A new lawsuit against OpenAI raises questions about liability and duty to warn in the AI industry, according to experts. A series of Canadian lawsuits against OpenAI over its failure to alert authorities to threats made on its ChatGPT platform ahead of one of the worst mass shootings in Canada’s history has renewed scrutiny of AI firms’ privacy and security practices.
The most recent case to be filed is by the province of British Columbia, seven months after 18-year-old Jesse Van Rootselaar – whose ChatGPT account was flagged for conversations that reportedly included gun violence – killed eight people in the small Canadian town of Tumbler Ridge. Victims included Van Rootselaar’s mother and half-brother, as well as five children and an educator at a secondary school. Van Rootselaar died by suicide.
British Columbia Attorney General Niki Sharma stated that the lawsuit is “an important step toward seeking justice.” It follows about 30 lawsuits filed earlier by the family members of victims.
In April, OpenAI’s chief executive Sam Altman apologized to the victims’ families, writing in an open letter, “I am deeply sorry that we did not alert law enforcement.”
This week, the Canadian province of British Columbia filed its case in the San Francisco federal court in California, US, alleging that OpenAI failed to notify authorities about concerning user interactions on ChatGPT ahead of the Tumbler Ridge mass shooting. The British Columbia lawsuit accuses OpenAI of “aiding and abetting a mass shooting” and product defect liability. It also names CEO Sam Altman as a defendant.
The lawsuit seeks financial compensation from OpenAI to cover costs tied to emergency response and community recovery efforts, including rebuilding the school where the shooting took place, which is to be demolished. It also requests the court to mandate OpenAI to revamp its policies for identifying and addressing user conversations that threaten violence.
Jean-Christophe Belisle-Pipon, assistant professor in health ethics at Simon Fraser University, noted that British Columbia is likely pursuing the case in a US court rather than a Canadian court because it has a greater chance of recovering higher damages there. He explained, “That speaks to how restrictive Canadian law is on damages. Awards for pain and suffering are capped, and punitive damages are rare and modest.”
Victims and their families also filed 30 lawsuits against OpenAI in the Northern District of California in the San Francisco division at the start of September, alleging that “ChatGPT played a role in the mass shooting and OpenAI could have, and should have, prevented it.”
Eighteen-year-old Jesse Van Rootselaar shot and killed eight people at a high school and residence in Tumbler Ridge, British Columbia, in February this year. Tumbler Ridge is a remote municipality with a population of about 2,400, located in the foothills of the Rocky Mountains in northern British Columbia, approximately 1,155km (718 miles) northeast of Vancouver. Tumbler Ridge Secondary School is a Grade 7-12 school with 160 students, according to its website.
Officers found the suspected attacker dead at the school. Two victims’ bodies were found at a nearby house, which police have said were those of the attacker’s 39-year-old mother and 11-year-old half-brother. Victims included a 39-year-old female educator, three 12-year-old female students, and two male students aged 12 and 13.
After the mass shooting, OpenAI disclosed that it had flagged a ChatGPT account linked to Van Rootselaar for abuse eight months earlier and deactivated it. The account had been banned for “misuses of our models in furtherance of violent activities,” it said. However, OpenAI stated it did not alert police at the time because the user’s content “did not meet the higher threshold required for referral,” meaning the company did not believe it indicated a credible, imminent risk of a plan for violent acts.
The Wall Street Journal reported that about a dozen OpenAI employees had discussed whether to alert authorities about the conversations, in which Van Rootselaar described scenarios involving gun violence. Some employees urged the company to refer the matter to authorities, but OpenAI leadership decided against doing so, according to the Journal.
US publication Mother Jones reported that after Van Rootselaar’s ChatGPT account was banned, he opened a second account on the platform used in the months leading up to the shooting. During that time, the chatbot provided Van Rootselaar with “tips on how to evade its own safeguards” to avoid another ban, such as presenting violent content as “fictional or hypothetical,” according to the publication, citing informed sources and material from Van Rootselaar’s chat history.
OpenAI stated it has shared chat logs with the Royal Canadian Mounted Police (RCMP), but British Columbia claims it has not received them. They allege the company failed to take action that could have prevented the mass shooting and configured ChatGPT in an unsafe manner. The lawsuit states, “One telephone call to the RCMP could have prevented the tragedy.” It also notes that OpenAI failed to implement a user-level ban that would have stopped Van Rootselaar from opening a second account on the platform. Furthermore, it alleges that ChatGPT’s safety features were weakened to prioritize engagement.
The platform is described in the lawsuit as “not a passive conduit for the speech of others but a content-generating product that manufactured scenarios involving gun violence.” The lawsuit claims, “Feasible, safer design alternatives existed and were not adopted or effectively implemented.”
Tiffany Li, associate professor of law at Southwestern Law School, indicated that OpenAI’s alleged disregard for its safety guardrails could strengthen British Columbia’s legal claims. She stated, “This puts this case in contrast with other AI death cases where the companies did not have sophisticated flagging and reporting safety workflows in place. There is a stronger case for claims related to negligence and failure to warn.”
In an open letter in April, OpenAI’s Altman apologized to the Canadian community at Tumbler Ridge for his company’s failure to notify authorities about the flagged account. He stated, “While I know words can never be enough, I believe an apology is necessary to recognize the harm and irreversible loss your community has suffered.” Altman also expressed a commitment to work with governments to prevent future tragedies.
Earlier, OpenAI had pledged to the Canadian government that it would carry out a series of safety reforms, including strengthening protocols for referring matters to law enforcement, establishing a direct line with Canadian law enforcement, incorporating “country and community context” into its de-escalation work, and improving its systems to better detect users who repeatedly violate its policies. However, Sharma stated that OpenAI has still not “taken meaningful steps to address the concerns raised by survivors, families, and the Tumbler Ridge community.”
OpenAI has filed motions to dismiss the lawsuits filed against it in California related to the Tumbler Ridge shooting, arguing those cases should instead be addressed in British Columbia. Calls have been growing for digital platforms to take greater responsibility for their impact on users, particularly children, who parents and campaigners say are particularly susceptible to addiction and other harms.
In March, a Los Angeles jury found Alphabet’s Google and Meta liable for damages in a landmark civil trial over youth social media addiction, stating that the companies intentionally built addictive platforms that harmed mental health. Experts suggest that the British Columbia lawsuit against OpenAI could serve as an important test case for how the law treats digital platforms. It raises largely unresolved questions about when an AI company can be held responsible for violence carried out by a user, including under what circumstances it owes a duty of care and when it breaches such a duty.
Anat Lior, associate professor of law at Drexel University in Pennsylvania, stated that the question of whether OpenAI had a duty to warn the authorities about the shooting will likely hinge on factors such as the company’s ability to anticipate danger and “to some extent control the potential harm.” Lior noted, “If courts recognize such a duty, it could impose affirmative obligations on AI companies, based on their exposure to user information, to alert authorities or take other protective measures on behalf of potential victims.” She added, “We are still very much in the early stages of AI liability from a practical standpoint, and much remains to be worked out.”
Belisle-Pipon remarked that ChatGPT’s reported content advising Van Rootselaar on how to evade safeguards could also affect the case. He stated, “Failing to call the police is one thing. Teaching a user how to slip past your own safeguards is another.” He added, “If those facts are validated in court, this is no longer only a failure to warn. It becomes a question of what the product itself contributed, and I think the claimants will have a very strong case.”
Li concluded, “This case raises many unanswered questions in US law. There are many ongoing cases on deaths related to the use of AI applications, but there is no clear law on the topic yet. This could also be an opportunity for this lawsuit to make a strong impact on how AI law develops.”