AI Startup Lawsuits: Hiring, Copyright, Privacy, and Safety

The first half of 2026 has produced a striking run of AI startup lawsuits in 2026, hitting hiring platforms, generative model makers, and AI infrastructure operators over how they collect data, train models, screen job applicants, handle safety warnings, and power their data centers. Several of these cases are already producing rulings that will shape what AI companies can lawfully do with the information they gather and the outputs they generate.

Hiring Algorithm Cases

Eightfold AI and the FCRA Theory

On January 20, 2026, job applicants Erin Kistler and Sruti Bhaumik filed a class action against Eightfold AI Inc. in California Superior Court in Contra Costa County.¹ The case, Kistler et al. v. Eightfold AI Inc., was removed to the U.S. District Court for the Northern District of California, where it carries case number 3:26-cv-1768 and sits in the pleading stage.²

Eightfold sells a “Talent Intelligence Platform” to employers including Microsoft, Morgan Stanley, Starbucks, PayPal, and Chevron.³ Its large language model assigns each applicant a “Match Score” from 0 to 5 ranking their likelihood of success in a role.¹ The complaint alleges Eightfold scrapes personal data from social media profiles, LinkedIn, GitHub, location data, and cookies, combines it with resume and employer data, and uses the resulting scores to filter out lower-ranked candidates before any human reviews their file.

The legal theory is what makes the case unusual. Rather than arguing bias, the plaintiffs contend the evaluations are “consumer reports” under the federal Fair Credit Reporting Act and California’s Investigative Consumer Reporting Agencies Act. Both statutes require the company assembling and selling such reports to disclose their existence, let applicants review them, and give applicants a way to correct errors. The complaint also asserts a claim under California’s Unfair Competition Law and proposes both a nationwide class and a California-specific class.⁴

Eightfold has told Staffing Industry Analysts that it “believes the allegations are without merit” and that its “platform operates on data intentionally shared by candidates or provided by our customers. We do not scrape social media and the like.”⁵ A 2024 Consumer Financial Protection Bureau circular already warned that employers using third-party algorithmic scores are governed by the FCRA.⁶ If the court treats Eightfold as a consumer reporting agency, every vendor selling similar AI screening tools faces the same compliance burden.

Mobley v. Workday

Running alongside Eightfold is Mobley v. Workday, Inc. (Case No. 23-cv-00770, N.D. Cal.), the leading discrimination case in AI hiring. In July 2024, the court denied Workday’s motion to dismiss Title VII, ADEA, and ADA disparate-impact claims, holding that because Workday’s customers delegate core hiring functions to its AI screening tools, Workday acts as an “agent” of the employer and can itself be liable.⁷

In February 2026, the court authorized notice to potential class members alleging Workday’s tools disproportionately reject Black applicants, disabled applicants, and applicants over 40.⁸ A May 2026 discovery order shielded Workday’s internal bias-testing data as attorney-client privileged, denied a request for customer applicant data on the ground that Workday lacks legal control over it, and ordered production of Workday’s own EEO-1 and OFCCP documents.⁹ The case remains active.

Data, Surveillance, and Biometric Privacy Cases

Mercor: Breach, Monitoring, and Work-Product Claims

Mercor, a $10 billion AI labor-platform startup, faces at least seven class actions after a March 2026 breach.¹⁰ One of the complaints, Ananthula et al. v. Mercor.io Corporation (No. 3:26-cv-03362, N.D. Cal.), filed April 21, 2026, alleges a group calling itself “TeamPCP” exploited a vulnerability in a third-party component called LiteLLM and stole roughly four terabytes of data. The stolen files reportedly included 211 GB of candidate records with resumes, Social Security numbers, and contact information; 3 TB of interview videos and facial biometric scans; and 939 GB of source code and API keys.¹¹

The complaints go beyond the breach. Contractors allege Mercor required them to install monitoring software called “Insightful” on personal devices, capturing screenshots every 30 to 60 seconds and picking up banking portals, health-insurance pages, and email.¹¹ Plaintiffs also claim Mercor encouraged workers to feed “real-world scenarios” drawn from their other employers’ proprietary data into Mercor’s AI training pipeline.¹⁰ The Ananthula complaint asserts ten causes of action, including negligence, FCRA violations, Illinois BIPA violations, and unjust enrichment. Meta has paused its work with Mercor pending its own investigation. Mercor disputes the claims and says it is investigating the breach with third-party forensics experts.

Fireflies.AI and the BIPA Damages Cap

Illinois’ Biometric Information Privacy Act continues to draw complaints against AI companies. In Cruz v. Fireflies.AI Corp., filed in federal court in Illinois in December 2025, the plaintiff alleges the AI meeting-transcription tool collects voiceprints to identify individual speakers without providing the written notice, obtaining the written consent, or publishing the retention policies BIPA requires.¹²

The scale of exposure in these cases shifted in April 2026, when the Seventh Circuit ruled in Clay v. Union Pacific Railroad Co. that Illinois’ 2024 amendment capping damages to one recovery per person, regardless of the number of biometric scans, applies retroactively to cases pending when the amendment took effect.¹³ That decision reverses several district court rulings that had treated the amendment as prospective only, and it substantially reduces potential liability for companies facing class actions over fingerprint scans, facial recognition, and voiceprints.

AI Copyright Cases

Runway AI and YouTube Scraping

Generative-video startup Runway AI faces consolidated class actions in the Southern District of New York alleging it circumvented YouTube’s copyright protections to download thousands of user videos for training. Two suits, Businessing LLC v. Runway AI (from a creator associated with the “Ali Spagnola” channel) and Ace Cam, Inc. v. Runway AI (filed by the “Random Golf Club” channel), were consolidated on March 27, 2026, with a combined complaint filed April 27, 2026.¹⁴ A separate suit filed by YouTube creator David Gardner in the Central District of California in February 2026 was transferred to the same New York court by May 2026.¹⁵ The claims center on the Digital Millennium Copyright Act.

Anthropic’s Settlement and a New BMG Suit

Anthropic, maker of the Claude chatbot, agreed to a $1.5 billion settlement in Bartz et al. v. Anthropic after a court found that while training on copyrighted books qualified as fair use, storing pirated copies of those books did not.¹⁶ BMG Rights Management filed a new copyright suit against Anthropic in the Northern District of California in March 2026, asserting direct, contributory, and vicarious infringement. That case was temporarily stayed as of April 2026 due to overlapping issues with the earlier action.¹⁴

The OpenAI Copyright MDL

The multidistrict litigation In Re OpenAI, Inc. Copyright Infringement Litigation (No. 25-MD-3143, S.D.N.Y.) consolidates a dozen cases from authors, news organizations, and video creators. In March 2026, the court granted a motion to compel OpenAI to produce 78 million output logs, a potentially precedent-setting order on the scope of discovery in AI training disputes.¹⁶

Platform Safety and Corporate-Control Cases Against OpenAI

The Tumbler Ridge Shooting Suits

On April 29, 2026, families of seven victims of the February 10, 2026, mass shooting in Tumbler Ridge, British Columbia, filed civil suits against OpenAI and CEO Sam Altman in federal court in San Francisco.¹⁷ The complaints allege OpenAI’s internal systems flagged the shooter’s account in June 2025 for “gun violence activity and planning,” but the company deactivated the account without reporting the threat to law enforcement and then failed to prevent the user from creating a second account.¹⁸

One complaint alleges internal team members recommended contacting law enforcement but leadership overruled them, deciding the risk was not “credible and imminent,” and that the decision was influenced by concerns about the company’s business prospects, including an upcoming initial public offering.¹⁸ Plaintiffs assert negligence and product liability, alleging ChatGPT “deepened the Shooter’s violent fixation and pushed them toward the attack.”¹⁹ Beyond damages, the families are asking the court to order OpenAI to notify law enforcement when its systems flag real-world harm risks and to block banned users from creating new accounts. Altman has publicly apologized for the failure to alert authorities, and OpenAI says it has since “strengthened” its safeguards.¹⁷

Musk v. Altman: Time-Barred

On May 18, 2026, a nine-member jury in Oakland, California, unanimously found that Elon Musk had filed his claims against OpenAI, Sam Altman, and Greg Brockman too late.²⁰ Judge Yvonne Gonzalez Rogers accepted the advisory jury’s finding and dismissed all claims after a three-week trial and less than two hours of deliberation.²¹ Musk had accused Altman and Brockman of breaching a charitable trust and enriching themselves by converting OpenAI from a nonprofit to a for-profit venture backed by Microsoft, and had sought their removal along with up to $180 billion in disgorgement. Because the suit was time-barred, neither the jury nor the court reached the merits.²² Antitrust claims against Microsoft and OpenAI were not part of the jury phase and remain outstanding, though Judge Gonzalez Rogers has expressed skepticism about them. Musk’s attorneys say they intend to appeal to the Ninth Circuit.

Environmental and State-Law Fronts: xAI

NAACP v. xAI

On April 14, 2026, the NAACP and the Mississippi State Conference of the NAACP sued Elon Musk’s xAI and its subsidiary MZX Tech in the U.S. District Court for the Northern District of Mississippi (Case No. 3:26-cv-00074), alleging Clean Air Act violations.²³ The suit claims xAI installed and operated 27 gas-fired turbines in Southaven, Mississippi, between August and December 2025 to power its “Colossus 2” data center without required air permits. The complaint alleges the turbines have the potential to emit over 1,700 tons of smog-forming nitrogen oxides and hazardous pollutants like formaldehyde each year.²⁴

The plaintiffs, represented by the Southern Environmental Law Center and Earthjustice, want the court to order xAI to shut the turbines down until it obtains permits, install pollution controls, and pay civil penalties for each day of violation.²⁵ Separately, the NAACP is seeking to have Mississippi state regulators revoke a permit granted to xAI in March 2026 for a permanent 41-turbine power plant at the same site.²⁴

xAI v. Colorado

On April 9, 2026, xAI sued in the U.S. District Court for the District of Colorado, seeking to block Colorado’s SB 24-205, the state’s algorithmic-discrimination law, before its June 30, 2026, effective date.²⁶ On April 24, 2026, the Department of Justice moved to intervene, and the court granted the motion. The DOJ argues the Colorado law violates the Equal Protection Clause by requiring companies to prevent unintentional disparate impact while providing liability exemptions for algorithms designed to advance diversity.²⁷ Colorado has since passed SB 26-189, which repeals and replaces the challenged law with a notice-and-disclosure framework.²⁸

A Discovery Ruling With Broad Reach: Expert AI Prompts

On May 18, 2026, in Conservation Law Foundation v. Shell Oil Co. (D. Conn.), Magistrate Judge Thomas O. Farrish ordered a plaintiff’s expert to hand over the generative AI prompts she used to filter and identify documents for her expert report, finding the prompts part of the expert’s methodology and therefore discoverable.²⁹ The court rejected the argument that a stipulation protecting “expert notes, drafts, or communications” covered AI prompts, ruling the agreement was not specific enough.³⁰

The ruling is stayed while the plaintiff challenges it as “clearly erroneous.”²⁹ If upheld, it establishes that AI inputs, including prompt histories and iterative refinements, are discoverable on par with code or formulas, a principle that reaches any startup or company using AI in legal, compliance, or technical work.

The Regulatory Backdrop

These lawsuits are landing against a fast-moving regulatory picture. California’s regulations, effective October 2025, require meaningful human oversight of automated hiring systems and four years of record-keeping. Illinois’ amendments to its Human Rights Act, effective January 2026, prohibit AI-driven bias and ban ZIP codes as proxies for protected characteristics. Texas’ TRAIGA, also effective January 2026, rejects disparate impact as a basis for liability and focuses on intentional discrimination, with fines up to $200,000 per violation.⁸

There is still no comprehensive federal AI law. The FTC continues to use Section 5 of the FTC Act against deceptive AI practices, and the EEOC has reached settlements with employers whose AI tools automatically screened out applicants based on age.³¹ The AI Foundation Model Transparency Act (H.R. 8094), introduced in March 2026, would require developers of large models to disclose training data and evaluation protocols, but it remains in committee.²⁸ Until Congress acts, the cases above are where the rules for AI companies are actually being written.

1
ClassAction.org. Kistler et al. v. Eightfold AI Inc. Complaint
2
Akin Gump. AI Hiring Platform Faces FCRA Class Action Over Data Use
3
Outten & Golden LLP. Landmark Class Action Accuses Eightfold AI of Illegally Producing Hidden Credit Reports on Job Applicants
4
Inside Tech Law. Class Action Questions Whether Using AI to Score Job Applicants Violates the FCRA
5
Staffing Industry Analysts. Lawsuit Targeting AI Dives Into Job Seeker Data
6
Consumer Financial Protection Bureau. Consumer Financial Protection Circular 2024-06
7
FindLaw. Derek Mobley v. Workday, Inc.
8
Angela Reddock-Wright. AI-Driven Hiring Bias: The Next Frontier of EEOC Enforcement
9
Duane Morris. California Federal Court Clarifies Limits on AI Bias Testing and Applicant Data Disclosure in Mobley v. Workday
10
The Wall Street Journal. Mercor AI Startup Personal Data Lawsuit
11
Hall Attorneys. Mercor Data Breach
12
SGR Law. AI Note-Takers, Biometric Privacy, and the Battle Over BIPA Damages
13
WilmerHale. Seventh Circuit Weighs In on Critical BIPA Retroactivity Question
14
Mishcon de Reya. Generative AI Intellectual Property Cases and Policy Tracker
15
Reuters. YouTuber Sues Runway AI in Latest Copyright Class Action Over AI Training
16
Norton Rose Fulbright. AI in Litigation Series: An Update on AI Copyright Cases
17
NPR. Tumbler Ridge Mass Shooting ChatGPT Lawsuit
18
CNN. OpenAI Tumbler Ridge Canada Shooting Lawsuits
19
Mother Jones. Lawsuit OpenAI ChatGPT Tumbler Ridge Mass Shooting Victims
20
NPR. Musk Altman OpenAI Jury Verdict Claims Dismissed
21
CNBC. Musk Altman OpenAI Trial Verdict
22
The New York Times. OpenAI Trial Verdict Altman Musk
23
NAACP. NAACP v. xAI Corp. Complaint
24
CNBC. Elon Musk xAI Memphis Data Centers
25
Southern Environmental Law Center. Civil Rights Group Sues xAI for Illegal Pollution From Data Center Power Plant
26
U.S. Department of Justice. Justice Department Intervenes in xAI Lawsuit Challenging Colorado’s Algorithmic Discrimination Law
27
Barnes & Thornburg. DOJ Intervenes in Lawsuit Challenging Colorado’s Algorithmic Discrimination Law
28
Alston & Bird. AI Quarterly April 2026
29
Arnold & Porter. Court Rules Expert’s AI Prompts Are Fair Game Under Rule 26
30
Mayer Brown. Court Orders Disclosure of Expert Witness’s AI Prompts
31
Morgan Lewis. AI Enforcement Accelerates as Federal Policy Stalls and States Step In