The short answer: in a handful of states, yes, sometimes. Everywhere else, the law does not require it in so many words, but letting a customer believe they are chatting with a person when they are not is the kind of thing consumer-protection regulators call deception. The practical answer for almost every small business is the same either way: say it's a bot, at the start, in plain words.

The longer answer is worth a few minutes, because the headlines about “AI chatbot laws” mostly describe laws that will never touch the help widget on a plumbing company's website. If you know which laws are about which kind of bot, you can stop worrying about the wrong ones and get the right ones done in an afternoon.

Two different kinds of “chatbot law”

Most of the chatbot legislation of the past two years is aimed at companion chatbots: AI products designed to hold ongoing, personal, emotionally engaging conversations, often with teenagers. Those laws require suicide and self-harm protocols, break reminders for minors, content restrictions, and reporting. They were written with Character.AI and Replika in mind, not your appointment scheduler.

A much smaller set of laws is aimed at any bot that talks to consumers in a commercial setting, including customer-service bots. These are the ones that matter for a typical small business, and they are short: mostly a single disclosure duty.

Here is how the main laws sort out as of October 2026.

A few notes on those laws.

Maine is the cleanest model. It does not care whether the bot is generative AI or a 2015-era decision tree. If a reasonable consumer could think it is a person, you have to tell them it isn't. Because the remedy runs through Maine's Unfair Trade Practices Act, you should assume it carries the same exposure as any other deceptive practice in that state.

Utah is narrower than it looks. The 2024 version of Utah's law was broader; the 2025 amendments cut the general rule back to “disclose if asked.” A bot that answers “Are you a real person?” honestly satisfies the basic duty. If you are in a licensed profession (accountants, health care providers, and the like), the up-front disclosure rule for high-risk interactions is stricter. The statute also gives a safe harbor to businesses that disclose clearly at the start of the interaction and throughout.

California's new customer-service law is for big companies. AB 1609 was signed by Governor Newsom on September 28, 2026, according to the Governor's office. Bill trackers summarizing the enacted text report a threshold of more than $500 million in annual gross revenue, public-prosecutor enforcement, penalties of up to $5,000 for a first violation and $10,000 for later ones, and no private right of action. We have not been able to confirm the operative date from the chaptered text; California laws without a stated date generally take effect the following January 1. A small business is not covered, but this law is where customer expectations are headed: an honest label and a real way to reach a person.

Colorado is the one to watch. Unlike most companion-bot laws, HB 26-1263 does not, on its face, exclude customer-service bots. The Colorado Attorney General's proposed rules, filed August 11, 2026, would exempt bots handling a bounded task, such as a purchase-status update, a billing question, or scheduling, as long as they stay away from the content the law prohibits for minors. Those rules are not final. If you serve Colorado consumers with a free-ranging generative AI assistant, assume the disclosure duty applies to you from January 1, 2027.

The federal backstop: deception is deception

No federal statute requires a website chatbot to identify itself. But Section 5 of the Federal Trade Commission Act prohibits “unfair or deceptive acts or practices in or affecting commerce,” and the FTC has addressed bots that pass as people. In 2023, the FTC stated in a business guidance post that “people should know if they're communicating with a real person or a machine.” (FTC Business Blog, May 1, 2023, archived copy. The FTC has since removed the post from its website, so treat it as the agency's 2023 position, not necessarily its current guidance.)

Every state also has its own consumer-protection statute modeled on Section 5. In states with no chatbot-specific law, a bot that claims to be “Jessica from our support team” and lets the customer believe it is a person is a deception claim waiting for a plaintiff or an attorney general. That is the real reason to disclose everywhere, not just in Maine.

A related risk: chat transcripts and wiretap claims

Disclosure laws are about what the bot says about itself. A separate line of litigation is about what happens to the conversation. Plaintiffs have sued businesses under California's Invasion of Privacy Act (CIPA), a 1967 wiretap statute with statutory damages of up to $5,000 per violation, arguing that the third-party vendor running a website chat feature is an unauthorized eavesdropper on the customer's conversation with the business.

The results are mixed. In Ambriz v. Google (N.D. Cal., February 2025), a federal court let a CIPA claim over Google's customer-service AI proceed, reasoning that the vendor's technical capability to use the call data for its own purposes was enough at the pleading stage. In Gutierrez v. Converse (9th Cir., July 2025), the Ninth Circuit affirmed judgment for the business because the plaintiff had no evidence the chat vendor actually read or used the messages. In other words, these suits can survive a motion to dismiss and still lose on the evidence, which is an expensive way to win.

California's SB 690, signed September 30, 2026, cut off private suits under one CIPA provision (the pen-register section) for website and app conduct. It does not touch the wiretap section these chat cases rely on. If your chat vendor uses transcripts to train its models, the risk is real, and a clear notice at the start of the chat that the conversation is recorded and shared with a service provider is cheap insurance.

A typical scenario

Consider a three-location home-services company that put a generative AI assistant on its website last spring. The vendor's default persona introduced itself with a first name and a stock photo of a smiling woman in a headset. Nobody at the company thought twice about it until a customer in Maine, angry about a missed appointment, posted a screenshot of the exchange alongside the line “I asked for a manager three times and it turned out I was arguing with software.”

There was no lawsuit. There was a fast meeting. The fix took less than a day: new greeting (“Hi, I'm the automated assistant for [company]. I can book, reschedule, and answer common questions. Type 'person' anytime to reach our team.”), a real handoff to the office during business hours, and a one-line recording notice. The owner's takeaway is the right lesson: the label cost nothing, and the fake person cost the company a customer and a week of reputational cleanup.

The five-point checklist

This checklist meets or exceeds every state rule in the list above for an ordinary small business, and it addresses the FTC deception risk at the same time.

  1. Disclose at the start of the chat. First message, plain words: “I'm an automated assistant,” not a name and headshot. This satisfies Maine, Utah's safe harbor, and the likely Colorado rule all at once.
  2. Answer honestly if asked. Configure the bot so that “Are you a real person?” always gets a truthful answer, even mid-conversation. Test it. Generative models can be talked into role-play.
  3. Offer a way to reach a human. A keyword, a button, or a callback form. You are not under AB 1609's time limits unless you are a $500 million company, but a dead end is what turns an annoyed customer into a complaint.
  4. Tell people the conversation is recorded. A short notice that the chat is logged and handled by a service provider, linked to your privacy policy. This is your best practical defense to the wiretap theory.
  5. Fix the vendor contract. Before you sign, confirm the vendor (a) lets you control the bot's greeting and persona, (b) limits its own use of your transcripts (especially for model training), (c) tells you where transcripts are stored and for how long, and (d) supports a human handoff.

One boundary worth drawing clearly: disclosure solves the “is it a bot?” problem. It does nothing for the “the bot promised a refund we don't offer” problem. A label does not let you disown what your chatbot tells a customer about prices, policies, or products. That is a separate question, covered in when your business is liable for what its AI says.

Frequently Asked Questions

We are a small business outside Maine, Utah, California, and Colorado. Do we need to disclose?

No statute in your state may require it today, but your customers may be in those states, and the FTC Act and your own state's consumer-protection law still prohibit deception. Disclosing costs one sentence. Not disclosing is the only option with downside.

Does a scripted, non-AI chatbot count?

Under Maine's law, yes: it covers any software that simulates human conversation. Utah's rule is limited to generative AI. Colorado's covers AI systems that primarily simulate conversation. The safe practice does not depend on the technology.

Is a disclaimer buried in our terms of service enough?

No. Maine requires clear notice, and Utah's safe harbor requires clear and conspicuous disclosure at the outset. Put the disclosure in the chat window itself.

Our bot only books appointments. Is it a “companion chatbot” under California SB 243?

Almost certainly not. SB 243 excludes bots used only for customer service or business operations. Some practitioners caution that a support bot that remembers past conversations and builds a personal rapport with users could drift toward the companion definition, but a scheduling bot is nowhere near that line.

For ongoing tracking

State chatbot rules are still being written, including Colorado's final rules. We track changes at silvertonpublishing.com/ai-current.

For related rules, see Connecticut's 2026 AI law, which includes AI companion requirements, and the EU AI Act's chatbot disclosure duty for businesses with EU customers.

This article reflects state and federal chatbot disclosure law as of October 2026. New state laws and rules in this area are arriving every legislative session. Confirm the current rules in the states where your customers live before relying on it. Nothing in this article is legal advice for your specific situation.

This article is for educational purposes only and does not constitute legal, tax, or financial advice. Consult a qualified professional for guidance specific to your situation.