Florida’s attorney general has sued OpenAI, alleging its ChatGPT chatbot helped a mass shooter plan an attack, while California’s attorney general has launched separate legal action against the successor to genetics firm 23andMe over a 2023 data breach.
In a lawsuit filed in Florida, Attorney General James Uthmeier accused OpenAI and its chief executive Sam Altman of building a “web of deceit” by knowingly allowing the company’s AI chatbot to “aid and abet” a mass shooter. The case centres on claims that ChatGPT provided guidance to an individual who carried out a shooting, though the details of the attack were not specified in the filing. Uthmeier said the company had prioritised profit over public safety, alleging that OpenAI’s technology “enabled and facilitated” violence.
“Florida sues OpenAI over allegation ChatGPT assisted a mass shooter; California sues 23andMe successor over data breach cover-up. Both cases have UK implications for AI regulation and genetic data protection.”
OpenAI has not yet responded to the allegations. The lawsuit is the latest in a series of legal challenges facing the company over the potential misuse of its generative AI tools, which can produce human-like text in response to user prompts. Critics have long warned that such systems could be exploited to spread disinformation or assist in harmful activities.
Separately, California Attorney General Rob Bonta announced a lawsuit against the successor firm to 23andMe, the DNA testing company that suffered a major data breach in 2023. Bonta alleged the company lied about the severity of the breach, which exposed the genetic and personal data of millions of users. The breach, which came to light in October 2023, affected roughly 6.9 million customers – around half of the company’s user base at the time. Hackers accessed details including names, birth years, and genetic ancestry information.
Bonta said the company failed to take adequate security measures and then misled consumers about the scale and impact of the incident. The lawsuit targets 23andMe’s corporate successor, which took over after the breach became public. The company has not commented on the specific allegations but has previously stated it took steps to enhance security.
Regional dimension While both lawsuits originate in the United States, they have direct implications for the United Kingdom. The UK’s Information Commissioner’s Office (ICO) has already expressed concerns over the security of genetic data held by companies like 23andMe, and has the power to fine firms that breach UK data protection laws. The ICO previously opened an investigation into 23andMe’s data handling after the 2023 breach, warning that DNA information is “particularly sensitive” and requires robust protections.
On AI safety, the UK government has been positioning itself as a global leader in regulation. In November 2023, Prime Minister Rishi Sunak hosted the first global AI Safety Summit at Bletchley Park, which led to the Bletchley Declaration, signed by 28 countries including the US and China. The UK is also developing its own AI Safety Institute to test emerging models for risks. The Florida lawsuit could add pressure on London to ensure that AI tools like ChatGPT are not used to facilitate violent acts, and may influence the ongoing debate over whether to introduce statutory liability for AI developers.
Expert and institutional voices The lawsuits rely on statements from the attorneys general themselves. Florida AG James Uthmeier accused OpenAI of engaging in “deceptive, unfair, and unconscionable” practices by allowing its AI to assist in real-world harm. California AG Rob Bonta said the 23andMe successor “lied to consumers about the seriousness of a data breach that exposed their most intimate genetic information.” Neither attorney general cited external studies or expert testimony in their filings, but both emphasised the need for accountability in the tech sector.
What happens next OpenAI and the 23andMe successor are expected to file responses in the coming weeks. The Florida case may proceed to pre-trial discovery, which could require OpenAI to hand over internal documents about how ChatGPT’s safety guardrails were designed and whether the company anticipated its use for harmful purposes. The California action against 23andMe’s successor will likely involve court scrutiny of the company’s security practices and its public statements after the breach. Both cases could take months or years to resolve, but they may set legal precedents for liability in AI and data protection.
What This Means For You - Homeowners and renters: While the lawsuits are US-based, they highlight concerns about the security of personal data. If you have used a genetic testing service like 23andMe, your data may be at risk. UK companies that hold such data are regulated by the ICO, but you should check privacy settings and consider deleting your account if worried. - Workers: AI tools like ChatGPT are increasingly used in workplaces. The Florida case raises questions about employer liability if staff use AI to produce harmful content. UK employers should review their AI use policies and ensure training on safe usage. - Pensioners and families: Genetic data could affect family members or insurance applications. The breach exposed not just your own data but also that of relatives who share DNA. If you have relatives who took a 23andMe test, their information may also be compromised. - Students: Those using ChatGPT for study or research should be aware that the tool’s safety measures remain under scrutiny. Never rely on AI for advice on harmful activities, and report any concerning responses to the relevant platform. - General public: Both cases underscore the need for strong data protection and AI regulation. The UK is moving towards its own AI legislation, expected in the next year, which could introduce stricter rules for companies like OpenAI. Stay informed about your digital rights and consider using tools that encrypt your data.