State AG News: AI Regulation, Data Protection, Food Safety (September 24-30, 2026)

Each week, Crowell & Moring’s State Attorneys General team highlights significant actions that State AGs have taken. See our State Attorneys General page for more insights. Below are the updates from September 24-30, 2026:

Multistate

• A bipartisan coalition of 26 attorneys general sent a letter to congressional leaders urging Congress to establish a federal framework for overseeing artificial intelligence development and to protect state authority to regulate AI by prohibiting federal preemption of state laws. The coalition outlined several core principles it believes federal AI legislation must address, including: mandating safety testing and performance standards; requiring transparent and uniform incident reporting with publicly available findings; ensuring that AI safety infrastructure and leadership operate independently of commercial incentives; pursuing international coordination to manage the pace of AI advancement and prevent the emergence of uncontrollable superintelligence; and expressly preserving the authority of state officials to enforce both federal and state AI protections.

• A coalition of 24 attorneys general announced that the U.S. District Court for the Eastern District of Virginia granted a preliminary injunction blocking the Trump Administration from accessing a state-managed database containing the sensitive personal information of commercial drivers across the country. The injunction bars the Administration from retaliating against American Association of Motor Vehicle Administrators by cutting off more than $10 million in federal funding if AAMVA declines to provide the Administration with the data. The underlying lawsuits allege that the Departments of Transportation and Homeland Security are covertly building their own database using AAMVA records—including Social Security numbers and other personal information—without public notice, restrictions on use or sharing of that data, or legal authority to do so under applicable federal privacy laws.
• A bipartisan coalition of 43 attorneys general reached a settlement of approximately $2.3 million with Laboratory Corporation of America arising from a 2019 data breach at one of its third-party debt collection vendors, American Medical Collection Agency, which exposed the personal and financial information of its consumers. The breach affected information including Social Security numbers, payment card data, bank account information, and medical testing details. Beyond the monetary payment, the settlement requires Labcorp to strengthen its information security program, develop an incident response plan that specifically addresses vendor breaches, expand its vendor risk management program, impose new cybersecurity requirements on its debt collectors, and engage a third-party assessor to evaluate its vendor risk practices.
• A coalition of 22 state attorneys general announced a U.S. District Court for the District of Oregon decision holding that the Consumer Financial Protection Bureau Director Mark Paoletta must seek funding from the Federal Reserve as Congress intended. This decision resolves a lawsuit filed in December 2025 that was prompted when the CFPB announced that it would stop requesting Federal Reserve funding based on an internal legal opinion concluding that the agency could not draw funds because the Federal Reserve had become “unprofitable.” The decision ensures the agency can continue carrying out its consumer protection functions, including maintaining its consumer complaints database.

Arizona

• Attorney General Kris Mayes filed a lawsuit against Botanic Tonics, LLC, the maker of the kratom-based product, alleging violations of the Arizona Consumer Fraud Act by promoting its product as a health and wellness beverage and alcohol alternative while concealing from consumers that it contains kratom—a psychoactive substance with opioid-like properties—and failing to disclose its risks of addiction and withdrawal. The lawsuit seeks to halt Botanic’s deceptive practices and obtain restitution for affected consumers.

Colorado

• Attorney General Phil Weiser announced a settlement with Wakefield & Associates, LLC, resolving allegations that the debt collection company pursued default judgments against Colorado medical debt consumers without complying with state protections enacted under SB23-093, which requires debt collectors to provide supporting evidence of the debt before a default judgment may be entered. Under the settlement, Wakefield must pay $30,000 to the state and comply with the Colorado Fair Debt Collection Practices Act going forward.

Georgia

• Attorney General Chris Carr filed suit in Fulton County Superior Court against SDG Impact Fund, Inc., its successor entity SDG Global Impact Fund, Inc., Anthony Suber who was the organization’s executive director, and a former board member, Bryan Doreian, alleging that the defendants unlawfully diverted charitable assets and misrepresented how donor contributions would be used. The organization presented itself as a 501(c)(3) sponsoring organization for donor-advised funds intended to benefit causes aligned with the United Nations’ Sustainable Development Goals. The lawsuit alleges that funds were instead redirected to cover personal expenses including vacations, legal fees, criminal restitution payments, vehicle loans, mortgage payments, and private school tuition. The lawsuit seeks full restitution to donors, civil penalties of $5,000 per violation of the Fair Business Practices Act, and the appointment of a receiver to take control of the defendants’ assets.

Michigan

• Attorney General Dana Nessel filed a lawsuit in Michigan’s Kent County Circuit Court against Triple Circle, LLC, Double Circle, LLC, Goodrich Enterprise, LLC, and their owner Brad Scott, alleging violations of the Michigan Consumer Protection Act in connection with the defendants’ operation of two Generator Supercenter franchise locations. The lawsuit alleges that the stores collected substantial deposits from Michigan consumers for home generators but failed to deliver the products or return consumers’ money after the franchise agreements were terminated in April 2024. The lawsuit seeks restitution for consumers, monetary damages, injunctive relief, and civil fines.

Texas

• Attorney General Ken Paxton announced a legal agreement with Plum Organics, a baby food manufacturer, requiring Plum to conduct heavy metal testing on its products, adhere to strict concentration limits, and make its test results publicly searchable. The agreement followed an August 2025 Civil Investigative Demand that investigated Plum’s internal standards that potentially allowed dangerous levels of toxic heavy metals into their products. Under the agreement, Plum agreed to follow FDA guidance for lead, adopt EU standards for cadmium and inorganic arsenic where FDA action levels are absent, and implement a 10 ppb internal limit for mercury in its baby food pouches. Plum agreed that these testing results will be publicly accessible by UPC code, lot number, and “best by” date.