Texas Says ChatGPT Asks Your Age and Checks Nothing. The Parent Is the Second Gap.

On 23 October 2026, Texas Attorney General Ken Paxton sued OpenAI and its CEO, Sam Altman, in Collin County district court. The petition runs 67 pages. It says ChatGPT harms children and that OpenAI misled Texans about how safe it is. Nothing in it has been tested in court.

We care about one part of it. The petition describes three different gaps: a free tier with no age check, a paid tier that asks for an age and never checks it, and no check of who a child’s parent is. Most teams have fixed the first one, or plan to. The second looks like a fix and isn’t. The third is a separate build that almost nobody has started.

What we could confirm

We read Biometric Update, Reclaim The Net, The Next Web and a commentary post from AI Policy Desk. We could not load the petition itself or the Courthouse News story. So every quote below comes second-hand. Treat all of it as an allegation.

• The court and the date. District Court of Collin County, Texas, filed 23 October 2026. The posted copy has no cause number.
• The counts. Count I is the Texas Deceptive Trade Practices Act (the state’s consumer protection law). Count II is the SCOPE Act, short for Securing Children Online through Parental Empowerment. AI Policy Desk says each SCOPE violation is pleaded as a violation of the first law as well.
• The free tier. Reported wording: it “has no gatekeeping or age verification mechanism whatsoever”.
• The paid tier. Reported wording: it “nominally asks users to provide their age”, but “there is no mechanism to verify the age of its users”.
• The parent. The petition says OpenAI “does not request, nor verify, any information related to a purported parent or guardian’s identity or relationship to a known minor”.
• The scale. The petition reportedly claims “tens of thousands” of Texas users under 13.
• What Texas asks for. An order stopping OpenAI from offering ChatGPT to minors in Texas, and from running it without adequate age verification or parental consent. A civil penalty of $10,000 per violation. Return of profits. Fees. A jury trial.
• OpenAI’s answer. A spokesperson said governments have a role in setting safety standards and that OpenAI wants policies that apply to the whole industry, not one company. It didn’t address the specific claims, as far as the reports show.

What we could not confirm

Whether ChatGPT is covered by the SCOPE Act at all. AI Policy Desk says the petition doesn’t explain how it meets the law’s coverage test. That is one commentary source, and we haven’t read the petition. We also can’t confirm the number of under-13 users, the incidents the petition cites, or what a court would count as one “violation”. Everything from “Three gaps” onward is our reading of the reports, not a statement of Texas law.

Three gaps, and why the second one hurts

Take them in order.

Gap one: nothing at the door. A free account with no age question is the easy case. Every regulator we’ve covered would call this a gap. Fixing it is a product decision, not a legal puzzle.

Gap two: the box that asks. This is the one that matters most to teams that think they’re done. The paid tier reportedly asks for an age. An age field is a record of what the user typed. The petition’s complaint is that nothing checks it. We made the same point about the Reddit fine in the self-declaration post. A field that nobody checks isn’t weaker protection. For a regulator it is closer to no protection, and for a plaintiff it is evidence that you knew the question mattered.

It also creates a second problem. Once a child types “13”, you hold a declared age on file. That makes the child a known minor in the petition’s language, and the SCOPE sections that apply to known minors then have something to attach to. Asking for an age and then ignoring the answer can be worse than never asking.

Gap three: nobody checked the parent. The petition says OpenAI doesn’t verify a parent’s identity or the parent’s relationship to the child. In the SCOPE Act, a “verified parent” has to be confirmed by a commercially reasonable method. AI Policy Desk lists the relevant sections as 509.051 (register a user’s age), 509.052 (limits on a known minor’s data and ads), 509.054 (parental tools) and 509.101 (verify the parent).

An age check answers one question: how old is this person? A parent link answers three others. Who is the adult? How are they related to this child? Can you show both facts later? A system built to answer the first question doesn’t answer those. We covered the same split in the New York post on verifying the parent and in the parental consent guide. The Texas petition applies it to an AI assistant.

The remedy that is new: a release gate

Most of what Texas asks for is familiar. One item isn’t. The petition asks the court to bar OpenAI from releasing any new model in Texas unless an independent evaluator, approved by the court, has reviewed its safety guardrails and approved the release.

That isn’t an age-gate rule. It’s a ship gate. If a court ever grants something like it, the question for a product team changes from “do we check age?” to “can we show, before each release, what the safety controls do for a child?”. We can’t say how likely that is. A court might refuse it. But it tells you what Texas thinks the evidence should look like: a record that exists before the incident, not a statement written after it.

This links to the argument in the Texas v. TikTok post. In both cases the state’s theory leans on what the company said it did. A safety page that says “built for teens” is a claim, and the claim can be the violation.

What to model: two states, not one

If your product has an assistant, a chat feature or anything that talks back, store two separate things per account.

The first is the age state. How do you know the age? There are four honest answers: you don’t know, the user declared it, you estimated it, or you verified it.

The second is the parent state. For a known minor: no parent linked, a parent claimed by the child, a parent linked by an invitation, or a parent verified.

Here is a function that applies our reading. It returns what the assistant may do, and why.

type AgeState = "unknown" | "declared" | "estimated" | "verified";
type ParentState = "none" | "claimed" | "linked" | "verified";

type Access = {
  assistant: "full" | "restricted" | "off";
  reason: string;
};

// Our reading of the Texas pleading, not Texas law.
// "declared" never counts as proof of adulthood.
export function assistantAccess(
  age: AgeState,
  isMinor: boolean | null,
  parent: ParentState,
): Access {
  if (age === "verified" && isMinor === false) {
    return { assistant: "full", reason: "verified adult" };
  }
  if (age === "estimated" && isMinor === false) {
    return { assistant: "restricted", reason: "estimated adult, step up before full access" };
  }
  if (isMinor === true) {
    return parent === "verified"
      ? { assistant: "restricted", reason: "known minor, verified parent" }
      : { assistant: "off", reason: "known minor, no verified parent" };
  }
  // unknown, or declared only: treat as not yet checked
  return { assistant: "off", reason: `age is ${age}, not checked` };
}

And the tests that matter:

import { test, expect } from "vitest";

test("declared 30 is not an adult", () => {
  const a = assistantAccess("declared", false, "none");
  expect(a.assistant).toBe("off");
});

test("a child who typed 13 and has a claimed parent is still off", () => {
  const a = assistantAccess("declared", true, "claimed");
  expect(a.assistant).toBe("off");
});

test("a known minor with a verified parent gets the restricted tier", () => {
  const a = assistantAccess("verified", true, "verified");
  expect(a.assistant).toBe("restricted");
});

test("a linked parent is not a verified parent", () => {
  const a = assistantAccess("estimated", true, "linked");
  expect(a.assistant).toBe("off");
});

test("an estimated adult must step up", () => {
  const a = assistantAccess("estimated", false, "none");
  expect(a.assistant).toBe("restricted");
});

The second test is the one that will cause arguments. A child who types an age and names a parent has done what a form asks. Under the petition’s reading, a claimed parent is the same as no parent. The cost is real: some teen users will be locked out until a parent really does something. That is the trade, and you should decide it on purpose.

The “off” in the code is the strictest option. Your product may choose a narrower tier for minors instead of a full block. Texas hasn’t said which restrictions would satisfy it.

What this does to a policy table

Account state	Assistant	Data use	Ads and training	What to record
Verified adult	Full	Normal	Normal	Method, date, result
Estimated adult	Restricted until step-up	Minimal	None	Estimate range, date
Declared only	Off, or a very narrow tier	None kept beyond what’s needed	None	That the age was declared and not checked
Known minor, no verified parent	Off	Delete what the child typed unless a law says to keep it	None	The decision and the reason
Known minor, verified parent	Restricted	Minimal	None	Parent method, date, link to the child’s account

The third row is the one to argue about with your lawyers. Whether a “declared only” user can have even a narrow tier depends on what the SCOPE Act and your other laws say about known minors, and the petition’s wording doesn’t settle it.

What it might cost

This is an example, not data from any platform. Say an assistant feature has 40,000 Texas accounts. Say 85% pass a browser Check as adults, and 15% (6,000 accounts) fall into the unsure band or are minors and need a document Verification. For the minors in that group, you’d also need a parent step, which could be a second Verification of the parent.

On a paid plan a Check costs €0.01 to €0.03 and a document Verification costs €0.10 to €0.30. That gives 34,000 Checks for €340 to €1,020, and 6,000 Verifications for €600 to €1,800. The one-time total for the child accounts is €940 to €2,820. If 2,000 of the 6,000 are minors and each needs one parent Verification, add 2,000 more Verifications for €200 to €600. The 15% is an assumption.

Now the other side. The petition asks for $10,000 per violation. Texas hasn’t said what counts as one. Suppose, as an assumption and not as something in the petition, that each account of a known minor counted once. Then 200 such accounts would be $2 million. The point of the arithmetic isn’t the number. It’s that the penalty scales with the count of accounts you hold, and the fix scales with the same count at about €0.20 to €0.60 each.

Checklist for this week

1. Count your accounts by age state: unknown, declared, estimated, verified. Write the four numbers down.
2. Find every place where a typed age is treated as proof. Each one is a copy of gap two.
3. If you collect a declared age, decide now what the product does when the age is under 18. Don’t leave that to chance.
4. Add a parentState field next to the age record. Four values, and “linked” must not equal “verified”.
5. Write the rule for “claimed parent” in plain words. Then check that the code does what the words say.
6. Run the five tests above against your real access logic.
7. Read your own safety page. Mark each sentence that says what you do for teens. Find the evidence behind each mark.
8. Keep a dated record of safety controls per release. You may never need to show it to a court. You will want it if a regulator asks.

The short version

The Texas petition is an allegation, and it may be narrowed or dismissed. But it lays out a checklist anyway: don’t leave the door open, don’t count a typed age as a check, and don’t call someone a parent because the child said so. A general-purpose assistant doesn’t escape those rules by being general. The cheapest fix is to treat age and parent as two stored states that each have a method and a date.

---

Xident provides age verification and age estimation with a decision record on every check. A browser Check is the lower-cost first step, and a document Verification is for users who need a stronger answer. On paid plans a Check costs from €0.01 to €0.03, and a document Verification costs from €0.10 to €0.30. We don’t provide parent-child linking as a built-in feature, and we make no claim about what Texas will accept. Talk to us about the age step behind your assistant, or see pricing.