AI Chatbot Disclosure Laws by State (2026): What Your Bot Must Say

Last verified: 6 October 2026. This guide summarises public sources and is not legal advice; confirm with counsel before relying on it.

The United States has no single federal chatbot disclosure law. Instead, a growing set of state laws and the Federal Trade Commission's general power over deceptive practices decide when a chatbot must say it is a bot. Two kinds of state law matter, and mixing them up is the most common mistake in articles on this topic:

• Bot disclosure laws for commercial chatbots. These cover ordinary sales and support bots. California (SB 1001, and AB 1609 for very large businesses), Utah and Maine are the main examples.
• Companion chatbot laws. These cover bots designed for ongoing social or emotional relationships, such as AI friends. California SB 243, New York's AI companion law, and new laws in Oregon and Washington fall here. California SB 243 expressly excludes bots used only for customer service.

Outside the US, the EU AI Act's Article 50 has required chatbots to tell people they are talking to AI since 2 August 2026, and it reaches non-EU companies whose bots serve EU users. Our EU AI Act compliance guide covers that in depth.

The practical question for any business is the same everywhere: does your chatbot clearly tell people they are talking to a machine, not a human? If it does, at the start of the conversation and in plain words, you meet the core of every law in this guide. The sections below cover the details: who each law covers, when it applies, how it is enforced, and disclosure wording you can copy.

California has three laws that touch chatbot disclosure, and they cover different bots.

SB 1001, the bot disclosure law (in force since 1 July 2019)

California Business and Professions Code section 17941 makes it unlawful to use a bot to communicate with a person in California online with the intent to mislead them about its artificial identity in order to encourage a purchase or sale of goods or services, or to influence a vote. A business is not liable if the bot discloses that it is a bot, and the disclosure must be "clear, conspicuous, and reasonably designed" to inform the person. In practice: a sales or support bot that says up front that it is a bot is on the safe side.

SB 243, companion chatbots (in force since 1 January 2026)

SB 243 regulates "companion chatbots": AI systems that give adaptive, human-like responses and are capable of meeting a user's social needs over multiple interactions. It excludes bots used only for customer service or a business's operational purposes. If you run a companion product, the law requires:

• A clear and conspicuous notice that the chatbot is AI and not human, where a reasonable person could be misled
• For users the operator knows are minors, a reminder at least every three hours to take a break and that the chatbot is not human, plus measures against sexual content
• A protocol for responding to suicidal ideation, including referral to crisis services
• Annual reports to California's Office of Suicide Prevention starting 1 July 2027

SB 243 gives anyone injured by a violation a private right of action for injunctive relief, the greater of actual damages or $1,000 per violation, and attorney fees.

AB 1609, the Right to Human Customer Service Act (signed 28 September 2026)

AB 1609 targets large businesses: those with more than $500 million in gross annual revenue nationally that serve California customers. According to Fox Rothschild's summary, covered businesses must:

• Give a clear and conspicuous disclosure, in the same medium, when a reasonable person might think the chatbot is human
• Offer a simple way to request a human during business hours, and connect the customer within 15 minutes or offer a set appointment or callback
• Post a customer service phone number clearly on their website

It is enforced by public prosecutors, with civil penalties of up to $5,000 for a first violation and $10,000 for each later one. Check the bill page for the operative date before planning your rollout.

What a compliant opening looks like

Good: "Hi! I'm an AI assistant, not a person. I can help with orders, returns and product questions. Type 'agent' at any time to reach our team."

Risky: "Welcome! How can I help today?" with only a small "Powered by AI" footer, or a bot called "Sarah" with a stock photo that admits to being AI only when asked.

The table below lists the enacted US state laws that require, or directly affect, chatbot disclosure as of 6 October 2026. Sources: the statutes and law-firm summaries linked in this guide, including Orrick's 2026 state chatbot law review. Bills change quickly; check the NCSL AI legislation tracker for anything newer.

What changed in Colorado

Colorado's 2024 AI Act (SB 24-205) would have required disclosure whenever a consumer interacted with an AI system. It never took effect: it was delayed to 30 June 2026, a federal court paused enforcement in April 2026, and SB 26-189, signed 14 May 2026, replaced it from 1 January 2027 with rules for automated decision-making in consequential decisions (credit, employment, housing, insurance, health care, education). There is no general chatbot disclosure duty in the replacement law.

Key Variations Across States

Scope: Maine's law and California's SB 1001 apply to ordinary commercial chatbots. Utah applies mainly when a consumer asks, or in high-risk interactions in licensed professions. Companion laws (California SB 243, New York, Oregon, Washington) do not cover a typical FAQ or support bot, but a support bot that drifts into open-ended emotional conversation could raise the question.

Timing: Utah's safe harbor and the companion laws point to disclosure at the start of the interaction; New York and California SB 243 add periodic reminders for companion use.

Human access: California AB 1609 is the first state law to require large businesses to offer a human within set time limits. Even where it does not apply, a visible route to a person is good practice and is what the human handoff guide covers.

Enforcement: most laws are enforced by an attorney general or consumer-protection agency. California SB 243 and Oregon SB 1546 add private rights of action, which is where class-action risk comes from.

The Federal Trade Commission has no chatbot-specific statute, but Section 5 of the FTC Act prohibits unfair or deceptive acts or practices nationwide. A chatbot that leads consumers to believe they are talking to a person, when that belief affects their decisions, fits the FTC's long-standing deception analysis.

What the FTC has done on AI and chatbots

• February 2023: the FTC's business blog post "Keep your AI claims in check" warned companies against overstating what their AI does.
• April 2024: the FTC's rule against impersonating governments and businesses took effect, letting it seek civil penalties against impersonation scams, including AI-driven ones.
• September 2024: "Operation AI Comply" brought cases against companies using AI claims to deceive consumers, including DoNotPay's "robot lawyer".
• September 2025: the FTC ordered seven companies (Alphabet, Character Technologies, Instagram, Meta, OpenAI, Snap and xAI) to report on how their companion chatbots affect children and teens.

What Makes a Chatbot "Deceptive" Under FTC Standards

1. Representation or omission: does the bot say or imply it is human? A human name, a human photo and a "live chat" label together can create that impression.
2. Materiality: would knowing it was a bot change what the consumer does, such as what they share or whether they ask for a person?
3. Reasonable consumer: would an ordinary person opening the chat window think they were talking to a human?

FTC Penalty Authority

A first Section 5 deception case usually ends in an order requiring changes, and sometimes refunds to consumers. Civil penalties apply when a company violates an existing FTC order or a trade regulation rule, such as the impersonation rule. The maximum is $53,088 per violation, and the FTC confirmed in September 2026 that the 2025 amounts stay in place for 2026.

Outside the US: EU AI Act Article 50

From 2 August 2026, providers of AI systems intended to interact directly with people must design them so users are told they are interacting with AI, unless that is obvious from the context. The obligation applies to non-EU companies whose chatbots serve people in the EU. The Digital Omnibus did not delay Article 50; it only gave existing generative AI systems until 2 December 2026 to add machine-readable marking of AI-generated content. Fines for transparency breaches reach EUR 15 million or 3% of worldwide annual turnover, whichever is higher. Our EU AI Act chatbot guide covers the rest.

Federal and State Rules Together

FTC authority and state laws apply side by side. Meeting a state law does not shield a disclosure the FTC still considers misleading, so design for the clearest standard rather than the minimum. A short, explicit statement at the start of every conversation satisfies the core of every law in this guide.

One of the most common compliance failures is using disclosure language that is technically present but legally insufficient. Many chatbots carry some kind of AI notice that a hurried user would never notice. The gap between having a disclosure and having a compliant disclosure is where most businesses fail.

The Anatomy of a Compliant Disclosure

A strong chatbot disclosure has four elements:

1. Explicit bot identification: The word "bot," "AI," "automated," or equivalent. Vague terms like "virtual assistant" or "smart helper" are weaker because they do not clearly say non-human.
2. Negation of human identity: An explicit statement that the user is NOT talking to a human. "I am an AI chatbot" is good. "I am an AI chatbot, not a human" is better because it eliminates any remaining ambiguity.
3. Functional description: What the chatbot can do, which sets expectations and reduces frustration when it reaches its limits.
4. Human alternative: How to reach a human if the user prefers. California AB 1609 requires this for very large businesses, and it is good practice for everyone.

Jurisdiction-Safe Templates

These templates contain all four elements, which covers the core disclosure duty in the US state laws above, FTC expectations and EU Article 50. Use them as-is or adapt them to your brand voice while preserving the four required elements.

Template 1: Universal Standard (Recommended for All Businesses)

"Hi! I am an AI chatbot - not a human. I can help with [list 2-3 capabilities]. If you would prefer to speak with a person, type 'human' at any time. How can I assist you?"

Template 2: E-Commerce

"Welcome! I am an automated AI assistant, not a human agent. I can help you find products, track orders, and answer questions about our policies. Need a real person? Just say 'agent' and I will connect you. What can I help you find?"

Template 3: Professional Services (Law, Finance, Healthcare)

"Hello. I am an AI-powered assistant and not a human representative. I can provide general information and schedule appointments, but I cannot give professional advice. For specific legal/financial/medical questions, I will connect you with a licensed professional. How may I direct your inquiry?"

Template 4: Home Services / Local Business

"Hey there! I am an AI assistant for [Business Name] - I am not a human, but I can help with pricing, scheduling, and answering common questions 24/7. Want to talk to our team directly? Type 'call me' and we will reach out. What do you need help with?"

Template 5: SaaS / Tech Support

"Hi! I am [Bot Name], an AI support bot - not a human. I can troubleshoot common issues, walk you through features, and check your account status. For complex technical issues, type 'escalate' to reach our support team. What is going on?"

Widget Label Requirements

The chat widget trigger button - the element users click to open the chatbot - is the first opportunity for disclosure and is a natural place to disclose before the conversation starts. Replace generic labels with disclosure-forward alternatives:

Persistent Disclosure Mechanisms

A first message can scroll out of view in a long conversation, and Utah's safe harbor refers to disclosure at the outset and throughout the interaction. Add at least one persistent signal: a fixed "AI Chatbot" badge visible at all times in the chat header, an "AI" indicator next to the bot's name in each message bubble, or a subtle but visible footer within the chat window stating "You are chatting with an AI." In Conferbot you control the bot's display name, avatar and first message in the chatbot builder, so you can name the bot "[Brand] AI Assistant" and put the disclosure in the opening message; on Discord and Telegram the Behaviour settings also add a short disclaimer line to AI replies. Preview the result with our free website chatbot preview tool.

Penalties vary widely, and several laws have no fixed fine of their own because they plug into an existing consumer-protection statute. These are the amounts stated in the laws and sources above:

Why per-violation penalties matter

Where a law counts each conversation as a violation and allows private lawsuits, small amounts add up: a bot that has thousands of conversations without a disclosure creates thousands of potential claims. That is why the companion-chatbot laws with private rights of action draw the most attention from plaintiff lawyers.

Risk Factors by Business Type

Risk rises with: high conversation volume, users in California or the EU, conversations tied to purchases or bookings, human names or photos on the bot, and regulated sectors such as finance, health care and real estate, where industry regulators add their own rules. Low-volume bots that disclose clearly carry little practical risk, but disclosure is still the law in several states and costs nothing to add.

Where enforcement has focused so far

Public enforcement has concentrated on clear deception: AI products sold on false claims (the FTC's Operation AI Comply) and companion chatbots used by children and teens (the FTC's 2026 inquiry and the new state companion laws). Ordinary support bots that say they are bots have not been the target. For the wider security and privacy picture, see our chatbot security risks guide.

The good news about chatbot disclosure compliance is that for the vast majority of businesses, the implementation is straightforward. Because disclosure requirements across states share a common core - tell users they are talking to a bot, not a human - a single well-designed disclosure framework satisfies all jurisdictions simultaneously. Here is the step-by-step implementation process.

Phase 1: Audit (30 Minutes)

1. Inventory all chatbots. List every chatbot your organization operates: website support bot, lead generation bot, WhatsApp bot, Facebook Messenger bot, internal helpdesk bot. Include chatbots operated by third-party vendors on your behalf.
2. Identify state exposure. Determine which states your chatbot serves. For website chatbots, this is effectively all 50 states unless you geo-block specific states (not recommended). For in-store kiosks or location-specific deployments, exposure is limited to the deployment state.
3. Assess current disclosure. Open each chatbot as a new user and document: Does the chatbot disclose its AI/bot nature? When does the disclosure appear? Is it clear and conspicuous? Is there a persistent indicator? Is human escalation available and disclosed?
4. Identify gaps. Compare each bot against the four elements in the templates section: explicit bot identity, "not a human", what it can do, and how to reach a person. Anything missing is a gap.

Phase 2: Implement Disclosure (60-90 Minutes)

1. Configure first-message disclosure. Add or update the chatbot's opening message to include explicit bot identification, negation of human identity, functional description, and human escalation option. Use Template 1 above as your starting point.
2. Update widget labels. Change chat trigger buttons from generic labels ("Chat with us") to AI-identifying labels ("Chat with our AI Assistant").
3. Add persistent AI indicator. Configure a visible badge, icon, or label that remains visible throughout the conversation identifying the chatbot as AI-powered.
4. Configure human handoff disclosure. When the chatbot transfers to a human agent, add a clear transition message: "You are now being connected to [Agent Name], a human member of our team."
5. Verify mobile rendering. Test all disclosures on mobile devices (iOS and Android) to ensure text is readable, badges are visible, and labels are not truncated.

Phase 3: Documentation (30 Minutes)

1. Create a compliance record. Document: date of implementation, specific changes made, screenshots of compliant chatbot interface (desktop and mobile), list of chatbot deployments covered, state laws addressed.
2. Update privacy policy. Add a section describing your use of AI chatbots, what data they collect, and how users can request human interaction. While not required by all chatbot disclosure laws, this complements your GDPR compliance and demonstrates good faith.
3. Train relevant staff. Brief customer service managers and marketing teams on the disclosure requirements. Ensure they understand that removing or modifying disclosure elements creates compliance risk. Document the training with date and attendees.

Phase 4: Ongoing Monitoring (15 Minutes Monthly)

1. Test disclosures monthly. Open each chatbot as a new user and verify all disclosure elements are functioning. Platform updates, theme changes, and configuration modifications can inadvertently remove or alter disclosure elements.
2. Monitor legislative developments. Check the NCSL tracker quarterly for new state laws. Subscribe to at least one AI regulatory newsletter for real-time updates on enforcement actions.
3. Review chatbot analytics. Use chatbot analytics and a sample of transcripts to confirm the opening message is shown in every flow and that requests for a human are answered.
4. Re-assess with changes. Any time you modify chatbot flows, add new capabilities, change platforms, or expand to new channels, re-verify disclosure compliance.

The total time investment for achieving multi-state compliance is approximately 2 to 3 hours for the initial implementation and 15 to 30 minutes monthly for ongoing monitoring. That is a small cost next to the penalties in the table above.

Some sectors add their own rules on top of general disclosure laws. These are the main ones to check with your compliance team; this is not a full list.

Financial Services

Broker-dealers' chatbot messages are communications with the public under FINRA's rules, so they need the same supervision, fair-and-balanced content and risk disclosures as other communications. Investment information from a bot should say it is general information, not personalised advice. Utah's AI Policy Act requires proactive AI disclosure in high-risk interactions in regulated occupations, which includes collecting financial data and giving personalised financial advice. From 1 January 2027, Colorado's SB 26-189 adds notice duties when automated decision-making is used in credit, insurance and other consequential decisions.

Healthcare

Health care chatbots handle protected health information, so HIPAA applies to any covered entity or business associate running them. Texas TRAIGA requires health care providers to disclose AI use to patients. Several states (including Utah and Tennessee) now restrict chatbots that present themselves as licensed mental health professionals. A health bot should state that it cannot diagnose or replace a clinician.

Real Estate

Real estate chatbots must avoid steering buyers or renters toward or away from neighbourhoods based on protected characteristics, which the Fair Housing Act prohibits whether the steering is intentional or comes from model bias. Keep property recommendations based on the user's stated criteria, and log them.

Multi-Industry Checklist

For data protection that applies to all of these, see our chatbot GDPR compliance guide.

Chatbot regulation is moving quickly. In the first half of 2026 alone, Oregon, Washington, Nebraska and Idaho enacted chatbot laws, California added AB 1609, and Colorado replaced its AI Act. Expect more states to follow, and expect existing laws to be amended. Build so that a change takes minutes, not a project.

Architecture for Compliance Agility

1. One place for disclosure text: keep the opening message, bot name and widget label consistent across every bot and channel, so one edit updates all of them.

2. Region-specific additions only where needed: use one strong disclosure everywhere, and add region-specific extras (for example EU notices) only where a law requires something unusual.

3. Keep records: save dated screenshots of the disclosure on desktop and mobile each time you change it, and keep the conversation logs your retention policy allows. If a regulator asks, you can show what users saw on a given date.

4. Version your wording: keep each version of the disclosure text with the date it went live. In Conferbot, flow version control gives you that history for the opening message.

The "Clearest Standard" Strategy

The simplest long-term approach is one disclosure that meets the clearest standard everywhere: explicit bot identity at the start, "not a human", what the bot can do, and how to reach a person. That covers the commercial bot laws in California, Utah and Maine, FTC expectations and EU Article 50, and it costs nothing extra to show to everyone. If you run a companion-style product, add the companion-law extras: periodic reminders, protections for minors and crisis protocols.

Conferbot lets you set all of this on every plan, including Free: the bot's name and avatar, the opening message, a visible route to a human through live chat handover, and the responsible AI basics of logging and review.