State AGs Target AI Firms Using Old Consumer Laws

State attorneys general are relying on long-standing consumer protection, licensing, privacy and advertising laws – not new artificial intelligence-specific statutes – to police AI products marketed as substitutes for traditionally regulated professions.

Regulators are applying existing unfair and deceptive acts and practices (UDAP) laws and other established legal authorities to AI business practices, particularly where companies overstate their products' capabilities or expose consumers to harm, according to a Monday analysis by Troutman Pepper Locke.

The trend has implications for AI developers, especially those marketing products as alternatives to licensed professionals or deploying consumer-facing AI systems in healthcare, financial advice and mental health, the analysis said.

One of the clearest enforcement priorities is AI products that present themselves as substitutes for professionals who require state licenses. Regulators generally do not object to licensed professionals using AI as an assistive tool. But they are scrutinizing products marketed as capable of replacing lawyers, physicians, financial advisers or other credentialed experts.

Pennsylvania's enforcement action against Character.AI is a landmark example, per the analysis. The state's Department of State alleged that chatbot personas represented themselves as licensed psychiatrists, claimed to hold Pennsylvania medical licenses and provided assessments and treatment recommendations without appropriate licensure or oversight. Rather than relying on an AI-specific statute, Pennsylvania grounded its case in traditional professional licensing authority – an enforcement model regulators across the country could readily replicate.

Children's safety is also a growing area of multistate cooperation, the analysis said. A bipartisan coalition of more than 40 attorneys general urged AI companies to strengthen safeguards around therapy and companion chatbots, particularly those used by minors. Recommendations included age-tailored conversations, referrals to mental health professionals or law enforcement when discussions involve self-harm or violence, and measures to reduce chatbot responses that reinforce users' delusions rather than providing accurate information.

Beyond chatbot safety, state attorneys general are focused on AI-enabled deception in online advertising. Generative AI has lowered the cost of producing convincing advertisements, making it easier for fraudsters to create investment scams, cryptocurrency promotions and misleading health-related marketing. State regulators have responded by pressing social media platforms to strengthen oversight of high-risk advertisements and improve transparency surrounding AI-generated content.

Coordinated action by 35 attorneys general demanded stronger safeguards from xAI after its Grok chatbot allegedly generated nonconsensual intimate images and child sexual abuse material, the analysis said. The coalition argued that existing protections were inadequate and warned that some outputs could violate existing civil and criminal laws.

Privacy and pricing practices represent another emerging enforcement frontier. California is investigating businesses that use consumer data to support individualized pricing. New York's Algorithmic Pricing Disclosure Act requires companies to notify consumers when prices are determined by algorithms using personal data. Together, the initiatives suggest state regulators are combining traditional privacy enforcement with new transparency requirements for AI-driven commercial practices.

For companies deploying AI, the analysis recommended focusing less on whether a specific AI law applies and more on whether existing consumer protection standards are being met. Companies should substantiate claims about AI accuracy and performance before making marketing representations, avoid suggesting AI can perform services requiring professional licensure, and clearly disclose how personal data is used. Businesses should also implement documented governance processes, testing and oversight, while building safeguards to address foreseeable misuse, particularly involving children, vulnerable individuals or applications that could affect health, finances or other regulated activities.

The compliance practices will help organizations satisfy existing state consumer protection laws while positioning them for an expanding wave of state AI-specific regulation, the analysis said. As attorneys general continue to demonstrate their willingness to use traditional legal frameworks to police emerging technologies, companies face pressure to treat AI governance as a core compliance function rather than a future regulatory concern.