FTC and State AGs Escalate AI Chatbot Crackdown

By Hector Herrera | June 8, 2026 | Legal | Government Policy

The Federal Trade Commission and a growing coalition of state attorneys general are moving aggressively to hold AI chatbot makers accountable under existing consumer protection law — and they do not need to wait for Congress to act. The enforcement playbook is already written; regulators are simply applying decades of deceptive-advertising and financial-services law to a new class of product.

This matters now because AI chatbots have moved from novelty to infrastructure. Hundreds of millions of consumers interact with them daily for advice on health, finances, legal questions, and purchases. When those systems produce false information, manipulate user behavior, or obscure that users are talking to a machine, the regulatory exposure is no longer theoretical — it is enforcement-ready.

How Consumer Protection Law Gets Stretched to Cover AI

The FTC's core authority under Section 5 of the FTC Act prohibits "unfair or deceptive acts or practices in or affecting commerce." That language was written in 1914. It has since been applied to false advertising, predatory lending, robocalls, and data brokers. AI chatbots are next.

The legal theory is straightforward: if a chatbot makes a false claim about a product — for instance, asserting that a supplement treats cancer, or that an investment carries no risk — that is a deceptive act, regardless of whether the speaker is human or machine. The FTC does not need a new statute to pursue that case. It already has one.

State attorneys general carry parallel authority under their own consumer protection statutes, which often mirror the FTC Act but with important distinctions: state AGs can move faster, can be more aggressive, and are not subject to the same internal deliberation requirements that slow federal agency action. A state AG can file a civil complaint in state court within weeks of identifying a violation. The FTC typically needs months of investigation, a commission vote, and often pursues voluntary settlement first.

That asymmetry matters enormously. Several state AGs — including those in New York, California, Illinois, and Texas — have publicly signaled that AI consumer harms are a priority. Expect the first major AI chatbot enforcement actions to come from state capitals, not Washington.

What Behaviors Are Being Targeted

Regulators are clustering their scrutiny around three categories of AI chatbot conduct:

1. Deceptive Claims

A chatbot that tells a user a drug is FDA-approved when it is not, or asserts that a financial product has government insurance when it does not, is making a deceptive claim. The same legal standard that applies to a human sales agent applies to the chatbot. This is not a novel interpretation — the FTC applied similar logic to automated telemarketing scripts years ago.

The complication with AI is that hallucinations — instances where a language model generates confident-sounding false information — can constitute deceptive claims even when the developer did not intend them. Courts and regulators are beginning to examine what "reasonable care" looks like for companies deploying systems known to produce false outputs.

2. Manipulative Design Patterns

Dark patterns — interface or conversational design choices that steer users toward decisions that benefit the company at the user's expense — are a second enforcement target. In the chatbot context, this includes:

• Systems designed to build emotional dependency that increases product engagement
• Chatbots that discourage users from canceling subscriptions or seeking human assistance
• Persona designs that obscure the AI nature of the interaction to reduce skepticism

The FTC's 2022 report on dark patterns established that manipulative design is actionable as an unfair practice under Section 5, regardless of medium. That framework applies directly to conversational AI.

3. Harmful Outputs

The third category is the most legally complex: chatbots that produce outputs causing direct harm — dangerous medical advice, instructions for self-harm, or facilitation of financial fraud. Several state legislatures are introducing statutes specifically targeting this category, creating liability standards that go beyond what federal law currently reaches.

New York has a pending bill that would impose strict liability on AI operators for certain categories of harmful output. California's legislature is examining whether existing product liability law can reach AI-generated harm. These are not fringe proposals — they are being taken seriously by chambers with strong technology industry lobbying, which signals how far the political environment has shifted.

Who Is Moving and How

The FTC under its current leadership has framed AI consumer protection as a top enforcement priority. The commission has issued guidance on AI and deception, opened investigations into AI companion apps, and sent warning letters to companies deploying chatbots in sensitive categories including health and finance.

Enforcement mechanisms available to federal and state regulators include:

• Civil penalties up to $51,744 per violation per day under FTC rules (state penalties vary)
• Consent decrees requiring operational changes, third-party auditing, and ongoing compliance reporting
• Injunctions that can halt specific product features or entire services pending compliance
• Restitution orders requiring companies to repay consumers harmed by deceptive practices

The FTC has also indicated interest in structural remedies — requirements that companies build compliance functions into product development cycles, not just bolt them on after complaints arise. This is a significant escalation. It means regulators want to be inside the product development process, not just reviewing outputs after the fact.

The Impact

For AI developers: Consumer protection compliance is now a product requirement, not a legal afterthought. This means evaluating chatbot outputs against deceptive-claim standards before deployment, auditing for dark patterns in conversation design, and maintaining documentation showing reasonable care was taken to prevent harmful outputs. Legal teams should be embedded in AI product reviews — not consulted only after launch.

For enterprises deploying third-party chatbots: The company deploying the chatbot bears enforcement risk alongside the AI vendor. A bank that uses a third-party AI system to answer customer questions about account terms is potentially liable for what that system says. Vendor contracts need to reflect this — including indemnification provisions and audit rights over AI outputs.

For consumers: Enforcement, if it succeeds, means better disclosure that an AI is conducting the conversation, more accurate information in sensitive contexts, and cleaner design that does not weaponize conversational rapport against user interests. The practical effect depends entirely on how aggressively regulators pursue cases and how courts interpret liability standards for AI-generated content.

What to Watch

Several markers will signal how quickly this enforcement environment matures:

• First state AG filing: When a major state AG files the first chatbot case, it will establish the legal theory and the damages claim that all subsequent enforcement actions will reference. Watch New York and California.
• FTC consent decree with an AI company: The first federal consent decree targeting chatbot conduct will set baseline compliance standards that the entire industry will adopt, because no company wants to face the next case without having met those standards.
• Companion legislation: Several state bills would create explicit statutory liability for AI harmful outputs, bypassing the need to stretch existing consumer protection law. If any of these pass and survive legal challenge, they change the enforcement calculus significantly.
• Industry self-regulatory moves: Some AI trade associations are developing voluntary compliance frameworks — partly to demonstrate good faith, partly to preempt stricter statutory requirements. Whether regulators accept these as meaningful will be a key test.

The trajectory is set. AI chatbot makers that treated consumer protection as an edge-case legal concern are discovering it is a core product design constraint. The regulators have the authority. They are beginning to use it.

Source: Kelley Drye — AI [Chatbots Face](/legal/ai-chatbot-legal-scrutiny-liability-2026) Rising Legal and Legislative Scrutiny