AI chatbot disclosure: the chat is not a person

If a website offers chat or a voice assistant, a visitor should be able to tell, before they rely on it, that they are not talking to a person. AI chatbot disclosure is that plain statement. It is not a nationwide US labeling code, and it is not a reason to throw out a contact form. In California, using a bot to mislead a person in the state about its artificial identity, in order to deceive them about the content and push a purchase, a sale, or a vote, is unlawful unless the user of the bot discloses that it is a bot [1]. The Federal Trade Commission has long treated a material omission that is likely to mislead a reasonable consumer as deception under the FTC Act [2].

This is not legal advice for a particular widget.

When a notice is actually required

No single federal statute says every website chatbot in the United States must wear a label. Hiding a human-sounding assistant, or labeling every scripted FAQ, both misread the texts that do exist.

California's bot law, and who it covers

The clearest US statute is California's, and it applies in California. Business and Professions Code sections 17940 through 17943 became operative on July 1, 2019 [1]. Section 17941 makes it unlawful for any person to use a bot to communicate or interact with another person in California online, with the intent to mislead that person about the bot's artificial identity, for the purpose of knowingly deceiving them about the content of the communication in order to incentivize a purchase or sale of goods or services in a commercial transaction or to influence a vote in an election [1]. "Person" includes a corporation and other legal entities, not only a human owner [1]. The other party is a person in California. A Charlotte company that chats with California customers is inside that set of facts. A company that does not should not treat the text as a national rule [1].

"Online" includes a public-facing internet website, web application, or digital application [1]. "Bot" means an automated online account where all or substantially all of the actions or posts of that account are not the result of a person [1]. A button that only opens a phone number, or a form that only emails a person, is not automatically that account. A tool that carries the conversation, with substantially no person behind the replies, is much closer. Whether a given widget fits is a facts question.

The prohibition is not "every bot must always confess." It requires that intent and that commercial or electoral purpose [1]. A person using a bot is not liable under that section if the person discloses that it is a bot [1]. The disclosure must be clear, conspicuous, and reasonably designed to inform the people the bot communicates with that it is a bot [1]. The chapter does not impose this duty on web hosts or internet service providers [1]. The business using the bot is the one the section addresses. Duties under the chapter are cumulative with any other law, so meeting section 17941 does not erase a deception claim or a sector rule [1].

The federal hook is deception, not a bot code

The federal piece is the FTC Act's ban on deceptive acts or practices, not a bot-labeling code. In a policy statement dated October 14, 1983, and appended to Cliffdale Associates, the Commission stated a three-part test [2]. There must be a representation, omission, or practice likely to mislead the consumer. The Commission judges it from the standpoint of a consumer acting reasonably in the circumstances. And it must be material, meaning likely to affect the consumer's conduct or decision about a product or service [2]. The Commission will find deception if that representation, omission, or practice is likely to mislead the reasonable consumer, to the consumer's detriment [2].

The statement says most deception involves misrepresentations or omissions of material information, and that some cases turn on information that must be disclosed so a claim, practice, or sale is not misleading [2]. The Commission looks at the whole transaction and the net impression [2]. Materiality can sometimes be presumed from the practice and sometimes needs evidence [2]. That is not a rule that every undisclosed chat box is illegal. A flat, mechanical reply may not lead a reasonable visitor to think a person is typing. A staff first name, a staff photo, a typing pause, and "let me check with my manager" can. If that impression is likely to change whether the visitor buys, shares a card number, or treats the reply as the company's word, the omission is in the territory the 1983 statement describes [2].

On September 25, 2024, the FTC announced Operation AI Comply, five actions against operations that used AI hype or sold AI tools that could be used in deceptive and unfair ways [3]. Chair Lina M. Khan said, "Using AI tools to trick, mislead, or defraud people is illegal," and that there is no AI exemption from the laws on the books [3]. One matter, DoNotPay, was not a hidden-identity case. The company marketed "the world's first robot lawyer" and claimed the service could substitute for a human lawyer. The FTC said the product did not live up to those claims, that the company had not tested whether the chatbot's output was equal to the level of a human lawyer, and that it had not hired or retained attorneys to check the law-related features [3]. Telling people a tool is software does not excuse a false claim about what it can do. Calling a tool AI does not excuse a design that tricks someone about who is speaking.

The EU rule, labeled as EU law

The EU has a direct interaction rule. It is not North Carolina law. Article 50(1) of Regulation (EU) 2024/1689, in the EUR-Lex consolidated text dated 27 July 2026, says providers shall ensure that AI systems intended to interact directly with natural persons are designed so those persons are informed they are interacting with an AI system, unless this is obvious to a reasonably well-informed, observant, and circumspect person, given the context [4]. Article 50(5) says the information in paragraphs 1 to 4 must be clear and distinguishable at the latest at the first interaction or exposure, and must conform to applicable accessibility requirements [4]. EUR-Lex says the consolidation is a documentation tool and has no legal effect of its own. The authentic acts are in the Official Journal [4].

Consolidated Article 113 says the Regulation applies from 2 August 2026, with other dates for other chapters. Chapter IV, where Article 50 sits, is not given a different start in that list [4]. Article 111(4) gives providers of systems that generate synthetic audio, image, video, or text, if those systems were placed on the market before 2 August 2026, until 2 December 2026 to comply with the machine-readable marking duty in Article 50(2) [4]. That grace period does not delay the interaction notice in Article 50(1). The European Commission's FAQ, updated 24 July 2026, says the same: Article 50 applies from 2 August 2026, and the grace period covers only Article 50(2) marking for systems already on the market [5].

The FAQ describes four conditions for that interaction duty: the system is an AI system, it is built for a genuine two-way exchange rather than merely collecting data or providing automated responses, the interaction is direct, and the other party is a natural person [5]. The FAQ says to read the "unless obvious" exception narrowly, because it removes transparency [5].

Article 2 covers providers placing AI systems on the Union market or putting them into service there, even if the provider is in a third country; deployers in the Union; and providers and deployers in a third country where the system's output is used in the Union [4]. A Charlotte business with only US customers is not inside that text merely because it has a chat box. If people in the Union use the output, Article 2(1)(c) is the clause to read, and it is still EU law [4].

What a clear notice looks like

Where a notice is required, the texts describe its quality, not a magic sentence. California wants it clear, conspicuous, and reasonably designed to inform the person in the conversation that it is a bot [1]. Where Article 50 applies, it must be clear and distinguishable at the first interaction, and in line with applicable accessibility requirements [4]. Where the FTC question is a misleading impression, the qualifying information has to fix that impression for a reasonable consumer across the whole transaction [2].

Put the words where the conversation is. The first line in the panel should say, in ordinary language, that the visitor is talking with an automated assistant and not a person. "This is an automated assistant. You are not chatting with a staff member." is understandable. "AI-enabled conversational experience" is not. If the assistant speaks, say it out loud before it asks for a name, an order, or a payment detail. A page banner does not inform someone who only hears the voice. A privacy policy three links away does not inform someone who thinks they reached the front desk [1].

Do not let the rest of the window contradict the sentence. A human first name, a photo of a real employee, and a pause that looks like typing can sit beside a clear label. They are a problem when they are the only signal, because that signal says "person" [2]. If a person joins the thread, say so. If the assistant returns, say that too. A disclosure that stops being true is no longer reasonably designed to inform.

Keep identity separate from ability. The DoNotPay action is about capability claims, not a missing label [3]. If the assistant sounds like it is giving legal, medical, financial, or licensing advice, say it is not a licensed professional and that the reply is not a substitute for one, unless you can support a stronger claim. Then read the live widget on a phone, and with a screen reader, after every vendor change. California does not put this chapter's duty on the host [1]. The vendor's default subtitle is not automatically clear or conspicuous.

Do not use the EU "unless obvious" exception unless a reasonably observant person would already know, without guessing, that no person is on the other side [4][5].

The trust problem a hidden bot creates

Those legal tests are triggers. The trust problem shows up even when no statute is triggered.

A visitor decides what to share based on who they think is listening. Someone who believes they reached the office may describe a billing dispute, a health detail, or a card number in a chat they would not have put on a form. Someone who believes a staff member answered may treat a price, a date, or a "yes, we can do that" as the company's promise. If the speaker was software, the business still has to live with what the customer heard. A label does not make the answer correct. It tells the visitor how much weight to give it, and whether to ask for a person first.

NIST's AI Risk Management Framework 1.0, released January 26, 2023, is voluntary. It is not a disclosure statute, and NIST has said the 1.0 text is being revised [6]. Its definition of transparency still describes what a hidden bot withholds. Transparency reflects the extent to which information about an AI system and its outputs is available to people interacting with that system, regardless of whether they even know they are doing so [7]. NIST says meaningful transparency increases confidence, and that a transparent system is not necessarily an accurate, privacy-enhanced, secure, or fair one [7].

None of this means a contact form is obsolete, or that every business should add chat. A form and a phone number already show what kind of contact is starting. Chat and voice are different because they can imitate a person. If you do not want that risk, do not imitate a person. If you want the assistant, say what it is.

Practical takeaways

• Put a plain sentence in the chat window, or in the first spoken turn, that the visitor is dealing with an automated assistant and not a person. Do not leave it only in a policy page.
• Treat California sections 17940 to 17943 as California law about misleading a person in California for a purchase, sale, or vote. The safe harbor in section 17941 is a disclosure that is clear, conspicuous, and reasonably designed to inform [1].
• For the federal question, use the FTC's 1983 test: a material omission that is likely to mislead a reasonable consumer can be deception. A 2024 Commission statement says there is no AI exemption from laws against misleading people [2][3].
• Do not apply the EU AI Act to a US-only audience. Where Article 50 applies, the interaction notice is due at the first interaction unless it is truly obvious. The marking grace period is a different duty [4][5].
• Do not let a human name, a staff photo, or a typing pause be the only clue. If a person takes over, or the bot returns, say so.
• Do not claim the assistant replaces a licensed person unless you can support that claim. Identity and capability are separate problems [3].
• Re-read the live widget after vendor changes, on a phone and with a screen reader. Keep a real path to a person. Chat does not have to replace the form.

How we can help

Have more questions or want to get in touch? Our team helps businesses and agencies look at what a site actually tells a visitor, including when a chat or voice assistant is software rather than staff. Contact IDFS AI and describe the chat you have now. We will help you sort out what the page should say.

Citations

1. California Legislative Information, "Business and Professions Code, Chapter 6. Bots (sections 17940-17943)" (2019)
2. Federal Trade Commission, "FTC Policy Statement on Deception" (1983-10-14)
3. Federal Trade Commission, "FTC Announces Crackdown on Deceptive AI Claims and Schemes" (2024-09-25)
4. EUR-Lex, "Consolidated text of Regulation (EU) 2024/1689 (Artificial Intelligence Act)" (2026-07-27)
5. European Commission, "Transparency obligations under Article 50 of the AI Act" (2026-07-24)
6. National Institute of Standards and Technology, "AI Risk Management Framework" (2023-01-26)
7. NIST AI Resource Center, "3 AI Risks and Trustworthiness" (2023)