In the strongest regulatory move made against OpenAI since the launch of its Artificial Intelligence (AI) chatbot ChatGPT in November 2022, the Federal Trade Commission (FTC) has opened an investigation to determine whether OpenAI engaged in unfair or deceptive privacy or data security practices or engaged in unfair or deceptive practices relating to risks of harm to consumers, including reputational harm. The initiation of the FTC’s investigation into OpenAI is timely, as OpenAI has recently faced several civil class action lawsuits in the past month, claiming various privacy and intellectual property violations.
The FTC issued a 20-page Civil Investigation Demand (CID) — an enforceable subpoena that seeks documents or other information related to an FTC investigation — seeking records regarding how OpenAI addresses risks related to its Large Language Models (LLMs) and LLM Products (i.e., ChatGPT). The CID includes a request to provide “detailed descriptions of all complaints it had received of its products making ‘false, misleading, disparaging or harmful’ statements about people” as well as records related to a security incident involving a leak of user data. Additional requests seek to determine what protocols and measures OpenAI has in place when handling the disclosure of personal information.
The launch of this investigation marks the first indication of how the FTC intends to enforce its earlier warnings to companies that existing consumer protection laws apply to AI. Companies found to violate consumer protection laws may be subject to fines or can be put under a consent decree, a court order that establishes an enforceable plan for a sustainable reform. A consent decree in this case would most likely be a plan on how the company would handle consumer data moving forward.
This is a rapidly developing area, and Benesch’s is closely monitoring all decisions that may affect your business.
What is the significance of the FTC’s investigation into OpenAI?
None at this time. The outcome of this investigation, which may take several months, is likely to shed light on how the FTC intends to approach enforcement of consumer protection regulations as they relate to the use of AI. However, once the investigation is completed, the AI industry can expect to see a new set of compliance-related requirements or measures for handling user’s personal data.
