Kentucky Attorney General Russell Coleman filed suit on January 12, 2026 against Character Technologies, the maker of the companion chatbot app Character.AI, in what his office calls the first enforcement action brought under the state’s new data privacy statute against an artificial intelligence company. The timing is not an accident: the Kentucky Consumer Data Protection Act took effect January 1, 2026, and Coleman’s complaint leans on it to argue that Character.AI built its entire product around collecting sensitive data from minors without the consent the law now requires.
The lawsuit, filed in state court, alleges that Character.AI failed to obtain parental consent before collecting data from users under 13, misrepresented how it would use that data, and in fact used children’s conversations to train and refine its underlying AI models while also monetizing the resulting engagement. According to the complaint, the app’s age-verification system amounts to little more than a birthday field that any child can falsify, and once inside, users encounter a largely unfiltered chat experience with digital companions designed to maximize emotional attachment and time on app.
What the Complaint Says Children Encountered
Coleman’s filing singles out Character.AI’s ‘Stories’ feature, which the complaint says generated narratives depicting explicit sexual content and violence involving characters modeled on children’s media franchises, including figures resembling those from Sesame Street, Paw Patrol, and Bluey. The complaint argues this was not an isolated failure but evidence that the company’s content moderation was never built to withstand the volume of younger users the app was simultaneously courting. Coleman described the technology in blunt terms, saying the state is seeking to stop a company from deploying technology that, in his words, induces users into divulging their most private thoughts and emotions — language that frames the case as being as much about data extraction as about content harm.
A Law Built for This Moment
The Kentucky Consumer Data Protection Act gives the attorney general authority to pursue civil penalties and injunctive relief against companies that process residents’ personal data unlawfully, with heightened obligations around data belonging to minors. Coleman’s office is seeking exactly that: civil penalties and a court order barring Character.AI from continuing to operate the way it currently does in Kentucky until it installs effective age verification, content filtering, and parental controls. Legal analysts tracking the case have called it a potential blueprint for other states with similarly new consumer privacy statutes, since it shows how a privacy law originally drafted with data brokers and retailers in mind can be redirected at generative AI chatbots.
The Company’s Defense
Character.AI, in a statement responding to the suit, said its highest priority is the safety and well-being of its users, including younger audiences, and expressed disappointment that Kentucky chose litigation after what the company described as months of prior dialogue with the attorney general’s office. The company has previously rolled out a separate, more restricted experience for under-18 users and pointed to those changes as evidence of good-faith effort. Critics, including child-safety advocates who have pushed several states toward similar suits, counter that opt-in safety features rolled out after public pressure do not erase the data already collected from children before those changes existed, nor do they address the core complaint that engagement, not safety, remains the product’s design goal.
A Legitimate Counterargument on Liability
Not everyone agrees the data-privacy framing is the right legal tool. Some technology attorneys have noted that consumer privacy statutes like Kentucky’s were written primarily to regulate data brokers’ sale of information, not to police the editorial content of AI-generated chat, and that stretching the law to cover both risks creating murky precedent that could just as easily be turned against legitimate AI products that process any data from minors, including educational tools. That tension — between wanting strong enforcement now and wanting clean legal doctrine later — is likely to surface again as more states test similar legal theories against AI companies.
What Happens Next
The case is still in its early stages, and Character.AI has not yet filed a formal response to the complaint. If Kentucky prevails, the precedent could embolden other states with recently enacted comprehensive privacy laws, several of which took effect in 2026, to bring parallel actions rather than waiting for federal legislation that has repeatedly stalled in Congress. For now, the Kentucky case stands as a test of whether state consumer-protection law, originally built for a world of data brokers and targeted advertising, can be retrofitted to govern a generation of AI companion apps built to extract exactly the kind of intimate personal disclosure that privacy law was designed to limit.
Photo: cottonbro studio / PEXELS via Pexels
