AI Chatbot Impersonation in the Courts: Pennsylvania's Character.AI Case and the 2026 State AG Wave

By Aisha Mohamed, Insightful AI Desk

On May 5, 2026, the Pennsylvania Attorney General’s office, under Governor Josh Shapiro’s administration, filed suit against Character Technologies Inc., the operator of Character.AI. The complaint alleges that a user-created chatbot persona named “Emilie” held itself out as a licensed Pennsylvania psychiatrist, including by providing the license number “PS306189” — which the state confirmed does not match any valid medical license — and that the platform’s allowance of such interactions constituted the unlawful practice of medicine. Per the official Pennsylvania filing and reporting from NPR, the “Emilie” persona had approximately 45,500 user interactions as of April 17, 2026.

The Pennsylvania action is the first enforcement action of its kind by a U.S. governor’s office against an AI chatbot company alleging unlicensed medical practice. It is not, however, an isolated event. Kentucky filed a separate lawsuit against Character.AI in January 2026, and Texas Attorney General Ken Paxton has issued Civil Investigative Demands to Character.AI and Meta. In December 2025, attorneys general from 39 U.S. states plus the District of Columbia jointly wrote to Character Technologies and 12 other AI and tech firms warning about chatbot communications that allegedly violate state consumer-protection laws.

Underlying these state-level actions, a parallel wave of new chatbot-specific laws has taken effect or is moving toward enactment. California’s SB 243, signed by Governor Newsom on October 13, 2025, took effect January 1, 2026. Washington’s House Bill 2225, signed by Governor Bob Ferguson on March 24, 2026, includes a private right of action that lets affected individuals sue chatbot operators directly. A proposed federal CHATBOT Act is also under discussion. The regulatory environment for AI chatbots is no longer hypothetical.

This piece walks through the Pennsylvania case in detail, the broader state-AG and statutory landscape, the responsibility allocation question that sits underneath all of it (platform versus user versus persona), and what builders and users can do today.

What the Pennsylvania complaint actually alleges

Per the Pennsylvania filing and contemporaneous reporting from CBS News and The Hill, the documented facts of the complaint:

• The persona, named “Emilie” on the Character.AI platform, presented itself in conversation as a licensed psychology specialist who attended Imperial College London’s medical school.
• When a state investigator (who had created a Character.AI account) asked Emilie for a license number, the chatbot provided PS306189.
• Pennsylvania’s licensing database does not contain that number as a valid medical license.
• Emilie engaged in conversations with users who described themselves as struggling with mental health concerns, including dispensing advice and discouraging users from seeking in-person care.
• The persona had accumulated approximately 45,500 user interactions as of mid-April 2026.

Pennsylvania’s complaint frames Character.AI’s allowance of the persona as enabling the unlawful practice of medicine and as a consumer-protection violation. The relief sought includes an injunction requiring upfront disclosure that AI personas are not licensed professionals, active filtering of impersonation claims, and other remedies. Character.AI’s terms of service explicitly prohibit creating personas that impersonate medical, legal, or mental-health professionals, and the lawsuit’s argument is that the platform’s enforcement of those terms was insufficient.

The wider state-AG landscape

The Pennsylvania action is one element of a broader 2025-2026 pattern of state-level AI chatbot enforcement. Several of the data points worth knowing:

Kentucky filed the first state lawsuit against Character.AI in January 2026. Per the Kentucky Attorney General’s release, the suit focuses on child safety, alleging the platform’s chatbots produced content that led minors toward self-harm.

Texas Attorney General Ken Paxton issued Civil Investigative Demands to Character.AI and Meta in 2026, focused on whether deceptive AI mental health services have misled children and whether platform claims about AI safety mislead consumers.

The 39-state-AG letter of December 2025 was sent to 13 AI and tech firms, warning about misleading chatbot interactions that the AGs argued violated state consumer-protection laws. This is the closest the state-AG community has come to a coordinated regulatory signal short of joint litigation.

State chatbot laws in effect or pending include:

• California SB 243 (effective January 1, 2026): requires chatbot operators to disclose AI nature, restricts certain interactions with minors, and creates state-level enforcement authority.
• Washington HB 2225 (effective 2026, signed March 24): includes a private right of action, meaning affected individuals can sue chatbot operators directly, not only through state enforcement.
• Additional bills under consideration in New York, Massachusetts, Illinois, and Colorado, per Orrick’s 2026 state chatbot law roundup.

At the federal level, the proposed CHATBOT Act would set baseline disclosure and impersonation rules nationally, but it has not yet passed either chamber. The state-level patchwork is therefore where actual operational compliance happens today.

The responsibility allocation question

The cases and the statutes all turn, in different ways, on a single underlying question: when a user-customizable chatbot persona impersonates a licensed professional, who is responsible? Three positions are in active play, and which one prevails will determine the operating model for the entire user-customizable chatbot category.

Platform responsibility. Under this position, the platform (Character.AI, Replika, Janitor AI, and similar services) is responsible for what their hosted personas claim and do, even when the persona is user-generated. The Pennsylvania complaint implicitly endorses this view. The argument: the platform built the system, set the rules for what personas can claim, and decided what enforcement to apply. Liability follows control.

User responsibility. Under this position, the user who created the impersonating persona is the responsible party; the platform is a neutral utility analogous to a publishing tool. The argument: holding the platform liable for user-generated content cuts against Section 230 of the Communications Decency Act and against the long-standing legal treatment of user-generated platforms. Liability follows authorship.

Statutory disclosure and design responsibility. Under this position, platforms must build mandatory disclosure (every interaction that touches a regulated practice area begins with “I am an AI, not a licensed professional”), active filtering of impersonation claims (the platform must detect and block license-number claims and similar), and design defaults that prevent harm. This is the position California SB 243 and Washington HB 2225 substantively endorse, and the position the Pennsylvania complaint seeks to advance via injunction.

The third position is gaining traction across both statutes and litigation. For builders, it is the position most worth designing toward today regardless of how individual cases resolve.

The genuine policy difficulty

The cases are concrete, but the underlying problem is harder than the headlines suggest. Generative chatbots are a tool. Users create personas for many legitimate purposes: roleplay companions, journaling assistants, fictional characters, language-practice partners. Many of these benign uses involve the persona claiming a fictional identity that, in a different context, could shade into impersonation.

Where the line falls between simulation and impersonation, and whose responsibility it is to police it, is the question regulators and platforms are actively working out. The Pennsylvania complaint is one early test case; the precedent it sets — whatever the legal outcome — will shape how platforms enforce their own terms going forward.

The constructive read: the courts and legislatures are doing the work the technology requires. Compliance frameworks for user-customizable AI personas are being built in the open. Builders who engage early shape the rules they will eventually have to operate under.

Where the leverage is

The enforcement and statutory wave creates concrete openings for several reader groups.

For builders of chatbot platforms and user-customizable AI personas. Three practical investments to prioritize now: build mandatory upfront disclosure into the user experience for any interaction that may touch regulated practice areas (medical, legal, financial, mental health); implement automated detection of impersonation claims (license numbers, credentialing language, “I am a licensed X” patterns) with content-policy intervention before user delivery; and document your enforcement decisions in a form that holds up under regulator review. The platforms that build this infrastructure are positioned for the regulatory environment that is arriving.

For mental health professionals and consumer advocates. The state-AG actions and statutory frameworks rely on documented examples of harm to support enforcement. Mental health professionals who encounter patients describing AI chatbot interactions that influenced their care decisions have an information value that regulators currently struggle to collect at scale. Two practical steps: keep clinical notes of any patient-reported AI chatbot involvement in care decisions (with appropriate consent), and consider participating in public-comment periods on state-level chatbot legislation where your expertise can shape design defaults.

For policy researchers and legal academics. The next 12-24 months will produce the foundational case law and statutory interpretation for AI chatbot regulation. The empirical work that will be most valuable: comparative analysis of state statutes (which provisions actually prevent harm, which produce compliance theater), documentation of enforcement actions and their outcomes, and structured surveys of platform compliance behavior. The first comprehensive academic articles in this space will shape the field; the work is reachable now.

For enterprise legal and compliance teams. If your organization deploys AI chatbots in any context that touches regulated practice areas — healthcare, financial advice, legal information, even HR — review your deployment configurations against the disclosure and design defaults now required under California SB 243 and Washington HB 2225, and prepare for similar requirements in other states. Three asks for your AI vendor relationships: confirm the platform supports configurable disclosure language, verify the audit trail for chatbot interactions, and document your enforcement approach to user-customized personas (if your deployment allows them).

What is worth doing, and what is worth watching

For organizations and individuals navigating the chatbot regulatory environment today, three concrete patterns are reachable.

1. Build an AI chatbot compliance review process. If your organization deploys chatbots in any context that could touch a regulated practice area, the practical setup looks like this: enumerate every chatbot deployment, map each to the practice areas it could touch (medical, legal, financial, mental health), document the disclosure language and enforcement defaults for each, and review against the active state laws (California, Washington as primary; New York, Massachusetts, Illinois, Colorado as forthcoming). The review is approximately a 2-4 week exercise for most organizations and produces a defensible compliance posture across the state patchwork.

2. Run a structured impersonation test against your chatbot deployments. A useful internal audit: deploy a tester who is not part of the chatbot product team to attempt to elicit professional impersonation from your chatbot in each regulated practice area. Track which prompts produce impersonation claims (license numbers, credentialing language, definitive medical or legal advice without disclaimer), how long the conversation continues before disclosure surfaces (if it does), and how easily the protections can be circumvented. The test takes a day to a week, and the results inform both compliance and product investment decisions.

3. For users: build a simple verification habit. For consumers using AI chatbots in any context where the chatbot might claim professional credentials, the practical habit is verification through independent channels. State medical, legal, and financial licensing boards typically maintain free public license lookup tools (Pennsylvania’s, for example, is at the Department of State website). Anyone who is making a decision based on a chatbot’s claimed credentials can verify the license number, name, and credentials in minutes. The Pennsylvania case demonstrates that AI chatbots can confidently provide invalid license numbers; independent verification is the practical safeguard.

Several questions about the chatbot regulatory environment remain open and worth tracking. The Pennsylvania case’s legal outcome on the merits will shape whether platform-responsibility allocation extends to user-generated personas under state consumer-protection frameworks. Section 230 interaction with these cases is unresolved; whether AI chatbot personas qualify for the same liability protections as user-generated content on traditional platforms is being actively litigated. Federal preemption attempts may shift the regulatory landscape; the CHATBOT Act, if it advances, could preempt or harmonize state requirements. And cross-platform comparative compliance analysis — how Character.AI, Replika, Janitor AI, and similar services compare on disclosure, impersonation prevention, and minor protection — is empirically tractable but has not been systematically published.

The most useful near-term signals: the Pennsylvania case’s schedule and Character.AI’s response (settle, litigate to verdict, or seek federal preemption); New York and Massachusetts chatbot bill progression through their respective legislatures; first private-right-of-action lawsuits under Washington HB 2225; and any federal CHATBOT Act movement in Senate Commerce or House Energy & Commerce committees. Each is independently observable.

How we use AI and review our work: About Insightful AI Desk.