Deepfake Laws by State: 8 States Sue Over ChatGPT ID Checks

Picture this. You open a chatbot to ask how long to roast a chicken, and a box pops up: "Please verify your age. Upload a photo ID or take a selfie." If you have been reading about deepfake laws by state, you already know the rules for AI change depending on where you live. This story is a different kind of state action, and it could land on regular adults first.

Deepfake Laws by State vs. Lawsuits: Why This Story Is Not What You Searched For

Let's be straight with you. Maybe you landed here searching for deepfake laws by state, hoping for a map of who is protected from deepfakes, whether election fakes or cloned voices. This article is not that map. The source reporting here does not cover deepfake statutes, and I won't pretend it does.

What it does cover is related, and arguably closer to home. According to Reclaim The Net, eight states filed lawsuits against OpenAI on October 14. They want ChatGPT to check the age of everyone who uses it. It is the first time several state attorneys general (the top lawyers for state governments) have teamed up like this against an AI company.

Same instinct as the deepfake laws by state you may have been reading about: states are not waiting for Washington. They are acting now, with the tools they already have.

State-by-state action on AI: what these lawsuits actually claim

The lawsuits lean on consumer protection law, the same kind of rules that go after misleading ads. The core complaint is that ChatGPT can serve content that is not right for kids, while the company has not checked who is on the other end. One line from the complaints, as reported, says it plainly:

"No age verification is required to access the ChatGPT website." For a comprehensive overview, explore our comprehensive face shape detector resource.

State complaint against OpenAI, as quoted by Reclaim The Net

Nebraska's attorney general goes further. The state alleges OpenAI misled families about how safe ChatGPT is, and failed to protect children from harmful content and emotional dependence (kids leaning on a chatbot the way they would on a friend). A summary from Yahoo News says the states also want data deletion and limits on testing advanced AI.

Child safety is a real problem. Nobody serious argues otherwise. But here is the catch the lawsuits skip.

ChatGPT Age Verification: Who Actually Gets Checked?

You cannot tell a 15-year-old from a 35-year-old by asking nicely. A checkbox that says "I'm over 18" does nothing. So real age checks usually mean one of three things: uploading a photo ID, taking a selfie so software can guess your age from your face, or linking some other proof. And here is the part that matters. If the rule covers every user, it covers you.

Will ChatGPT age verification apply to adults too?

If the states win what they are asking for, yes. The goal is checks for all users, because a system cannot know who is a child without checking everyone. Adults would be asked to prove they are adults. How, exactly, is not spelled out in the lawsuits, as far as the reporting shows.

That number is the part that should make you pause. A chat app collected ID images, handed the job to an outside service, and that service got hacked. The people exposed had done exactly what they were told.

What happens to an ID after an age check?

Nobody can answer that in general. It depends on the company and its vendor. Some delete right away. Others keep records. A 2026 study, covered by Futurity, found that one of the world's leading age verification providers collects and shares very sensitive personal data, including facial photos and device fingerprints (small technical clues that can pick out your phone or laptop), with third parties.

Are Deepfake Laws by State the Same Thing as Age Check Rules?

No. Deepfake laws by state are about fake images, video, and audio, and which uses of deepfakes, such as fakes aimed at an election, are allowed or punished. Age check rules are about who gets to use a service. A deepfake rule targets the content, while an age check targets the user. What they share is the patchwork feeling. One state moves, another waits, and the rest of us read the fine print.

And the patchwork is the real worry here. If a handful of states win, a company will likely build one system for everybody rather than fifty versions. The research memo behind this piece puts it sharply: a ruling favoring even a few states could set a national floor for AI child-safety standards, with or without Congress. That is my read too, and it is why deepfake laws by state and these lawsuits belong in the same conversation about who sets the rules for your screen.

What privacy experts say about collecting faces and IDs

Privacy and security scientists signed a 2026 joint statement saying age-assurance systems (the tools that estimate or confirm age) are hard to deploy safely at scale. Their list of risks: people getting around the checks, loss of privacy, people being shut out, and function creep (data collected for one reason slowly getting used for others). They also warn that age checks can tie your "most sensitive and immutable data," meaning names, faces, birthdays, and home addresses, to what you do online. A Marketplace report covers the same worry about government ID and face data.

The Fair Counterpoint, and the One Thing to Do

The other side deserves its hearing. Kids are using these tools, some families say they were misled, and "identity checks are imperfect" is not a reason to do nothing. Fair. The real question is whether companies build checks with data minimization (collect as little as possible), short retention (how long they keep it), and safeguards for any outside vendor. The Center for Democracy and Technology has laid out guardrails along those lines. The lawsuits, as reported, are silent on that part.

Now the one useful thing. Before you upload anything, find the sentence that says when it gets deleted. If you can't find one, treat that as your answer. And if you've ever wondered whether a photo or profile is really who it claims to be, that is the exact question face-comparison technology exists to answer. It is also why this stuff should be handled carefully: a face is not a password you can change.

Here is what bugs me. Whole legislatures can argue for months about deepfake laws by state, while one pop-up asks a tired adult for a face scan in ten seconds. If a chatbot asked for your ID tomorrow, would you know where it went the day after?

Deepfake Laws by State: Frequently Asked Questions