OpenAI just became the first AI company to face a formal state investigation. Florida Attorney General James Uthmeier announced Thursday his office is targeting the ChatGPT maker's data collection practices — subpoenas coming within three weeks.
Key Takeaways
- Florida becomes the first state to formally investigate OpenAI, targeting data practices and consumer protection violations
- Subpoenas expected within three weeks, focusing on data retention, disclosure practices, and Florida's consumer protection laws
- Sets precedent for state-level enforcement using existing consumer protection statutes rather than waiting for federal AI regulation
Why This Matters Now
The timing isn't coincidental. OpenAI is reportedly seeking funding at a $100+ billion valuation while federal regulators debate what AI oversight should look like. States aren't waiting for that conversation to end.
Uthmeier — DeSantis's former chief of staff turned AG in January 2024 — has made big tech his signature target. His office already pursued Meta over teen mental health and various platforms over alleged censorship. OpenAI represents the biggest prize yet: a company processing millions of daily interactions with minimal regulatory constraints.
The probe follows a established playbook. When federal action stalls, states move: 43 states sued Meta over Instagram's teen impact. Multiple states enacted privacy laws when Congress couldn't pass federal legislation. Now Florida is applying that same pressure to AI.
"Subpoenas are forthcoming, and we intend to get to the bottom of how these AI systems are being developed and deployed in ways that may harm Florida consumers." — James Uthmeier, Florida Attorney General
What most coverage misses is the enforcement mechanism here. Unlike federal agencies navigating complex jurisdictional questions, state AGs can act immediately using existing consumer protection statutes. That's exactly what's happening.
The Investigation's Scope
Three specific targets: data retention policies, user disclosure practices, and potential violations of Florida's Deceptive and Unfair Trade Practices Act. Sources familiar with the probe say Uthmeier's team has been building the case for months — user complaints, technical docs, the works.
OpenAI's current privacy policy allows conversation data for model training unless users opt out through account settings. Legal experts say that's insufficient under Florida's consumer protection requirements. The disclosure gap is real.
"This is exactly the kind of enforcement action we've been expecting as AI becomes more mainstream," said Ryan Calo, University of Washington Law professor. "State AGs have broad authority to investigate companies for potential consumer harm. That authority clearly extends to AI systems."
The investigation could force OpenAI to document everything: training data sources, content filtering systems, user privacy protections. Transparency that the company has largely avoided providing voluntarily.
The Bigger Strategic Picture
Here's what's actually happening: Florida is testing whether states can regulate AI companies the same way they regulate any other business operating within their borders. The answer will determine whether AI companies face a patchwork of 50 different state requirements or continue operating in the current regulatory vacuum.
Republican AGs in Texas, Missouri, and Tennessee are watching closely. If Florida's investigation succeeds — meaning it forces meaningful compliance changes or settlements — expect similar probes within months. The enforcement model scales quickly.
For OpenAI, the timing creates maximum pressure. State investigations generate compliance costs and regulatory uncertainty that investors notice. When you're seeking $100+ billion valuations, regulatory risk becomes a pricing factor.
The deeper issue is data handling requirements. OpenAI needs massive datasets to train models. State privacy laws could fragment that process into jurisdiction-specific compliance requirements. That's expensive and operationally complex — exactly what competitors like Anthropic and Google will also face if this model spreads.
What the Subpoenas Will Demand
First round of subpoenas within three weeks. Expected targets: internal communications about data collection, technical documentation of ChatGPT's architecture, financial records showing how user data generates revenue.
OpenAI gets 30 days to respond under Florida law. The company could challenge the investigation's scope or attempt to move proceedings to federal court. Legal experts expect initial cooperation followed by potential challenges if demands expand beyond data practices.
The precedent implications are significant. If Florida successfully forces compliance changes, other states inherit a tested enforcement framework. AI companies would face the same state-by-state regulatory complexity that financial services and healthcare companies already navigate.
The investigation establishes something new: states using existing consumer protection authority to regulate AI deployment before federal frameworks exist. Whether that's effective governance or regulatory chaos depends entirely on what Florida finds — and what other states do with those findings.
