Sony BMG is facing two separate lawsuits in Texas and California for installing spyware and allegedly collecting personal data without the users' permission.
The software, which is installed on millions of CDs has caused the company nothing but trouble since the first discs were released.
The company hoped that the software would stop users from copying the files to a PC to combat piracy, however security experts criticised it for using virus-like techniques, and Microsoft even went one step further and classified the software as spyware.
The row began when Windows expert Mark Russinovich found that Sony BMG was using a so-called rootkit to conceal the program used to stop some of its CDs being copied.
Rootkits are being increasingly used by virus makers to hide their malicious code deep within the Windows operating system.
"Sony has engaged in a technological version of cloak and dagger deceit against consumers by hiding secret files on their computers", said Greg Abbot, Attorney General for Texas to the BBC.
Consumers, who thought they were buying a music CD, "instead, received spyware that can damage a computer, subject it to viruses and expose the consumer to possible identity crime", he said.
The Texan lawsuit is seeking up to $100,000 for every Texan affected by the controversial copy protection system, under its Consumer Protection Against Computer Spyware Act, enacted earlier this year.
Sony has said it is co-operating fully with the Attorney General's office.
The company has already announced a CD exchange system and spoken to key retailers like Amazon.com to offer an alternative to the original CDs.
The Electronic Frontier Foundation who wrote an open letter to the company has accused Sony BMG of not doing enough to inform consumers about the problems.
It is suing under a Californian law which bans collecting personally identifiable information through deceptive means.
Other lawsuits are pending against Sony in New York and Italy.