Your Website Has an AI Chatbot. What Do You Have to Disclose?

An AI chat widget is now a default setting. It ships with the CRM, the help desk, the website builder. Someone turns it on, it starts answering customers, and nobody writes down what it is allowed to say or whether anyone has to be told it is not a person.

That last question has a legal answer in some situations and a contractual one in most of the rest. The two are frequently confused, and the confusion runs in a surprising direction: the statutory duty is narrower than people expect, and the exposure that actually bites is broader.

The California Rule Is Narrower Than Its Reputation

California’s bot statute is often described as requiring anyone using a chatbot to say so. It does not say that.

Cal. Bus. & Prof. Code § 17941(a) makes it unlawful to use a bot to communicate with a person in California online with the intent to mislead that person about the bot’s artificial identity, for the purpose of knowingly deceiving them about the content of the communication, in order to incentivize a purchase or sale of goods or services in a commercial transaction, or to influence a vote in an election.

Those elements stack. A support bot that answers billing questions without pretending to be human is not doing what the section describes. The statute is aimed at deception in service of a transaction, not at automation.

The same subsection then supplies the way out: “A person using a bot shall not be liable under this section if the person discloses that it is a bot.” Cal. Bus. & Prof. Code § 17941(a). Subsection (b) sets the standard for that disclosure — it must be “clear, conspicuous, and reasonably designed to inform persons with whom the bot communicates or interacts that it is a bot.” Cal. Bus. & Prof. Code § 17941(b).

A disclosure may eliminate liability under Section 17941 itself; it does not by its terms resolve obligations that may arise under other laws. That reading is consistent with Cal. Bus. & Prof. Code § 17942(a), which makes the chapter’s duties cumulative with duties imposed by other law.

That is the practical shape of the rule. Disclosure is not framed as an affirmative duty on every operator. It is framed as a defence, and it is inexpensive to take, which is why disclosing is a sensible default even for a business that would be unlikely to satisfy the statute’s intent elements.

Two structural points are easy to miss. “Bot” is defined as “an automated online account where all or substantially all of the actions or posts of that account are not the result of a person,” Cal. Bus. & Prof. Code § 17940(a) — so a hybrid queue where a human takes over is a different factual question than a fully automated one. And the chapter’s duties are expressly “cumulative with any other duties or obligation imposed by any other law,” Cal. Bus. & Prof. Code § 17942(a). Satisfying § 17941 settles § 17941. It settles nothing else.

A bill in the current session, AB 410, would amend §§ 17940, 17941 and 17942 and replace § 17943. As of this writing its last recorded action was in committee, held under submission on August 29, 2025. It is not law, and the sections above are the operative text.

Texas Regulates the Disclosure — For a Narrow Set of Deployers

Texas enacted the Responsible Artificial Intelligence Governance Act as HB 149 (89th Legislature, Regular Session). The governor signed it on June 22, 2025, and it took effect January 1, 2026.

Its disclosure provision, Tex. Bus. & Com. Code § 552.051, is more prescriptive than California’s — and it applies to fewer deployers. Subsection (b) requires a governmental agency that makes available an AI system intended to interact with consumers to disclose, before or at the time of interaction, that the consumer is interacting with an AI system. Subsection (f) applies the same disclosure to a provider of health care service or treatment where an AI system is used in relation to that service or treatment, no later than the date the service is first provided, with an exception for emergencies.

Where it applies, the drafting is strict. The disclosure is required “regardless of whether it would be obvious to a reasonable consumer” that they are dealing with an AI system, § 552.051(c). It must be clear and conspicuous, written in plain language, and must not use a dark pattern, § 552.051(d). It may be delivered by hyperlink to a separate web page, § 552.051(e).

For a private Texas company running a sales or support chatbot, § 552.051 is not the provision that governs. That is a real answer, and it is worth knowing before paying for a compliance exercise aimed at the wrong statute.

What Actually Creates Exposure for Most Companies

Neither statute is where most businesses get into trouble. Three other things are, and none of them depend on which state the customer sits in.

What the bot says about your product. The FTC’s position is that there is no AI exemption from the laws already on the books, and it has brought enforcement actions over deceptive claims made with and about AI tools. A chatbot is a sales channel. Representations it makes about pricing, results, capabilities or terms are your representations. A bot that improvises a discount, a service level or a refund policy has made a statement your company now has to deal with.

What the bot collects. A chat widget that takes a name, an email and a free-text description of the customer’s problem is collecting personal information, usually into a third-party processor. If your privacy policy does not describe that collection, the policy is now inaccurate — and an inaccurate privacy policy is a more common source of trouble than a missing bot disclosure. Check what the vendor stores, where, for how long, whether it trains on your conversations, and whether it uses its own subprocessors for error reporting or analytics.

What the bot promises on your behalf. This is the one that reaches contracts. If a bot tells an enterprise prospect that you support SSO, retain data for thirty days, or maintain a particular uptime, and your MSA says something else, you have created a gap between what you sold and what you signed. We have written separately about how those gaps open up in security questionnaires and what an SLA should actually promise. A chatbot is a new and fast way to generate the same problem, because nobody reviews what it said.

A Workable Standard, Regardless of State

Companies that handle this well do four things, and none of them require a legal opinion first.

Consider disclosing at the point of entry. One line, before the first exchange, can identify the assistant as automated rather than human. For California’s bot statute, a disclosure must be clear, conspicuous, and reasonably designed to inform the person that the interaction is with a bot.

Document what the bot may not discuss. Pricing outside a published range, legal or regulatory questions, security commitments, anything that sounds like a promise about the future. Route those to a human. The constraint list is the governance artefact; the disclosure is just the visible part.

Review the bot against your paper. Read what it says about your product next to your privacy policy, your terms, and your standard customer agreement. Where they disagree, one of them is wrong, and it is usually faster to fix the bot.

Confirm who reads the transcripts. A bot that collects a customer’s description of their problem has created a record. Someone should own it, know where it lives, and know how long it is kept.

Where This Usually Surfaces

Rarely at launch. It surfaces during an enterprise security review, when a customer asks what happens to chat data. It surfaces in diligence, when a buyer asks which third parties touch customer communications. And it surfaces when a customer points at a transcript and says: your website told me this.

The chatbot is a small piece of software with a large surface area. The work is not complicated, but it does have to be done deliberately, and it is far easier before the transcript exists.