Lawsuits against AI companies now span copyright, privacy, defamation, right of publicity, and employment discrimination, with hundreds of active cases in federal and state courts as of 2026. The money at stake is substantial: statutory damages for willful copyright infringement reach $150,000 per work, and privacy penalties can run into the billions when millions of users are affected. These cases are testing whether laws written for human conduct can handle systems that learn from everyone’s data and then generate new content at scale.
Copyright Claims Over Training Data
The largest wave of litigation targets how generative models were built. OpenAI, Meta, Stability AI, and others trained their systems on books, news articles, photographs, and code, mostly without licensing any of it. The plaintiffs’ theory is simple: copying protected works into a training dataset violates the exclusive rights copyright law grants to creators, including the right to reproduce their work and control derivatives.1Office of the Law Revision Counsel. 17 U.S. Code 106 – Exclusive Rights in Copyrighted Works If you can’t photocopy a book and sell it, you shouldn’t be able to feed that same book into a machine that competes with the author.
Two cases stand out. The New York Times sued OpenAI and Microsoft in late 2023 over the use of millions of Times articles to train ChatGPT and Copilot. In April 2025, a federal judge in the Southern District of New York allowed most of the Times’ claims to proceed, denying motions to dismiss the direct and contributory infringement claims while trimming some narrower theories.2Southern District of New York. The New York Times Company v. Microsoft Corporation, OpenAI, Inc., et al. – Opinion The Authors Guild filed a separate class action on behalf of thousands of fiction and nonfiction writers; discovery continues into 2026.3Justia. Authors Guild v. OpenAI Inc.
Where infringement is found to be willful, statutory damages can reach $150,000 per work.4Office of the Law Revision Counsel. 17 U.S. Code 504 – Remedies for Infringement: Damages and Profits When a training set contains millions of works, the exposure is enormous. Some plaintiffs also bring claims under the Digital Millennium Copyright Act, arguing that AI companies stripped author names, titles, and copyright notices during data processing. Those violations carry their own statutory damages of $2,500 to $25,000 each.5Office of the Law Revision Counsel. 17 U.S. Code 1203 – Civil Remedies The Times court allowed several of those DMCA claims to move forward as well.
Where the Fair Use Defense Stands
AI companies almost uniformly argue that training on copyrighted material qualifies as fair use. The statutory doctrine weighs the purpose and character of the use, the nature of the work, how much was copied, and the effect on the market for the original.6Office of the Law Revision Counsel. 17 U.S. Code 107 – Limitations on Exclusive Rights: Fair Use The defense argument is that a model doesn’t store or reproduce its training data; it learns statistical patterns and generates something new.
The first major ruling went against the AI developer. In Thomson Reuters v. Ross Intelligence, a Delaware federal court held that Ross’s use of Westlaw headnotes to train a competing legal research tool was not fair use. The court emphasized that Ross copied the material to build a market substitute and that the effect on potential licensing markets weighed heavily against the defense, even though the output didn’t reproduce the headnotes verbatim.7District of Delaware. Thomson Reuters Enterprise Centre GmbH v. Ross Intelligence Inc. – Opinion
Two California rulings in June 2025 went the other way, but with sharp caveats. One judge found the plaintiffs had simply made the wrong arguments and failed to build a record showing market harm; the ruling did not establish a blanket rule that AI training is lawful. The other found the training itself transformative but held that downloading pirated copies of books to build a permanent library was not fair use. The question remains genuinely unsettled, and the cases now heading toward trial, particularly the Times and Authors Guild cases, will carry more weight because they involve fuller factual records and potentially a jury.
Right of Publicity and Voice Cloning
A separate category of lawsuits targets AI systems that clone a real person’s voice, face, or performing style. The legal basis is the right of publicity, which protects individuals from having their identity used commercially without permission. Most states recognize the right in some form, and damages typically start with whatever the person would have charged for a legitimate licensing deal.
The highest-profile dispute involved Scarlett Johansson and OpenAI. After Johansson declined an offer to voice ChatGPT’s assistant, OpenAI released a voice called “Sky” that many listeners found strikingly similar to the actress. Johansson objected publicly, and OpenAI pulled the voice. The key issue in that kind of claim is not whether the company recorded the person’s voice but whether it created something close enough to evoke their identity for commercial gain.
Voice actors, musicians, and visual artists have filed their own suits, arguing that AI tools trained on their performances allow anyone to generate new content “in the style of” a specific person. These claims don’t always fit neatly into copyright because they target the persona rather than any single recording. State publicity laws vary in scope and duration, and some extend protection beyond death, which matters when models are trained on the work of deceased performers.
Congress is weighing a federal solution. The NO FAKES Act, reintroduced in April 2025, would establish a federal intellectual property right in every individual’s voice and likeness, including protections that extend to families after death. It would let individuals sue anyone who knowingly creates or profits from unauthorized digital replicas, with safe harbors for platforms that remove infringing content promptly.8Congress.gov. S.1367 – NO FAKES Act of 2025 As of mid-2026, the bill is still in committee.
Privacy and Personal Data Harvesting
Privacy claims attack a different part of the AI pipeline: the collection and use of personal information. Many systems were trained on data scraped from social media, forums, and public records, picking up names, photos, health details, and private communications without consent. Plaintiffs argue that scraping personal data at scale and feeding it into a commercial product goes far beyond what anyone intended when they posted a comment or uploaded a photo.
No single federal privacy law governs this collection across all industries. Enforcement comes through a patchwork of state consumer privacy statutes and the Federal Trade Commission’s authority over unfair and deceptive practices. Several state frameworks impose per-violation penalties exceeding $7,500 for intentional violations, and when millions of users are affected, even modest per-person figures produce enormous aggregate liability.
The FTC has emerged as a particularly aggressive enforcer. In its action against Rite Aid, the agency banned the company from using facial recognition technology for five years after finding that its AI-powered surveillance flagged customers based on unreliable biometric data.9Federal Trade Commission. Rite Aid Corporation, FTC v. The agency has also deployed a remedy called algorithmic disgorgement, which forces companies to delete not only improperly collected data but also any AI models built using it. That remedy can erase years of development work.
Internationally, the European Union’s General Data Protection Regulation imposes steeper penalties. Serious violations can trigger fines of up to 4% of worldwide annual revenue or €20 million, whichever is higher. For the largest AI companies, that percentage translates to potential fines in the billions. The GDPR also gives individuals the right to demand deletion of their data, creating an ongoing compliance burden for any company whose models were trained on European users’ information.
Defamation and AI Hallucinations
Large language models sometimes generate entirely fabricated claims about real people, a problem the industry calls “hallucination.” When an AI system confidently states that someone committed a crime they never committed, the legal question becomes whether that counts as defamation. In one case, ChatGPT told a user that radio host Mark Walters had been accused of embezzlement in a lawsuit he had no connection to. Walters sued OpenAI for defamation, and a Georgia court dismissed the claim. The case showed how awkwardly AI-generated falsehoods fit into existing law.
Traditional defamation requires a false statement of fact, publication to a third party, fault on the speaker’s part, and resulting harm. AI complicates every element. A chatbot response to a single user may not qualify as “publication” under traditional standards. Fault is tricky because the model has no intent, and the company may argue it took reasonable precautions. For public figures, plaintiffs must show “actual malice,” meaning the speaker knew the statement was false or acted with reckless disregard for the truth. How that standard applies to a probability engine is unclear.
The bigger fight is over Section 230 of the Communications Decency Act, which shields internet platforms from liability for content created by third parties.10Office of the Law Revision Counsel. 47 U.S. Code 230 – Protection for Private Blocking and Screening of Offensive Material Section 230 was written for message boards and social networks, where users post the content and the platform hosts it. Generative AI doesn’t fit that model cleanly. When ChatGPT fabricates a defamatory statement, no third-party user created it; the model generated it from its training. Plaintiffs argue that makes the AI company an “information content provider” under the statute, which would strip away Section 230 protection entirely. Courts have recognized that a platform loses immunity when it “materially contributes” to the illegality of content rather than passively transmitting what someone else wrote. Whether AI hallucinations cross that line is one of the most consequential open questions in tech law.
Hiring Discrimination and Algorithmic Bias
A growing category of lawsuits targets AI tools used in hiring, lending, and other high-stakes decisions. If an algorithm produces outcomes that disproportionately screen out applicants based on race, age, sex, or disability, it violates the same civil rights laws that would apply to a human decision-maker. The difference is scale: algorithmic bias can affect thousands of applicants before anyone notices the pattern.
The leading case is Mobley v. Workday, filed in 2023, in which a job applicant alleged that Workday’s AI-powered screening tools systematically discriminated against Black applicants, older applicants, and applicants with disabilities. The case raises a threshold question: whether a software vendor that provides hiring tools can be held directly liable under federal anti-discrimination law, or whether only the employer using the tool bears responsibility. As of 2026, there is no final ruling, but the resolution will set the template for how these claims are litigated.
The EEOC has stated in published guidance that employers can be held liable under Title VII when an AI hiring tool produces a discriminatory outcome, even if the employer purchased the tool from an outside vendor and had no discriminatory intent. The guidance tells employers to ask vendors whether their tools have been evaluated for disparate impact and to consider less discriminatory alternatives. The practical implication is that “the algorithm did it” is not a defense.
Downstream Risk: Lawyer Sanctions
One category of AI litigation has nothing to do with AI companies themselves. It involves professionals, particularly lawyers, who rely on AI-generated content without verifying it. In Mata v. Avianca, an attorney used ChatGPT to research a brief and submitted citations to cases that did not exist. The chatbot had invented case names, docket numbers, and judicial opinions. The court fined the attorneys $5,000 and required them to notify every judge falsely identified as the author of a fake opinion.11Justia. Mata v. Avianca, Inc. – Document 54
The judge found that the attorneys had engaged in “conscious avoidance,” meaning they were aware of a high probability that ChatGPT might fabricate citations but chose not to verify them. Courts have not said that using AI for legal research is improper. The obligation is the same one that always existed: a lawyer must verify that the authorities cited in a filing exist and say what the filing claims they say. Since Mata, courts have adopted local rules requiring attorneys to disclose when AI was used in preparing filings and to certify that all citations have been independently verified. A client who loses a case because their lawyer submitted fabricated research could have a viable malpractice claim, and insurers are paying close attention.
Insurance Gaps
Insurers have begun introducing explicit AI exclusions in professional liability, directors-and-officers, and errors-and-omissions policies. These exclusions can be sweeping, covering any claim arising from the creation or distribution of AI-generated content and even reaching a company’s failure to detect content created by a third party’s use of AI.
Major AI providers offer indemnification to enterprise customers against intellectual property claims, but with significant conditions: using the product within license scope, not tampering with safety systems, having proper rights to the input, and not using output the customer knew or should have known was likely to infringe. If any condition is unmet, the indemnification evaporates. Some agreements also reserve the provider’s right to terminate the license and refund fees rather than defend the claim. A company that deploys a generative AI tool and then faces a copyright or defamation claim may discover simultaneously that the provider’s indemnification doesn’t apply and that its insurance policy contains an AI exclusion that voids coverage. Checking both the indemnification terms and the policy language before deploying AI is the kind of homework that prevents expensive surprises later.