Six litigation signals from October 13–19: eight states sue OpenAI, a video-privacy statute reaches the Supreme Court, and CVS pays $315 million (2026)

The week of October 13–19, 2026 brought eight separate state lawsuits against OpenAI, a Supreme Court argument over whether a 1988 video-privacy statute reaches a tracking pixel, and a $315 million pharmacy settlement. 1 2 3

Four of the six cases below test how far older statutes reach: consumer-protection acts applied to a chatbot, a 1988 video-rental privacy law applied to a website pixel, and antitrust and false-claims law applied to drug pricing and pharmacy dispensing. Two of them put individuals in the defendant's chair.

Docket at a glance

Sector	Parties	Docket	Current stage	Recent development	Next milestone
AI consumer protection	Attorneys general of Arizona, Arkansas, Idaho, Iowa, Kansas, Montana, Nebraska and West Virginia v. OpenAI	Eight separate state actions; Nebraska's is `D09CI260000488` (District Court of Buffalo County)	Filed October 14, 2026	The states allege OpenAI marketed ChatGPT as safe for minors while its design invited harmful use; Nebraska seeks civil penalties and an injunction. 4	OpenAI's responses; dates not public
AI data	Jane Doe, on behalf of two minor children, v. OpenAI Foundation, OpenAI OpCo, OpenAI Holdings and OpenAI Group PBC	`3:26-cv-11781` (N.D. Cal.)	Filed October 13, 2026	A putative nationwide class says children's conversations trained OpenAI's models without valid parental consent and asks for company equity or its cash value. 5	OpenAI's response, including any motion to compel arbitration; dates not public
Tech privacy	Michael Salazar v. Paramount Global, d/b/a 247Sports	`25-459` (U.S. Supreme Court)	Argued October 14, 2026	The justices appeared likely to read "consumer" in the Video Privacy Protection Act to cover a subscriber of any Paramount product who watched videos on the site. 2	Decision expected in 2027; date not set
Tech consumer protection	United States of America v. REPS & Company, Inc., Ryan Pancheri, Brian Archibald and Nicholas Totagrande	`3:26-cv-05895-CAB-BJW` (S.D. Cal.)	Filed October 15, 2026	The Justice Department and FTC allege the broker used thousands of accounts and masked IP addresses to buy 18.5 million tickets beyond published limits. 6	Defendants' response; date not public
Pharma antitrust	Federal Trade Commission and seven states v. Martin Shkreli	`1:20-cv-00706` (S.D.N.Y.)	Contempt motion filed October 13, 2026	The FTC and the states say Shkreli kept trading drug stocks and commenting on companies in violation of a lifetime industry ban. 7	Ruling on the order to show cause; date not public
Pharma regulatory	United States ex rel. Hillary Estright v. CVS Health Corporation et al.	`22-cv-00222` (D.R.I.)	Settled October 13, 2026	CVS will pay $315 million over controlled-substance dispensing from 2013 to 2025 and accept a DEA monitoring agreement. 3	Court approval and the relator's share; dates not public

AI

Eight states v. OpenAI: consumer-protection law becomes the AI regulator

Parties: The attorneys general of Arizona, Arkansas, Idaho, Iowa, Kansas, Montana, Nebraska and West Virginia, each suing in that state's own courts, against eight OpenAI entities. 1 4

Docket number: Eight separate actions rather than one consolidated case. Nebraska filed in the District Court of Buffalo County as No. D09CI260000488 on October 14, 2026. 8 Docket numbers for the other seven states are not public.

Claims: Each state pleads its own consumer-protection statute. Nebraska sues under the Nebraska Consumer Protection Act, the Uniform Deceptive Trade Practices Act and the Age-Appropriate Online Design Code Act; Iowa sues under its Consumer Fraud Act. 4 9 The complaints allege OpenAI marketed ChatGPT as safe for teenagers while designing an agreeable chatbot that coached users to self-harm, gave dangerous medical advice and failed to control its own agents. 10

Current stage: The complaints were filed on October 14, 2026. No responsive pleading from OpenAI appears on any of the eight dockets.

Recent developments: Nebraska asks for an injunction, disgorgement and restitution, civil penalties of $2,000 per violation under its consumer-protection and deceptive-trade statutes, and $50,000 per violation under its age-appropriate design code. 8 OpenAI spokesperson Drew Pusateri said the company had built age-specific protections "that many other AI products lack" and would keep working with states on industry-wide policy. 1

Business impact: Per-violation penalties tied to each affected consumer can scale with user counts. The eight filings also sit alongside Florida's June suit against OpenAI and Sam Altman, so the company faces state enforcement in at least nine jurisdictions. 10

Precedent value: Kansas Attorney General Kris Kobach compared the coordination to the opioid and tobacco cases, where states used separate suits to set national terms. 1 A ruling in any one state on whether consumer-protection law reaches model behavior would give the others a template. Nebraska's age-appropriate design claim also tests a newer statute aimed at platform design.

Next milestone: OpenAI's responses and any motions to dismiss or transfer, in eight courts; no dates are public.

Doe v. OpenAI Foundation: a demand for equity in place of damages

Parties: Jane Doe, on behalf of her 12-year-old daughter and 16-year-old son and a putative nationwide class of minors who used ChatGPT, against OpenAI Foundation, OpenAI OpCo, OpenAI Holdings and OpenAI Group PBC. 5

Docket number: 3:26-cv-11781, U.S. District Court for the Northern District of California, filed October 13, 2026. 11

Claims: Unjust enrichment and declaratory relief. 12 The complaint says OpenAI's sign-up flow lets a child confirm she is at least 13 and proceed, and that a checkbox cannot supply the parental consent the company's terms require. 5 It cites California Civil Code Section 1568.5 and Family Code Section 6701 on minors' contracts, and challenges the arbitration provisions in OpenAI's terms.

Current stage: Complaint filed October 13, 2026; no class has been certified and no response from OpenAI is on the record.

Recent developments: The 81-page complaint describes ChatGPT mirroring a child's slang and emojis, then following up on disclosures about body image and family relationships. 12 Its prayer for relief asks for "an equity stake in OpenAI, or the cash value thereof, attributable to data that OpenAI wrongfully took," plus restitution, disgorgement and punitive damages. 5

Business impact: An equity demand converts a data-privacy claim into a claim on enterprise value, at a company reported to be seeking new funding at a valuation of about $1.4 trillion. 5 OpenAI's parental controls let an adult stop future teen conversations from training models, but the training option is on by default. 5

Precedent value: The case asks two questions with reach beyond OpenAI: whether a child can validly accept an AI provider's terms at all, and whether unjust enrichment or the California doctrine of accession can reach data once it is folded into a model. 5 A ruling on the arbitration clause would affect how every consumer AI claim proceeds.

Next milestone: OpenAI's response, which may include a motion to dismiss or to compel arbitration; no date is public.

Tech

Salazar v. Paramount Global: the justices take up who counts as a video consumer

Parties: Michael Salazar, a Tennessee subscriber to a Paramount-owned college sports newsletter, against Paramount Global, which operates 247Sports.com. 2

Docket number: No. 25-459, Supreme Court of the United States, on review of the Sixth Circuit's decision in No. 23-5748; the district court was the Middle District of Tennessee. 13

Claims: Violation of the Video Privacy Protection Act, which bars a "video tape service provider" from knowingly disclosing personally identifiable information about a consumer. 2 Salazar says Paramount used a Meta Pixel to send Facebook his video-viewing history without consent and seeks $2,500 in statutory damages for himself and the class.

Current stage: Argued October 14, 2026. 14 A decision is expected in 2027.

Recent developments: The justices appeared likely to agree that "consumer" covers anyone who consumes the products of a company that provides videos, which is Salazar's reading. 2 Justices Thomas, Alito and Barrett doubted that a sports-recruiting site is a "video tape service provider" at all, a question the Court did not take up. Kavanaugh and Kagan suggested that companies can avoid the statute by obtaining consent.

Business impact: A broad reading exposes any website that embeds video and runs advertising pixels to class actions carrying statutory damages per viewer. 2 Consent screens and pixel audits become the practical controls.

Precedent value: The Sixth Circuit held that a "consumer" must subscribe to goods or services in the nature of audio-visual content, so a newsletter subscriber did not qualify. A reversal would settle the definition nationwide and revive a wave of pixel suits. 2 Two questions the Court left open — who is a video tape service provider, and what counts as personally identifiable information — would then decide how far the statute reaches.

Next milestone: A merits decision in 2027; the Court has not scheduled a date.

United States v. REPS & Company: the BOTS Act meets the account farm

Parties: The United States, acting on an FTC referral, against REPS & Company, Inc. and three executives: chief executive Ryan Pancheri, president and former chief operating officer Brian Archibald, and Nicholas Totagrande. 6

Docket number: 3:26-cv-05895-CAB-BJW, U.S. District Court for the Southern District of California, filed October 15, 2026. 15

Claims: Violations of Section 5(a) of the FTC Act and the Better Online Ticket Sales Act, which bars circumvention of the measures ticket sellers use to keep access equitable. 15 The government seeks a permanent injunction, monetary relief and civil penalties.

Current stage: Complaint filed October 15, 2026; no response from the defendants is on the record.

Recent developments: Since 2022, the complaint alleges, REPS opened thousands of Ticketmaster, AXS and other issuer accounts using other people's names, addresses and phone numbers, along with thousands of virtual credit-card numbers. It routed purchases through proxy IP addresses and multi-session browsers. 15

The defendants spent more than $1.3 billion on over 18.5 million tickets and made at least $120.8 million in profit, according to the filing. At an Arrowhead Stadium event on October 1, 2023, the government says, they used at least 1,300 accounts. 6

Business impact: The case targets the mechanics of professional resale: identity verification, purchase limits and the infrastructure that defeats them. Naming the chief executive, president and another executive puts personal liability on the table for a compliance failure the companies' own controls were meant to prevent. 15

Precedent value: The BOTS Act is usually discussed as a ban on software that defeats queue systems. This complaint applies it to account proliferation, synthetic identities and IP masking, which widens the conduct the statute covers. 15 Civil penalties under the FTC Act give the government a remedy that individual ticket buyers lack.

Next milestone: The defendants' response; no date is public.

Pharma

FTC v. Shkreli: testing the reach of a lifetime industry ban

Parties: The Federal Trade Commission, New York, California, Illinois, North Carolina, Ohio, Pennsylvania and Virginia against Martin Shkreli. 7

Docket number: 1:20-cv-00706, U.S. District Court for the Southern District of New York, the case that produced the February 4, 2022 injunction. 16

Claims: Civil contempt of the 2022 order, which banned Shkreli for life from participating in the pharmaceutical industry and from making public statements to influence a pharmaceutical company's business. 7 The underlying case found that he and Vyera Pharmaceuticals suppressed generic competition to Daraprim and raised its price from $17.50 to $750 a tablet.

Current stage: The FTC and the states filed a motion for an order to show cause on October 13, 2026. 7 No hearing date is public.

Recent developments: The motion traces four phases of trading after Shkreli left prison in May 2022. 16 It cites a 2024 short in Cassava Sciences that turned a $138,200 brokerage balance into $841,000, a 2025 loss on Capricor, and a new account opened in June 2026 with a $10 million balance.

The states want an auditor paid by Shkreli and an order to sell his pharmaceutical holdings. They also seek disgorgement of trading profits since February 4, 2022 with no offset for losses, plus further fines or incarceration if he does not comply. 7

Business impact: The motion defines an industry ban to cover personal securities trading and public commentary, alongside employment and ownership. For anyone subject to a conduct decree, the compliance perimeter now includes a brokerage account and a livestream. 7

Precedent value: Courts rarely litigate what "participating in the pharmaceutical industry" means. A contempt finding would give the phrase an operational test — trading plus market-moving commentary — in a sector where executives move between companies and personal accounts. 16

Next milestone: A ruling on the order to show cause and any evidentiary hearing; no date is public.

United States ex rel. Estright v. CVS: a $315 million price for pharmacy dispensing

Parties: The United States, intervening in a whistleblower suit brought by former CVS employee Hillary Estright, against CVS Health Corporation and related entities. 3

Docket number: 22-cv-00222, U.S. District Court for the District of Rhode Island. 3

Claims: Violations of the Controlled Substances Act and the False Claims Act from October 17, 2013 through December 2, 2025. 3 The government alleged CVS filled prescriptions without a legitimate medical purpose, including early fills, excessive quantities, "trinity" combinations of an opioid, a benzodiazepine and a muscle relaxant, and prescriptions from pill-mill prescribers, then billed Medicare and other federal programs.

Current stage: Settled October 13, 2026, for $315 million. 3

Recent developments: The complaint traced the violations to corporate performance metrics, incentive compensation and staffing policies that, in the government's account, prioritized profit over patient safety. 3 CVS also signed a memorandum of agreement with the DEA requiring a reporting hotline, proactive monitoring of dispensing patterns and a process for evaluating suspicious prescribers. CVS admitted no wrongdoing and said it disagrees with the claims. 17

Business impact: The settlement turns pharmacy staffing, dispensing quotas and prescriber oversight into compliance evidence. The DEA agreement imposes monitoring obligations that outlast the payment and can be enforced separately. 3

Precedent value: The government's theory links corporate incentive structures to the knowledge element of a False Claims Act case, which is the same argument it has used against manufacturers over sales practices. 3 For pharmacy chains, it sets a price for dispensing controls that other chains can expect to face.

Next milestone: Court approval of the settlement and a determination of the relator's share; neither date is public.

Cases to watch

Apple v. OpenAI: At an October 14 hearing in San Jose, Judge Edward Davila said he was "highly likely" to grant Apple's preliminary injunction, and OpenAI agreed not to use the trade secrets Apple claims were stolen and to collect forensic images from 14 employees' devices. 18 The formal order, and a ruling on OpenAI's motion to dismiss in No. 5:26-cv-07078 (N.D. Cal.), remain pending. 19
Ambriz v. Google: Judge Rita Lin heard Google's motion to dismiss California Invasion of Privacy Act claims over its Cloud Contact Center AI on October 13 and did not say when she would rule. 20 A ruling either way would set the disclosure standard for AI agents that sit on customer service lines.
PhRMA v. Kennedy: Briefing continues in the challenge to the GLOBE Medicare pricing model, which takes effect November 30, 2026, and PhRMA has asked for a temporary restraining order. 21 22 A decision on preliminary relief is the next public event, with no date set.
Liquidia and United Therapeutics: Liquidia agreed to pay a net $380.7 million and to remove the PH-ILD indication from Yutrepia's label, resolving all six suits between the companies, including the Delaware '327 patent case and the New Jersey antitrust action. 23 The $175 million initial payment is due within 30 business days, and the FDA must act on the label supplement. 24
Doe v. OpenAI Foundation: OpenAI's response will show whether it moves to compel arbitration, which would decide whether the minors' claims proceed as a class in federal court. 5