAI from the subpoena. It amplifies the consequences.
What This Means for Your Business
If you took our February advice and locked things down, this changes very little for you. You already moved.
If your team has continued to pour client data, financials, HR matters, and strategic conversations into ChatGPT, the calculus has shifted in three concrete ways:
1. Discovery is a one-way valve. When state AGs subpoena a company, the documents they receive don’t disappear. They become evidence in private class actions and derivative shareholder suits. Conversations your team had with ChatGPT in 2025 and 2026 — even ones since “deleted” — may surface in legal proceedings you have no part in but can’t insulate yourself from.
2. The “everyone uses it” defense just got weaker. Until June 12, an executive could plausibly argue, “We used ChatGPT because it’s the industry standard.” After June 12, the industry standard is under coordinated state investigation.
3. If you’re in a regulated industry, urgency just went up. State AGs investigating the handling of consumer health data through a general-consumer AI product is exactly the foundation regulators in healthcare, finance, and legal services use to launch industry-specific follow-up.
What to Do This Week
1. Audit what your team has shared with ChatGPT. If anyone has used it for client work, financials, HR, legal strategy, or competitive intelligence in the last 18 months, that data may sit inside the systems regulators are now subpoenaing.
2. Lock down ChatGPT settings if you’re still using it. Settings > Ad Controls. Disable “Personalize ads” and “Past chats and memory.” Tap “Delete ads data.” This is forward-looking only and full removal still takes up to 30 days.
3. Put an AI usage policy in writing. Define what categories of information can and cannot be entered into AI tools. Distribute it. Train your team. Document the date. If discovery ever reaches your business, the existence of a dated policy matters.
4. Move sensitive work to AI tools that don’t monetize your conversations. Claude and Lumo are still the right answer. Both leaned deeper into privacy while OpenAI built the ad infrastructure that is now under subpoena.
Side-by-Side, Updated for June 2026
| Feature | ChatGPT | Claude | Lumo |
|---|---|---|---|
| Ads in product | Yes (expanding to UK) | No | No |
| Uses chats for ad targeting | Yes (default-on) | No | No |
| Zero-knowledge encryption | No | No | Yes |
| Data used for training | Default: Yes | Opt-in choice | Never |
| Subject to 42-state AG investigation | Yes (as of June 12, 2026) | No | No |
| Jurisdiction | USA | USA | Switzerland/EU |
| Ad-free guarantee | Paid plans only | All plans | All plans |
The new row is the one that matters. Until last week, every comparison like this evaluated AI tools on features, privacy, and price. Now there’s a column for legal risk to the business choosing the tool.
Where This Goes From Here
The subpoena was served on a Friday. OpenAI has weeks to respond, document production takes longer, and the first formal findings or settlements are likely 12 to 24 months out. But the second-order effects start immediately:
- Other states will join. Eight haven’t signed on yet. Several will once the political optics clarify.
- Federal regulators will follow. The FTC has been circling AI for two years. A 42-state coalition gives them political cover.
- Class action lawyers are reading the same subpoena. Every theory the AGs are advancing is a template for private litigation.
- Insurance markets will reprice. Cyber and E&O insurers are already adjusting premiums for businesses using generative AI on client data.
The story we covered in February was about what OpenAI had quietly built. The story now is about whether what they built is, in the legal opinion of 42 state attorneys general, lawful.
Ready to Get Your Business Off the Risk Map?
Caboodle Media helps businesses migrate from data-as-the-product AI tools to private, secure alternatives that don’t compromise speed or capability. As an authorized Lumo by Proton reseller and an experienced technology consultant, we can help you evaluate the right AI stack, write an AI usage policy you can defend, and move your existing workflows.
The companies that acted in February have nothing to disclose, nothing to discover, and nothing to explain. That position is still available. It will not be for long.
Sources: Wall Street Journal, The New York Times, Washington Post, TechCrunch, Tech Times, Business Insider, Euronews.
