With the proliferation of new AI and consumer protection laws, much of the focus has been on state attorneys general and statutory penalties. These laws, however, also present fertile ground for enterprising private plaintiffs and theories of class action liability.

Private plaintiffs have a long history of bootstrapping new laws to old causes of action, especially during times of technological change. This post considers how plaintiffs might try to use these laws, how the remedies available to such plaintiffs are uncertain, and what companies can do to prepare.

New Laws, Old Strategies

Let’s start with New York’s recently passed Fiscal Year 2025-26 Budget. My colleagues Hannah Taylor and Kate Patton have written about the “sweeping set of consumer protection reforms” tucked into this bill. Among these reforms are new requirements for AI companions and disclosure of so-called algorithmic pricing (using personal data to tailor prices).

The risk of private enforcement of these two laws is not immediately obvious. While they authorize the state attorney general to bring suit on behalf of the people (with penalties up to $15,000 per day under the AI-companion law and up to $1,000 per violation under the algorithmic-pricing law), these laws do not expressly create new private causes of action. Further, enforcement of the algorithmic-pricing law is stayed pending litigation.

But private plaintiffs can still try to import the same theory of liability into established causes of action. For example, they might try to sue under New York’s general consumer protection statute, General Business Law (“GBL”) § 349(a), which prohibits “[d]eceptive acts or practices in the conduct of any business, trade or commerce in the furnishing of any service in the state.”

As the argument would go: a violation of, e.g., the algorithmic-pricing law equates to a violation of GBL § 349. Plaintiffs have had mixed success with this strategy before. See Schlessinger v. Valspar Corp., 817 F. Supp. 2d 100, 109–11 (E.D.N.Y. 2011) (discussing failed and successful attempts to use GBL § 349 as a “vehicle” for claims that conduct violates a statute with no private right of action), aff’d, 723 F.3d 396 (2d Cir. 2013).

Or plaintiffs might try to turn a violation of, e.g., the new requirements for AI companions into a theory of product tort liability. In a break from past trends, courts in New York have started to entertain theories that AI and algorithms are “products” subject to products liability tort regimes, which can come with strict liability. See Nazario v ByteDance Ltd., 2025 NY Slip Op 32266 (N.Y. Sup. Ct. June 27, 2025) (plaintiff stated strict products liability and negligence claims against social media companies for defective algorithm design and failure to warn).

Beyond New York’s AI-companion and algorithmic-pricing laws, other states have passed AI laws that plaintiffs might try to use. Some of these laws expressly prohibit private causes of action (e.g., the Colorado Artificial Intelligence Act (SB 24-205)). But others—most notably Maine’s new AI chatbot law (L.D. 1727)—are silent on who may sue and, more, expressly state that a violation constitutes an  “unfair trade practice,” practically inviting private enforcement.

The Importance of Remedies

One part of a bootstrapping strategy where plaintiffs run into trouble is their remedy. Since they cannot take advantage of the statutory penalties that a state attorney general could, they need something else. What would a remedy be, for example, for a violation of the algorithmic pricing law?

There might not be one. California’s strike-through pricing law offers a helpful comparison. Under this law, companies may not advertise a discount from a former price unless the former price was the “prevailing market price” within the 90 days prior. Cal. Bus. & Prof. Code § 17501. Plaintiffs have survived motions to dismiss in strike-through pricing class actions, but with pyrrhic results.

One California federal district court dismissed strike-through pricing claims on summary judgment because none of the measures of restitution damages worked, observing that “[d]efendant appears to have stumbled across a gap in statutory coverage.” Chowning v. Kohl’s Dep’t Stores, Inc., 2016 WL 1072129, at *7 (C.D. Cal. Mar. 15, 2016). The methods of measuring damages in that case were either legally non-viable or resulted in zero damages.

While this is one example, the potential lack of remedy is a deterrent to plaintiffs bringing suit. It also gives the company leverage to negotiate a favorable early settlement and mitigates the risk of litigating the case. We’ve all heard the legal maxim that where there’s a right, there’s a remedy. But the reverse can also be true. Without a remedy, there’s effectively no right.

What Companies Can Do

In addition to evaluating compliance and assessing risk of enforcement by state attorneys general, companies should prepare against lawsuits by private plaintiffs, especially class or mass actions. Indeed, private firms are already involved: my colleagues Daniel Goldberg and Holly Melton recently wrote about how private firms are powering state enforcement actions.

First, companies should include such potential lawsuits in their risk assessments and consider what plaintiffs could recover, if anything at all, by bootstrapping new laws to general consumer protection causes of action.

Second, companies should ensure they have up-to-date arbitration agreements that can efficiently handle mass arbitrations. Even if plaintiffs have weak remedies, plaintiffs might use the cost of litigation to extract significant settlements, especially in costly class actions or in mass arbitrations where admin fees can run amok. Companies should therefore look to reducing litigation costs via enforceable arbitration agreements that have viable mass arbitration fee structures.