California Bot Disclosure Law: SB 1001 Chatbot Reference

TL;DR: California's bot disclosure law (SB 1001, Business and Professions Code sections 17940 to 17943) makes it unlawful to use a bot that hides being a bot in order to push a sale or sway a vote, and it gives a safe harbour to anyone who discloses clearly that it is a bot. The simplest way to comply is to label the chatbot as AI from the first message. LuckPanda Chatbot does that by default: every reply carries an "AI" label you cannot switch off.

Build a chatbot from your website for free with LuckPanda Chatbot

The California bot disclosure law has been operative since July 1, 2019. It applies to an automated online account that talks to a person in California with the intent to mislead them about its artificial identity, so as to knowingly deceive them about the content of the conversation in order to encourage a purchase or sale of goods or services, or to influence a vote in an election. A business is not liable under the section if it discloses that the bot is a bot, and that disclosure must be "clear, conspicuous, and reasonably designed to inform" the person. For a sales chatbot on a business website, that means: say it is AI, say it early, and say it where the visitor actually looks.

This page is information, not legal advice. It quotes the statute as published on the California Legislative Information site (read November 14, 2026) and the EU AI Act Article 50 text, and it adds the 2025 companion chatbot law, SB 243, which most older law-firm write-ups predate.

SB 1001 quick reference table

What does the California bot disclosure law require?

The law requires one thing: do not use a bot that pretends to be human to push a commercial transaction or a vote. Section 17941(a) reads, in full:

"It shall be unlawful for any person to use a bot to communicate or interact with another person in California online, with the intent to mislead the other person about its artificial identity for the purpose of knowingly deceiving the person about the content of the communication in order to incentivize a purchase or sale of goods or services in a commercial transaction or to influence a vote in an election. A person using a bot shall not be liable under this section if the person discloses that it is a bot."

Four elements stack up before the ban applies:

1. A bot: an automated online account where all or substantially all of what it does is not done by a person.
2. Talking to a person in California, online.
3. With intent to mislead about being artificial, to knowingly deceive about what is being said.
4. To encourage a purchase or sale, or to influence a vote.

The safe harbour sits at the end of the same sentence. If you disclose that it is a bot, the section does not make you liable. That is why every practical guide on this law ends at the same place: disclose, and the question of intent rarely matters.

Does it apply to customer service chatbots?

Yes, when the chatbot sells. Section 17941 is about bots that "incentivize a purchase or sale of goods or services in a commercial transaction". A website chatbot that recommends a plan, quotes a product or books a demo is doing exactly that, so it falls inside the scope. A bot that only answers "where is my order" is a weaker fit, but it is still a bot under section 17940(a), and many support chats turn into sales chats within two messages.

Three points that often get missed:

• Size does not matter for the ban. Section 17940(c) defines an "online platform" as one with 10,000,000 or more unique monthly US visitors, but section 17941 applies to "any person" who uses a bot. The 10 million figure only matters for section 17942(c), which says the chapter puts no duty on platform service providers such as web hosts. A small business website with a chatbot is not exempt because it is small.
• You are the one using the bot. The business that puts a chatbot on its site is the "person" using it, not the chatbot vendor or the host.
• Where the visitor is decides it. The law covers interacting "with another person in California". A business in Texas, Germany or India whose website gets California visitors is in scope for those chats.

What counts as a clear and conspicuous disclosure?

A clear and conspicuous disclosure is one a reasonable visitor sees and understands before the conversation can mislead them. The statute does not define the phrase further; section 17941(b) only adds that it must be "reasonably designed to inform persons with whom the bot communicates or interacts that it is a bot". In practice that rules out a line in the privacy policy, a tooltip on hover, or a disclosure that appears only after the visitor asks "are you human?".

Human personas are the main trap. A bot called "Emma" with a headset photo is fine if every reply is marked as AI. The same bot with no label, telling a visitor it will "check with the team" as if it were the team, is the scenario the law was written for.

What should a chatbot disclosure message say?

A chatbot disclosure message should say three things in one or two sentences: it is an AI assistant, what it answers from, and that a person is available. Copy-ready lines (adapt the business name):

Keep the line in the visitor's language: a disclosure the visitor cannot read is not reasonably designed to inform them.

How LuckPanda Chatbot handles bot disclosure

LuckPanda Chatbot is built so a business does not have to remember to disclose. From the product's feature reference:

• "AI" label you cannot turn off. Visitors always see an "AI" label beside the persona's name, in the header and on each reply, and screen readers are told "AI assistant named ...". This works even when you pick one of the nine preset persona faces or upload your own photo.
• People are shown as people. When a teammate takes over a chat, their own name is shown without the AI label, so the visitor always knows who is talking. The bot stays quiet while the person has the chat.
• Your own greeting. The greeting is free text up to 300 characters, and you can set different greetings for up to 10 page paths, so the disclosure line can open every chat.
• Answers only from your content. It answers from your pages and documents, says so when the answer is not there and offers to pass the chat to a person. It does not browse the web or guess prices and policies, which also keeps it away from deceptive claims.
• Every chat saved word for word, with the page it started on, so you have a record of what the bot said if a question ever comes up.

Pricing: setting up and testing are free, and the preview reads up to 30 pages without an account. Putting it on a website costs $4.99/month or $44.91/year, tax included, for up to 10 websites (India: ₹199/month or ₹1,791/year). An unsaved preview answers up to 20 questions and is kept for 7 days. AI replies use tokens: 10,000 free tokens once per business, then one-time credit packs that never expire. More on how it handles data is on the Chatbot security page.

Is there a penalty for violating the California bot law?

Chapter 6 does not set its own penalty or create a private right to sue. Violations are generally pursued as unfair competition under California's Unfair Competition Law, where section 17206(a) allows a civil penalty of up to $2,500 for each violation in an action brought by the Attorney General, a district attorney, certain county counsel or a city attorney of a city over 750,000 people. Because a chatbot can hold thousands of conversations, "per violation" can add up: if each misleading chat were counted separately, 100 chats at $2,500 per violation would be up to $250,000, and 1,000 chats up to $2,500,000. Section 17942(a) also keeps every other law in play, such as false advertising rules.

What is SB 243, the 2025 companion chatbot law?

SB 243 (Padilla) is a separate California law, approved by the Governor on October 13, 2025, that adds Business and Professions Code sections 22601 and onward for companion chatbots: AI systems that give adaptive, human-like responses, can meet a user's social needs and sustain a relationship across multiple interactions. It requires a clear and conspicuous notice that the chatbot is artificially generated and not human if a reasonable person would be misled (section 22602(a)), a reminder at least every 3 hours for users known to be minors, a suicide and self-harm protocol, annual reports from July 1, 2027, and it lets an injured person sue for the greater of actual damages or $1,000 per violation (section 22605).

For a business website chatbot the key line is the exclusion in section 22601(b)(2)(A): a companion chatbot "does not include" a bot "used only for customer service, a business' operational purposes, productivity and analysis related to source information, internal research, or technical assistance." A sales and support bot on your website is normally outside SB 243, but still inside SB 1001.

What does the EU AI Act require for chatbots?

The EU AI Act requires chatbots that talk directly with people to tell them they are interacting with an AI system, from August 2, 2026. Article 50(1) puts the duty on providers: AI systems "intended to interact directly with natural persons" must be designed so the people concerned "are informed that they are interacting with an AI system", unless that is obvious to a reasonably well-informed, observant and circumspect person. Article 50(5) adds that the information must be given "in a clear and distinguishable manner at the latest at the time of the first interaction" and meet accessibility requirements.

Fines for breaking Article 50 reach up to EUR 15,000,000 or 3% of worldwide annual turnover, whichever is higher, under Article 99(4)(g). Unlike California, there is no intent element: the EU duty applies whether or not anyone meant to deceive. A business selling to both California and the EU can meet both with the same setup: an AI label visible from the first message, in the visitor's language, readable by screen readers.

Compliance checklist for a website sales chatbot

• Label the bot as AI in the chat header and on every reply.
• Open every chat with a disclosure line, in the visitor's language.
• Never let the bot claim to be human; script the "are you human?" answer.
• If you use a persona name or photo, keep the AI label next to it.
• Show human agents under their own name when they take over.
• Keep transcripts so you can show what the bot said, and spot-check 10 per week to see the disclosure shows up.
• Point the bot only at your own content so it does not invent prices or policies. See how chatbot human handoff works and what to look for in an AI chatbot for a small business.

Need a privacy policy that mentions your chatbot? The free privacy policy generator gives sourced notes by country (not legal advice).