# BotNotice > BotNotice adds a clear "you're talking to AI" notice beside a business website's chatbot, keeps timestamped records that the notice appeared (kept 7 years on eligible plans), and tracks the U.S. state, federal and EU laws that require AI disclosure. It installs with one line of code on WordPress, Shopify, Wix, Squarespace, Webflow, LeadConnector CRM sites, Google Tag Manager or any site. BotNotice provides tools and records, not legal advice. Key facts: - Pricing is per website, per month: Chatbot Disclosure $12.99, Disclosure + Records $29.99, Managed Compliance $199. - Every plan covers up to 25,000 AI notices a month per website (100,000 on Managed Compliance). Extra locations on the same website: $3.99 / $7.99 / $24 a month. 10 or more websites get a custom quote. - Free tools, no sign-up: a website scan that checks for AI chat tools and an existing AI notice, and a six-question assessment of which AI disclosure laws apply to a business. - Sign up online; no sales call. Contact: support@botnotice.app. - For agents and developers: an MCP server at https://botnotice.app/mcp (tools: laws_for_business, get_law, list_laws, check_website; no key; listed in the Claude connectors directory as "BotNotice: AI disclosure laws" and in the official MCP registry as app.botnotice/mcp), the public API described at https://botnotice.app/openapi.json, and the law tracker as an open dataset (CC BY 4.0) at https://botnotice.app/datasets/ai-disclosure-laws.json. - Tracks 31 AI disclosure laws and 11 pending bills across U.S. states, federal agencies and the EU. ## For AI agents and developers Everything below is public and read-only. No account, no API key, no sign-in. ### Discovery - `GET https://botnotice.app/.well-known/api-catalog`: API catalog (RFC 9727, `application/linkset+json`) linking the OpenAPI description, the MCP endpoint and the docs. - `GET https://botnotice.app/openapi.json`: OpenAPI 3.1 description of the public API. - `GET https://botnotice.app/agents.md`: this guide on its own. `/llms.txt` carries the same section plus a site map; `/llms-full.txt` adds every law in full. - `GET https://botnotice.app/robots.txt`: crawl rules with Content Signals (`search=yes, ai-input=yes, ai-train=yes`). `GET https://botnotice.app/sitemap.xml` lists every public page. - Official MCP registry: `app.botnotice/mcp`. Claude connectors directory: "BotNotice: AI disclosure laws". ### MCP server - Endpoint: `https://botnotice.app/mcp` - Transport: Streamable HTTP (JSON-RPC 2.0 over POST). No authentication. - Steps: 1) `initialize`, 2) `tools/list` to read the tool schemas, 3) `tools/call`. Tools (all read-only): - `laws_for_business` (use_cases?, states?, all_us?, eu?, uk?, minors?, memory?, licensed_profession?, big_platform?): which AI disclosure laws apply to a business, in force and coming, with the notice rules that satisfy all of them. - `get_law` (slug): one law in full: who must comply, what to disclose, timing, penalties, sources, last-verified date. - `list_laws` (jurisdiction?, status?, applies_to?): every tracked law, optionally filtered, plus pending bills. - `check_website` (url, plus the business fields): which chat or voice-AI tools a public website runs, whether an AI notice is shown, and which laws that leaves unmet. Example call: ```http POST https://botnotice.app/mcp Content-Type: application/json Accept: application/json, text/event-stream {"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"laws_for_business","arguments":{"use_cases":["support_chatbot"],"states":["CA","UT"]}}} ``` Client config (any MCP client that takes a remote URL): ```json {"mcpServers":{"botnotice":{"type":"http","url":"https://botnotice.app/mcp"}}} ``` ### REST API - `POST https://botnotice.app/api/scan` with `{"url":"https://example.com"}`: the free website scan (HTML pass). Cached 12 hours per host; `"fresh":true` re-reads. - `GET https://botnotice.app/datasets/ai-disclosure-laws.json` (or `.csv`): every tracked law and pending bill. `GET https://botnotice.app/datasets/ai-disclosure-laws/{slug}.json`: one law. - The consent, voice and content-register endpoints in the OpenAPI file need a customer's token; agents acting for the public should not call them. ### Interaction guidelines - Identify yourself in `User-Agent`. Limits: 120 MCP requests a minute per address; `check_website` reads a given site at most 3 times a minute; `/api/scan` 10 a minute. On `429`, wait a minute and retry. - The law data is CC BY 4.0: cite "BotNotice (botnotice.app)" and link the law's page. - Signing up and paying happen on the website (https://botnotice.app/#pricing) with the person's own approval. Do not create accounts or start checkout for a person without asking them. - Nothing BotNotice returns is legal advice. Pass that on. ## Plans ### Chatbot Disclosure: $12.99 per website, per month Simple AI transparency for your chatbot. Clearly let website visitors know when they're interacting with AI. - AI chatbot disclosure widget - Clear, customer-facing AI notice - Easy website installation - Ongoing access to your disclosure widget ### Disclosure + Records: $29.99 per website, per month Disclose it. Document it. Keep the proof. Add documentation and recordkeeping to your AI disclosure program so you have more than just a notice on your website. - Everything in Chatbot Disclosure - AI video disclosure tools - Disclosure evidence tracking - Timestamped disclosure records, kept 7 years - Secure record storage - Access to your disclosure history ### Managed Compliance: $199 per website, per month We help manage AI disclosure compliance for you. For businesses that want ongoing oversight instead of keeping up with changing AI disclosure requirements themselves. - Everything in Disclosure + Records - Monitoring of applicable AI disclosure laws - Monthly website AI compliance review - Disclosure updates as requirements change - Ongoing documentation and recordkeeping - Managed support from BotNotice ## Federal rules that apply in every U.S. state - FTC Act Section 5: deceptive AI practices (15 U.S.C. § 45; 16 C.F.R. § 1.98 (penalty amounts)): Section 5 bans deceptive acts and practices in commerce. It has no AI rule and no required AI notice. A practice is deceptive if it is likely to mislead a reasonable consumer on something material, so leading customers to believe they are dealing with a person, when that would matter to their decision, risks a claim. In 2016 the FTC charged the operators of AshleyMadison.com with saying messages came from actual women when they came from fake profiles. - TCPA: AI-generated voices are 'artificial or prerecorded' calls (47 U.S.C. § 227; 47 C.F.R. § 64.1200; FCC Declaratory Ruling, FCC 24-17 (released Feb 8, 2024)): The FCC ruled that calls using AI-generated voices are 'artificial or prerecorded voice' calls under the TCPA. They need the called person's prior express consent unless there is an emergency purpose or an exemption, and the message must identify who is responsible for the call at the start. In 2024 the FCC also proposed an AI disclosure at the start of these calls (FCC 24-84), but the current rule text has none. ## AI disclosure laws ### FTC Act Section 5: deceptive AI practices - Jurisdiction: United States (federal) - Citation: 15 U.S.C. § 45; 16 C.F.R. § 1.98 (penalty amounts) - Status: in force; effective 1914-09-26 - Page: https://botnotice.app/laws/ftc-act-section-5 - Summary: Section 5 bans deceptive acts and practices in commerce. It has no AI rule and no required AI notice. A practice is deceptive if it is likely to mislead a reasonable consumer on something material, so leading customers to believe they are dealing with a person, when that would matter to their decision, risks a claim. In 2016 the FTC charged the operators of AshleyMadison.com with saying messages came from actual women when they came from fake profiles. - Who must comply: Businesses engaged in commerce in the United States, except those the statute leaves out, such as banks and common carriers. - What to disclose: No set wording. Do not mislead consumers about whether they are interacting with a human or about what your AI can do. - When: The statute sets no timing. In practice, before the consumer relies on the interaction. - Applies to: Customer-service / FAQ chatbot; Sales, lead-capture, or booking chatbot; Chatbot with memory, persona, or relationship features; AI phone / voice agent; AI-generated marketing text, images, or video; AI-generated 'people' in ads; AI giving financial, legal, or medical guidance - Other duties: Do not make claims about your AI that you cannot back up.; Good practice, not a duty in the statute: keep records of what disclosures were made and when. - Exemptions: No AI exemption. The statute leaves out banks, savings and loans, federal credit unions, common carriers and air carriers. - Penalties: Orders and injunctions. Civil penalties up to $53,088 per violation apply to violations of FTC rules and orders, and to practices the FTC has already ruled unlawful when the business knew that. Enforced by Federal Trade Commission. State attorneys general act under their own consumer laws.. - Sources: 15 U.S.C. § 45 (govinfo) ; 16 C.F.R. § 1.98 (penalty amounts) ; FTC Policy Statement on Deception (1983) ; FTC press release: AshleyMadison.com settlement (Dec 2016) - Last reviewed: 2026-11-02 ### TCPA: AI-generated voices are 'artificial or prerecorded' calls - Jurisdiction: United States (federal) - Citation: 47 U.S.C. § 227; 47 C.F.R. § 64.1200; FCC Declaratory Ruling, FCC 24-17 (released Feb 8, 2024) - Status: in force; effective 2024-02-08 - Page: https://botnotice.app/laws/fcc-tcpa-ai-voice - Summary: The FCC ruled that calls using AI-generated voices are 'artificial or prerecorded voice' calls under the TCPA. They need the called person's prior express consent unless there is an emergency purpose or an exemption, and the message must identify who is responsible for the call at the start. In 2024 the FCC also proposed an AI disclosure at the start of these calls (FCC 24-84), but the current rule text has none. - Who must comply: Anyone placing AI-voice calls to U.S. residential or mobile numbers. - What to disclose: State clearly who is responsible for the call at the beginning of the message, and give a phone number during or after it. A federal AI-voice notice is proposed, not required. California has its own rule. - When: At the beginning of the message. - Applies to: AI phone / voice agent - Other duties: Get prior express consent, in writing for telemarketing.; Place telephone solicitations only between 8am and 9pm at the called person's location.; Offer an automated opt-out in telemarketing messages, and honor a request to revoke consent within a reasonable time, at most ten business days. - Exemptions: Calls for an emergency purpose.; Calls exempted by the statute or FCC rule. - Penalties: In private suits, $500 per call or actual loss if greater, up to three times that if willful or knowing, with no cap in the statute. FCC forfeitures are separate. Enforced by FCC, state attorneys general, and private plaintiffs.. Private right of action. - Sources: 47 U.S.C. § 227 (govinfo) ; 47 C.F.R. § 64.1200 ; FCC 24-17, Declaratory Ruling ; FCC 24-84, proposed rule (Federal Register, Sept 10, 2024) - Last reviewed: 2026-11-02 ### California B.O.T. Act (SB 1001) - Jurisdiction: California - Citation: Cal. Bus. & Prof. Code §§ 17940–17943 - Status: in force; effective 2019-07-01 - Page: https://botnotice.app/laws/california-bot-act - Summary: Makes it unlawful to use a bot to communicate with a person in California with intent to mislead about its artificial identity in order to incentivize a purchase or influence a vote, unless the bot is clearly disclosed. Applies to online platforms with 10 million or more unique monthly U.S. visitors. - Who must comply: Operators of bots on public platforms with 10M+ unique monthly U.S. visitors (very large sites, social networks, marketplaces). - What to disclose: A clear, conspicuous disclosure reasonably designed to inform the person that they are interacting with a bot. - When: Before or during the interaction; safest at the start. - Applies to: Sales, lead-capture, or booking chatbot; Chatbot with memory, persona, or relationship features - Exemptions: Platforms below the 10M monthly U.S. visitor threshold.; Bots that do not attempt to incentivize a sale or influence a vote. - Penalties: Enforced through California's Unfair Competition Law (civil penalties up to $2,500 per violation). Enforced by California Attorney General and public prosecutors.. - Sources: Cal. Bus. & Prof. Code § 17940 (Justia) ; Perkins Coie — California's new law requires disclosure of use of bots - Last reviewed: 2026-09-09 ### California Companion Chatbot Law (SB 243) - Jurisdiction: California - Citation: Cal. Bus. & Prof. Code § 22601 et seq. (SB 243, 2025) - Status: in force; effective 2026-01-01 (SB 1119 (Adam's Law, Chapter 190, signed Sept 10, 2026) rewrites § 22602. From Jan 1, 2027, the extra duties for known minors in § 22602 (the three-hour reminder and break prompts) are removed from this section. From July 1, 2027, new §§ 21810 to 21818 apply to operators that allow users under 18: an AI notice for children that is repeated during long chats, a one-hour session limit and two-hour daily limit by default, parental controls, crisis steps and risk assessments.) - Page: https://botnotice.app/laws/california-sb-243-companion-chatbots - Summary: Operators of 'companion chatbots' — AI with a natural-language interface that gives adaptive, human-like responses and can meet a user's social needs or sustain a relationship across interactions — must clearly disclose that the chatbot is AI whenever a reasonable person could be misled, maintain suicide/self-harm protocols, and apply extra rules for minors. Annual reporting to the Office of Suicide Prevention begins July 1, 2027. - Who must comply: Anyone who makes a companion chatbot available to users in California. Bots that remember users, personalize, check in, or build rapport can qualify even if they started as e-commerce assistants. - What to disclose: Clear and conspicuous notice that the chatbot is artificially generated and not human; a notice that the chatbot may not be suitable for some minors on the app or site. - When: Whenever a reasonable person could be misled; for known minors, at least every three hours during continuing use, plus break reminders. For minors, every 3 hours. - Applies to: Chatbot with memory, persona, or relationship features; AI offering emotional support or therapy-like help - Other duties: Publish and maintain a protocol for detecting and responding to suicidal ideation or self-harm, with referral to crisis services.; For known minors: prevent sexually explicit content and remind them to take breaks.; From July 1, 2027, file annual reports with the California Office of Suicide Prevention.; From July 1, 2027, if users under 18 are allowed: follow Adam's Law (SB 1119), including a repeated AI notice written for children, default time limits, parental controls and published child-safety policies. - Exemptions: Bots used only for customer service, business operations, productivity, internal research, or technical assistance.; Video-game bots that only discuss the game.; Stand-alone consumer electronic voice assistants that do not sustain relationships. - Penalties: Private right of action: the greater of $1,000 per violation or actual damages, plus injunctive relief and attorney's fees. Enforced by Private lawsuits; California Attorney General.. Private right of action. - Sources: SB 243 bill text (California Legislative Information) ; Future of Privacy Forum — Understanding the new wave of chatbot legislation ; Troutman — Analyzing the new AI companion chatbot laws (Jan 2026) ; SB 1119 (Adam's Law), Chapter 190, 2026 (California Legislative Information) - Last reviewed: 2026-10-08 ### California AI-voice robocall disclosure (AB 2905) - Jurisdiction: California - Citation: Cal. Pub. Util. Code § 2874, as amended by AB 2905 (Chapter 316, 2024) - Status: in force; effective 2025-01-01 - Page: https://botnotice.app/laws/california-ab-2905-ai-voice-calls - Summary: Before an automatic dialing-announcing device plays a prerecorded message, a live natural voice must give the nature of the call and the business's name, address and phone number, ask whether the person agrees to hear the message, and say so if the message uses an artificial voice. An artificial voice is one generated or significantly altered using AI. The law speaks of prerecorded messages and does not say how it treats a live conversational AI agent. - Who must comply: Anyone placing calls with an automatic dialing-announcing device: equipment that stores or generates numbers and plays a prerecorded message. - What to disclose: An unrecorded, natural voice announcement with the nature of the call, the business's name, address and phone number, a question asking for consent to hear the message, and a statement that the message uses an artificial voice, if it does. - When: Before the prerecorded message plays. - Applies to: AI phone / voice agent - Other duties: These calls need a prior agreement with the person called or this live announcement (§ 2873).; No calls received in California between 9pm and 9am (§ 2872).; Apply to the phone company before connecting the device (§ 2875). - Exemptions: A device not used to dial randomly or in sequence that only messages an established customer or associate, and calls the recipient asked for.; Schools, tax-exempt groups contacting members, and cable and utility companies, for the purposes listed in § 2872.; Public safety and emergency calls by the agencies listed in § 2872. - Penalties: A fine up to $500 per violation, disconnection of the device's phone service, or both, set by the Public Utilities Commission. Enforced by California Public Utilities Commission.. - Sources: AB 2905, Chapter 316, 2024 (California Legislative Information) ; Cal. Pub. Util. Code §§ 2871 to 2876 - Last reviewed: 2026-11-02 ### California Customer Service Chatbots (AB 1609) - Jurisdiction: California - Citation: Cal. Bus. & Prof. Code §§ 22625 to 22629 (AB 1609, Chapter 733, 2026) - Status: enacted, starts later; effective 2027-01-01 (Signed Sept 28, 2026. No later operative date in the bill, so it starts Jan 1, 2027. Covers only businesses with more than $500 million in gross annual revenue nationally.) - Page: https://botnotice.app/laws/california-ab-1609-customer-service-chatbots - Summary: Large businesses must not say a customer service chatbot is a human. If a reasonable person could think the chatbot is a person, the business must show a clear notice that it is AI and not human, in the same channel the chatbot uses. During business hours, customers must have a simple way to ask for a human on every customer service channel, and the business must make a good faith effort to connect them within 15 minutes or book a call within one business day. Hold times are limited to 15 minutes at a time and one hour in total. - Who must comply: Businesses with more than $500 million in gross annual revenue nationally that use a customer service chatbot with customers whose account address is in California. - What to disclose: A clear and conspicuous notice that the customer service chatbot is artificially generated and not human. - When: When a reasonable person could think they are talking to a human; in the same channel the chatbot uses. - Applies to: Customer-service / FAQ chatbot; Sales, lead-capture, or booking chatbot - Other duties: Offer a simple way to ask for a human agent on every customer service channel during regular business hours.; Make a good faith effort to connect the customer to a human within 15 minutes, or set a call within one business day.; Keep hold times to 15 minutes at a time and one hour in total.; Post the customer service phone number clearly on the website, if the business has phone support. - Exemptions: Businesses with $500 million or less in gross annual revenue.; Internal and business-to-business lines.; Hospitals, for health care communications.; Consumer reporting agencies.; Telecom and water services covered by CPUC General Orders 133 and 103-A. - Penalties: Up to $5,000 for a first violation and $10,000 for each later violation. Enforced by Public prosecutors only. No private right of action.. - Sources: AB 1609 chaptered text (California Legislative Information) - Last reviewed: 2026-10-08 ### California AI Transparency Act (SB 942 / AB 853 / SB 1000) - Jurisdiction: California - Citation: Cal. Bus. & Prof. Code § 22757 et seq., as amended by SB 1000 (Chapter 861, 2026) - Status: in force; effective 2026-08-02 (Operative Aug 2, 2026 (§ 22757.6). SB 1000, an urgency law effective Sept 30, 2026, removed the one-million-user threshold and the visible-label duty, renamed the AI detection tool a disclosure verification tool, and added a $50,000 penalty for falsely claiming a system is assistive technology. AB 853 added duties for large online platforms (Jan 1, 2027; § 22757.3.1), GenAI hosting platforms (Jan 1, 2027; § 22757.3.2) and capture device makers (Jan 1, 2028; § 22757.3.3).) - Page: https://botnotice.app/laws/california-ai-transparency-act - Summary: From Aug 2, 2026, anyone who creates, codes or produces a generative AI system that is publicly accessible in California is a covered provider, with no size threshold since SB 1000. A covered provider must offer a free disclosure verification tool and, where technically feasible, embed a latent (machine-readable) provenance disclosure in images, audio and video the system creates or alters. From Jan 1, 2027, large online platforms (social media, file-sharing, mass messaging and search services with over two million monthly users) must detect standards-based provenance data, show users what it says and let them inspect it, and must not knowingly strip it. Also from Jan 1, 2027, hosting platforms must not knowingly offer a GenAI system that does not place these disclosures. From Jan 1, 2028, new cameras and phones sold in California must embed provenance by default. A business that only uses another company's AI tool is not a covered provider for that reason, but a small business that builds and publishes its own generative AI system can be. AI images and video posted to large platforms will show the provenance data they carry. - Who must comply: Anyone who creates, codes or produces a generative AI system publicly accessible in California, at any size; large online platforms with 2M+ monthly users; GenAI hosting platforms; capture device manufacturers. - What to disclose: Latent provenance disclosures in AI-generated images, audio and video, where technically feasible; platform display of provenance to users from 2027. The law no longer requires an optional visible label. - When: At generation (covered providers, from Aug 2, 2026); at distribution (large platforms, from Jan 1, 2027); at capture (devices first produced for sale from Jan 1, 2028). - Applies to: AI-generated marketing text, images, or video; AI-generated 'people' in ads - Other duties: Covered providers must tell anyone they license a GenAI system to about these duties, and act within 72 hours if they learn a licensee changed the system so it no longer meets these rules.; Businesses that only publish AI media have no duty under this Act, but keeping the provenance data their tools attach matches the rule platforms must follow. Check that your website or CMS keeps it on upload.; Expect AI-made images and video posted to Instagram, YouTube, TikTok and similar to show their provenance data from 2027, and decide what your own site says about the same content. - Exemptions: Products and services that provide only non-user-generated video games.; GenAI systems designed to primarily function as assistive technology, until Jan 1, 2029.; Platforms under the 2M monthly-user threshold; broadband and telecommunications services. - Penalties: $5,000 per violation; each day in violation is a separate violation. A prevailing plaintiff recovers attorney's fees and costs. Falsely claiming a system is assistive technology: $50,000 per violation, each day separate, until Jan 1, 2029. Enforced by California Attorney General, city attorneys, county counsel.. - Sources: Cal. Bus. & Prof. Code § 22757.1 (definitions) ; Cal. Bus. & Prof. Code § 22757.3 (latent disclosures) ; Cal. Bus. & Prof. Code § 22757.3.1 (large online platforms) ; Cal. Bus. & Prof. Code § 22757.4 (enforcement) ; SB 1000, Chapter 861, 2026 (California Legislative Information) ; AB 853 (2025) bill text - Last reviewed: 2026-11-02 ### New York AI Companion Models Law - Jurisdiction: New York - Citation: N.Y. Gen. Bus. Law Art. 47, § 1700 et seq. (2025 budget, S-3008C) - Status: in force; effective 2025-11-05 - Page: https://botnotice.app/laws/new-york-ai-companion-law - Summary: Operators of 'AI companions' (systems designed to simulate a sustained human-like relationship by retaining past interactions and preferences, asking unprompted emotion-based questions, and sustaining a dialogue on personal matters) must tell users clearly that they are not talking to a human at the start of an interaction, which need not happen more than once a day, and at least every three hours during continuing interactions. They must also detect and respond to expressions of suicidal ideation or self-harm with crisis referrals. - Who must comply: Any operator providing an AI companion to New York users. - What to disclose: Clear and conspicuous notification, verbally or in writing, that the user is not communicating with a human. - When: At the beginning of an interaction (need not exceed once per day) and at least once every three hours during continuing interactions. Repeat every 3 hours. For minors, every 3 hours. - Applies to: Chatbot with memory, persona, or relationship features; AI offering emotional support or therapy-like help - Other duties: Maintain a protocol to detect suicidal ideation or self-harm and refer users to crisis services (e.g., 988). - Exemptions: Systems a business uses solely for customer service or to give information about its own products and services.; Systems primarily designed and marketed for efficiency, research or technical assistance.; Systems a business uses solely for internal purposes or employee productivity. - Penalties: Civil penalties up to $15,000 per day of violation, plus injunctive relief. Enforced by New York Attorney General only.. - Sources: N.Y. Gen. Bus. Law § 1700 (definitions) ; N.Y. Gen. Bus. Law § 1701 (crisis protocol) ; N.Y. Gen. Bus. Law § 1702 (notifications) ; N.Y. Gen. Bus. Law § 1703 (enforcement) - Last reviewed: 2026-11-02 ### New York Synthetic Performer Disclosure in Advertising - Jurisdiction: New York - Citation: N.Y. Gen. Bus. Law § 396-b as amended (S.8420-A / A.8887-B) - Status: in force; effective 2026-06-09 - Page: https://botnotice.app/laws/new-york-synthetic-performer-ads - Summary: Anyone who produces or creates an ad for a commercial purpose must conspicuously disclose a 'synthetic performer' in it, when they actually know one is there. A synthetic performer is a digitally created asset meant to look like a human performer who is not recognizable as any real person. - Who must comply: Any business dealing in property or services that produces or creates an ad with a synthetic performer, with actual knowledge of it. Media that only carry the ad are not covered. - What to disclose: A conspicuous disclosure in the ad that it contains a synthetic performer. - When: Displayed with the advertisement. - Applies to: AI-generated 'people' in ads - Exemptions: Audio ads.; AI used solely to translate a human performer's language.; Ads for expressive works such as films, shows and games, if the performer is used consistently with the work.; Media that publish or carry the ad, such as newspapers, broadcasters, streaming services and billboards. - Penalties: $1,000 for a first violation; $5,000 for each subsequent violation. Enforced by Civil penalty set by the statute; § 396-b does not name who enforces it.. - Sources: N.Y. Gen. Bus. Law § 396-b ; S.8420-A (NY State Senate) - Last reviewed: 2026-11-02 ### NYC Automated Employment Decision Tools Law (Local Law 144) - Jurisdiction: New York City - Citation: N.Y.C. Admin. Code § 20-870 et seq. - Status: in force; effective 2023-07-05 - Page: https://botnotice.app/laws/nyc-local-law-144-aedt - Summary: Employers and agencies that use automated tools to substantially assist hiring or promotion decisions for NYC candidates must commission an annual independent bias audit, publish a summary, and give candidates notice at least 10 business days before the tool is used. A December 2025 Comptroller audit found enforcement had been weak and the city has committed to stricter enforcement in 2026. - Who must comply: Employers and employment agencies using AI screening for jobs located in New York City. - What to disclose: Notice that an automated employment decision tool will be used, the job qualifications it assesses, and how to request an alternative process; publish the bias-audit summary on your website. - When: At least 10 business days before the tool is used (job posting, email, or website notice). - Applies to: AI in hiring, screening, or HR decisions - Other duties: Annual independent bias audit with published impact ratios. - Exemptions: Tools that do not substantially assist or replace human discretion. - Penalties: $500 for a first violation and $500–$1,500 for each subsequent violation, per day. Enforced by NYC Department of Consumer and Worker Protection.. - Sources: NYC DCWP — Automated Employment Decision Tools - Last reviewed: 2026-09-09 ### Maine Chatbot Disclosure Act (LD 1727) - Jurisdiction: Maine - Citation: 10 M.R.S. § 1500-DD (PL 2025, c. 294) - Status: in force; effective 2025-09-24 - Page: https://botnotice.app/laws/maine-chatbot-disclosure-act - Summary: The broadest chatbot law in the country: no person may use an AI chatbot or any other computer technology to engage in trade or commerce with a consumer in a way that may mislead a reasonable consumer into believing they are dealing with a human, unless the consumer is clearly and conspicuously told they are not engaging with a human. There is no customer-service carve-out. - Who must comply: Every business using a chatbot, voice bot, or similar technology with Maine consumers, including ordinary customer-service bots. - What to disclose: A clear and conspicuous notification that the consumer is not engaging with a human being. - When: The statute sets no timing or interval. The notice must reach the consumer before they could be misled, so in practice at the start of the interaction. - Applies to: Customer-service / FAQ chatbot; Sales, lead-capture, or booking chatbot; Chatbot with memory, persona, or relationship features; AI phone / voice agent; AI giving financial, legal, or medical guidance - Exemptions: None written into the statute. The test is whether a reasonable consumer could be misled. - Penalties: A violation is a violation of the Maine Unfair Trade Practices Act: Attorney General civil penalties (up to $10,000 per intentional violation) and suits by consumers who bought goods or services for personal use and lost money or property. Enforced by Maine Attorney General; consumers under the UTPA.. Private right of action. - Sources: 10 M.R.S. § 1500-DD (Maine Legislature) ; 5 M.R.S. § 209 (Attorney General actions and civil penalties) ; 5 M.R.S. § 213 (private remedies) ; Verrill: Maine law now requires limited disclosures of AI technology - Last reviewed: 2026-11-02 ### Maine restrictions on AI mental health services (LD 2082) - Jurisdiction: Maine - Citation: 10 M.R.S. § 1500-EE (PL 2025, c. 687) - Status: in force; effective 2026-07-29 (Not an emergency law, so it took effect with the session's other laws on July 29, 2026.) - Page: https://botnotice.app/laws/maine-ai-mental-health-ld-2082 - Summary: No one may provide, advertise or offer therapy or psychotherapy services to the public, including through internet-based AI, unless the services are provided by a licensed professional. These services mean diagnosing, treating or addressing mental or behavioral health through therapeutic communication in a clinical or professional setting. A violation is a violation of the Maine Unfair Trade Practices Act. - Who must comply: Anyone providing, advertising or offering therapy or psychotherapy services to the public in Maine, including through AI. - What to disclose: No AI notice is required. Do not provide or offer AI therapy unless a licensed professional provides the services. - When: Ongoing. - Applies to: AI offering emotional support or therapy-like help - Exemptions: AI used solely within a research project approved by an institutional review board and run under federal human-subject protections. - Penalties: A violation is a violation of the Maine Unfair Trade Practices Act: Attorney General civil penalties (up to $10,000 per intentional violation) and suits by consumers who bought goods or services for personal use and lost money or property. Enforced by Maine Attorney General; consumers under the UTPA.. Private right of action. - Sources: 10 M.R.S. § 1500-EE (Maine Legislature) ; PL 2025, c. 687 (LD 2082) ; 5 M.R.S. § 209 (Attorney General actions and civil penalties) ; 5 M.R.S. § 213 (private remedies) - Last reviewed: 2026-11-02 ### Utah Artificial Intelligence Policy Act (SB 149, as amended by SB 226 and SB 332) - Jurisdiction: Utah - Citation: Utah Code ch. 13-77 (generative AI disclosures); ch. 13-72 (AI Policy Act) - Status: in force; effective 2024-05-01 (SB 226 replaced the original rule (§ 13-2-12) with the disclosure rules now in chapter 13-77, effective May 7, 2025. Only chapter 13-72, which sets up Utah's AI office and learning lab, is scheduled for repeal on July 1, 2027. Chapter 13-77 has no repeal date.) - Page: https://botnotice.app/laws/utah-ai-policy-act - Summary: A supplier using generative AI with a person in a consumer transaction must say it is AI, not a human, when the person clearly asks. A stricter rule applies to people in occupations licensed or certified through the Department of Commerce: when AI in their services is a high-risk interaction (collecting health, financial or biometric data, or giving personalized financial, legal, medical or mental health advice), they must disclose it prominently, out loud at the start of a spoken interaction or in writing before a written one. A clear AI notice at the outset and throughout the interaction is a safe harbor from enforcement of both rules. - Who must comply: Suppliers using generative AI in consumer transactions with people in Utah; people in Department of Commerce regulated occupations when AI use is high-risk. - What to disclose: Disclosure that the person is interacting with generative AI, not a human. Prominent disclosure for high-risk use in a regulated occupation. - When: When the person clearly asks; for high-risk use in a regulated occupation, at the start of a spoken interaction and before a written one. Must answer truthfully when asked. - Applies to: Customer-service / FAQ chatbot; Sales, lead-capture, or booking chatbot; Chatbot with memory, persona, or relationship features; AI phone / voice agent; AI giving financial, legal, or medical guidance; AI in patient diagnosis, treatment, or care; AI offering emotional support or therapy-like help - Other duties: Configure your bot to answer truthfully when asked 'Am I talking to a human / a bot?'; People in regulated occupations must still meet all the rules of their occupation when using generative AI.; 'The AI did it' is no defense to a violation of a consumer law the Division enforces. - Exemptions: Safe harbor: no enforcement action under these disclosure rules if the AI clearly and conspicuously says it is AI or not human, at the outset and throughout the interaction. - Penalties: Administrative fines up to $2,500 per violation, plus court-ordered remedies; up to $5,000 per violation for violating an administrative or court order. Enforced by Utah Division of Consumer Protection.. - Sources: Utah Code ch. 13-77 (generative AI disclosures) ; Utah Code § 13-77-103 (required disclosures) ; Utah Code § 13-77-104 (safe harbor) ; SB 226 enrolled (2025) ; Utah Code § 63I-2-213 (repeal dates) - Last reviewed: 2026-11-02 ### Utah Mental Health Chatbot Law (HB 452) - Jurisdiction: Utah - Citation: Utah Code § 13-72a-101 et seq. - Status: in force; effective 2025-05-07 - Page: https://botnotice.app/laws/utah-mental-health-chatbots-hb-452 - Summary: Suppliers of AI mental-health chatbots must disclose that the chatbot is AI, not a human, before a user can access it, again if the user has not used it for seven days, and whenever the user asks. They must not sell or share users' health information or input, must label any ad shown in a conversation along with any sponsorship, and must not use what a user types to target ads. - Who must comply: Suppliers of a chatbot that talks with Utah users like a licensed therapist would, and that the supplier represents, or a reasonable person would believe, can provide therapy or help manage or treat mental health conditions. - What to disclose: Clear and conspicuous disclosure that the chatbot is an AI technology and not a human. - When: Before access, at the start of an interaction if the user has not used the chatbot in the previous seven days, and whenever asked. Must answer truthfully when asked. - Applies to: AI offering emotional support or therapy-like help - Other duties: Clearly label any ad shown in a conversation and disclose any sponsorship or affiliation.; Do not use a user's input to choose or customize ads.; Do not sell or share a user's identifiable health information or input, with limited exceptions. - Exemptions: AI that only gives scripted output, such as guided meditations or mindfulness exercises.; AI that only analyzes input to connect someone with a human therapist. - Penalties: Up to $2,500 per violation, plus court-ordered remedies; up to $5,000 per violation for violating an administrative or court order. Enforced by Utah Division of Consumer Protection.. - Sources: Utah Code ch. 13-72a ; Utah Code § 13-72a-101 (definitions) - Last reviewed: 2026-11-02 ### Utah Digital Content Provenance Standards Act (HB 276) - Jurisdiction: Utah - Citation: Utah Code ch. 13-72c (HB 276, Laws of Utah 2026, ch. 352) - Status: enacted, starts later; effective 2027-01-01 (The capture device duty applies to devices produced for sale on or after Jan 1, 2028. Utah's code site marks the chapter "Affected by 63I-2-213 on 7/1/2027", but the current text of that section repeals only chapter 72, and HB 276 does not amend it.) - Page: https://botnotice.app/laws/utah-digital-content-provenance-standards-act - Summary: From Jan 1, 2027, anyone who produces a publicly accessible generative AI system with over one million monthly visitors or users must embed a latent (machine-readable) disclosure in images, video and audio the system creates or substantially modifies. Social media, mass messaging and search platforms with over two million monthly users must detect standards-based provenance data, show users it exists and let them inspect it, and must not knowingly strip it. From 2028, new cameras and phones sold in Utah must embed a latent disclosure, which users may turn off. - Who must comply: Makers of generative AI systems with over 1M monthly visitors or users; large online platforms with over 2M monthly users; capture device manufacturers. - What to disclose: A latent disclosure in AI-created or substantially modified images, video and audio, with the time and date, and digital signatures that can show AI use or the other detail § 13-72c-203 lists, as far as technically feasible and reasonable. Platforms must tell users when provenance data is available. - When: At generation (AI system makers); on the platform (large platforms); at capture (devices produced for sale from Jan 1, 2028). - Applies to: AI-generated marketing text, images, or video; AI-generated 'people' in ads - Other duties: Large platforms must let users inspect provenance data directly, by download or by link, and must not knowingly strip it, as far as technically feasible.; A business that only uses another company's AI tool is not named in the act. Keeping the provenance data its tools attach matches the rule platforms must follow. - Exemptions: AI systems used only for a business's internal operations and not made public.; AI systems at or under one million monthly visitors or users.; Platforms at or under two million monthly users; broadband and telecommunications services. - Penalties: Administrative fines or court fines up to $2,500 per violation, plus injunctions, disgorgement and the state's fees and costs; up to $5,000 per violation of an administrative or court order. Enforced by Utah Division of Consumer Protection. The Attorney General may sue to collect civil penalties.. - Sources: Utah Code ch. 13-72c (Utah Legislature) ; HB 276 enrolled (2026) ; Utah Code § 63I-2-213 (repeal dates) - Last reviewed: 2026-11-02 ### Colorado Artificial Intelligence Act (SB 24-205, rewritten by SB 26-189) - Jurisdiction: Colorado - Citation: C.R.S. § 6-1-1701 et seq. as repealed and reenacted by SB 26-189 (signed May 14, 2026) - Status: enacted, starts later; effective 2027-01-01 (Applies to consequential decisions made on or after Jan 1, 2027. AG rules are due by that date. Until Jan 1, 2030, the AG must give notice and 60 days to cure if a cure is possible, unless the violation is knowing or repeated.) - Page: https://botnotice.app/laws/colorado-ai-act - Summary: A deployer using automated decision-making technology to materially influence a consequential decision (education, employment, housing, lending, insurance, health care, essential government services) must give notice first. A prominent public notice at points of consumer interaction meets that duty. After an adverse outcome it must explain the technology's role within 30 days and offer correction of data and meaningful human review. Developers must give deployers documentation. The 2024 duty to tell consumers they are interacting with AI is not in the rewritten act. - Who must comply: Developers and deployers of automated decision-making technology that materially influences consequential decisions about Colorado consumers. - What to disclose: A clear and conspicuous notice that the technology is or will be used in a consequential decision, and how to get more information. After an adverse outcome, a plain-language description of its role and of the consumer's rights. - When: Before the technology is used in the decision; within 30 days after an adverse outcome. - Applies to: AI deciding eligibility (credit, housing, insurance, benefits); AI in hiring, screening, or HR decisions - Other duties: Keep records for at least three years after the decision.; Offer correction of factually incorrect personal data and meaningful human review after an adverse outcome.; Developers: give deployers documentation on intended uses, training data, limitations and human review. - Exemptions: Low-stakes or routine decisions, including scheduling, customer service triage and communicating decisions.; Advertising, marketing, product recommendations, search and content moderation.; HIPAA covered entities and their business associates, except for employment decisions. They must still give patients a general notice.; Insurers subject to C.R.S. § 10-3-1104.9, in the practice of insurance.; FDA-overseen medical devices and related research. - Penalties: A deceptive trade practice under the Colorado Consumer Protection Act: civil penalties up to $20,000 per violation, or $50,000 if committed against an elderly person. Enforced by Colorado Attorney General only.. - Sources: SB 26-189 bill page, with the signed act (Colorado General Assembly) ; HB 19-1289 (Consumer Protection Act penalty amounts) - Last reviewed: 2026-11-02 ### Texas Responsible Artificial Intelligence Governance Act (HB 149) - Jurisdiction: Texas - Citation: Tex. Bus. & Com. Code ch. 552 - Status: in force; effective 2026-01-01 - Page: https://botnotice.app/laws/texas-responsible-ai-governance-act - Summary: Government agencies must tell consumers when they are interacting with AI. The provider of a health care service or treatment must clearly and conspicuously disclose, no later than the date it is first provided, when an AI system is used in relation to it, which can include a patient-facing chatbot. Other private businesses have no disclosure duty under the Act, but it bans developing or deploying AI that intentionally aims to encourage self-harm, harm to others or crime, or AI built with the intent to unlawfully discriminate. The AG must give 60 days to cure before suing. - Who must comply: Texas state agencies; licensed health-care providers using AI in relation to a patient's care; all businesses for the prohibited-use rules only. - What to disclose: Clear and conspicuous disclosure, in plain language and without dark patterns, to the patient (or their representative) that AI is used in relation to their health care service or treatment. A link to a separate web page is allowed. - When: No later than the date the service or treatment is first provided; in an emergency, as soon as reasonably possible. - Applies to: AI in patient diagnosis, treatment, or care - Other duties: Do not deploy AI that intentionally aims to incite self-harm, harm to others or crime. - Exemptions: The Act's consumer protections cover people acting in an individual or household context, not a commercial or employment one, so private employers have no disclosure duty to applicants or employees under it. - Penalties: $10,000–$12,000 per curable violation; $80,000–$200,000 per uncurable violation; up to $40,000 per day for continuing violations. Enforced by Texas Attorney General (exclusive); 60-day cure period. Licensing agencies may add sanctions if the AG recommends it.. - Sources: Tex. Bus. & Com. Code ch. 552 ; HB 149 enrolled (Texas Legislature) - Last reviewed: 2026-11-02 ### Washington AI Companion Chatbot Act (HB 2225) - Jurisdiction: Washington - Citation: Laws of 2026, ch. 168 (ESHB 2225), new chapter in Title 19 RCW - Status: enacted, starts later; effective 2027-01-01 (Approved March 24, 2026.) - Page: https://botnotice.app/laws/washington-chatbot-disclosure-act - Summary: Operators of AI companion chatbots, natural-language systems that give adaptive human-like responses and can sustain a relationship across interactions, must clearly disclose that the chatbot is AI at the start and at least every three hours. If the operator knows the user is a minor, or the bot is directed to minors, the reminder is every hour and manipulative engagement techniques and sexual content must be blocked. Operators must also keep and publish a self-harm protocol. Violations fall under the Consumer Protection Act, which lets injured people sue. - Who must comply: Operators that make an AI companion chatbot available to Washington users. - What to disclose: Clear and conspicuous disclosure that the companion chatbot is artificially generated and not human. - When: At the beginning of the interaction and at least every three hours; every hour if the operator knows the user is a minor or the bot is directed to minors. Repeat every 3 hours. For minors, every 1 hours. - Applies to: Chatbot with memory, persona, or relationship features; AI offering emotional support or therapy-like help - Other duties: Stop the chatbot from claiming to be human, including when asked.; Keep a protocol to identify suicidal ideation and self-harm, including eating disorders, and refer users to crisis resources.; Publish the protocol and the number of crisis referrals in the past calendar year on your website and in your app.; Block content that encourages or describes how to commit self-harm.; For minors: block sexual content and manipulative engagement techniques, such as prompting them to return or simulating distress when they want to leave. - Exemptions: Bots used only for business operations, productivity, internal research, technical assistance or customer service, if they do not sustain a relationship and generate outputs likely to elicit emotional responses.; Video-game bots limited to the game that cannot discuss mental health, self-harm or sexual content.; Stand-alone voice-assistant devices that do not sustain a relationship.; Narrowly tailored educational tools used in school settings. - Penalties: Consumer Protection Act: Attorney General civil penalties up to $7,500 per violation; private suits for actual damages, which a court may triple up to $25,000, plus attorney's fees. Enforced by Washington Attorney General and private plaintiffs.. Private right of action. - Sources: ESHB 2225, Chapter 168, Laws of 2026 (Washington Legislature) ; RCW 19.86.090 (private suits) ; RCW 19.86.140 (civil penalties) - Last reviewed: 2026-11-02 ### Oregon Companion Chatbot Law (SB 1546) - Jurisdiction: Oregon - Citation: Oregon Laws 2026, ch. 85 (SB 1546) - Status: enacted, starts later; effective 2027-01-01 (Approved by the Governor March 31, 2026. Effective Jan 1, 2027.) - Page: https://botnotice.app/laws/oregon-companion-chatbot-law - Summary: Covers AI companions: systems designed to simulate a sustained human-like relationship by retaining past interactions, asking unprompted emotional questions and sustaining a dialogue on personal matters. If a reasonable person would believe they are talking to a human, the operator must show a clear notice that they are not. Operators must also keep a suicide and self-harm protocol with 988 referrals, add protections for known minors and post a public report each year. A person who suffers a loss of money or property or other injury in fact can sue for the greater of actual damages or $1,000 per violation. - Who must comply: Operators of AI companions or companion platforms available to Oregon users. - What to disclose: Clear and conspicuous notice on the platform that the user is interacting with artificially generated output and not a natural person. - When: When a reasonable person would believe they are talking to a human; no set interval for adults. For users the operator knows or has reason to believe are minors, a break reminder and AI reminder at least every three hours. For minors, every 3 hours. - Applies to: Chatbot with memory, persona, or relationship features; AI offering emotional support or therapy-like help - Other duties: Keep a protocol to detect suicidal or self-harm input, give 988 referrals, and publish its details on your website.; Post a public report by Dec 31 each year with the number of crisis referrals and the protocol details.; For known minors: prevent claims of being human, simulated romance or emotional dependence, and sexually explicit content.; For known minors: do not use rewards to maximize time spent or guilt to stop them leaving. - Exemptions: Software solely for customer service, patient or resident care in a facility, education, financial services, business operations, productivity, information analysis, internal research or technical assistance.; Video-game software limited to the game's features.; Stand-alone speakers and voice-activated virtual assistants. - Penalties: The greater of actual damages or $1,000 per violation, plus an injunction; a court may award attorney fees and costs. The person suing must have suffered an ascertainable loss of money or property or other injury in fact. Enforced by Private lawsuits only; the act names no state enforcer. Private right of action. - Sources: Oregon Laws 2026, ch. 85 ; SB 1546 enrolled (Oregon Legislature) ; SB 1546 overview (Oregon Legislature) - Last reviewed: 2026-11-02 ### Nebraska Conversational AI Safety Act (LB 525) - Jurisdiction: Nebraska - Citation: Neb. LB 525, §§ 12 to 18 (approved April 14, 2026) - Status: enacted, starts later; effective 2027-07-01 - Page: https://botnotice.app/laws/nebraska-conversational-ai-safety-act - Summary: Covers public AI services that primarily simulate human conversation. If a reasonable person would be misled into thinking they are talking to a human, the operator must clearly disclose that it is AI. Known minors get a persistent disclaimer, or one at the start of each session and every three hours, plus limits on sexual content, simulated emotional dependence and random rewards. Operators must keep a self-harm protocol and must not program the service to say it is designed to provide professional mental health care. Bots used solely for customer service or product information are excluded. - Who must comply: Operators that make a conversational AI service available to the public in Nebraska. - What to disclose: Clear and conspicuous disclosure that the service is artificial intelligence. - When: When a reasonable person would be misled into thinking it is a human; no set time for adults. For minor account holders, a persistent visible disclaimer, or at the start of each session and at least every three hours. For minors, every 3 hours. - Applies to: Chatbot with memory, persona, or relationship features; AI offering emotional support or therapy-like help - Other duties: Keep a protocol that refers users who mention suicide or self-harm to crisis services.; For minor account holders: no points or rewards at unpredictable intervals meant to increase engagement.; For minor account holders: reasonable measures against sexual content, claims of being human, simulated emotional dependence and romantic role-play.; Offer privacy and account tools to minor account holders and, as the act sets out, their parents or guardians. - Exemptions: Services used by a business solely for customer service or to provide information about its own products, services or accounts.; Services used by a business solely for internal purposes, or primarily designed for commercial use by businesses.; A feature within another application, and tools limited to a narrow and discrete topic.; Tools for developers or researchers, and voice assistants on consumer devices. - Penalties: Civil penalties of at least $1,000 per violation, up to $500,000 per operator, plus actual damages, court orders and the state's costs and attorney's fees. Enforced by Nebraska Attorney General only.. - Sources: LB 525 slip law (Nebraska Legislature) - Last reviewed: 2026-11-02 ### Idaho Conversational AI Safety Act (S 1297) - Jurisdiction: Idaho - Citation: Idaho Code §§ 48-2101 to 48-2105 (S 1297, Session Law ch. 249, signed March 31, 2026) - Status: enacted, starts later; effective 2027-07-01 - Page: https://botnotice.app/laws/idaho-conversational-ai-safety-act - Summary: Closely follows Nebraska's model. If reasonable people would be misled into thinking they are talking to a human, the operator must clearly disclose that it is AI. Known minors get a persistent disclaimer, or one at the start of each session and every three hours, plus limits on sexual content, simulated emotional dependence and random rewards. Operators must keep a suicide protocol and must not program the service to say it is designed to provide professional mental health care. - Who must comply: Operators that make a conversational AI service available to the public in Idaho. - What to disclose: Clear and conspicuous disclosure that the service is artificial intelligence. - When: When reasonable people would be misled into thinking it is a human; no set time for adults. For minor account holders, a persistent visible disclaimer, or at the start of each session and at least every three hours. For minors, every 3 hours. - Applies to: Chatbot with memory, persona, or relationship features; AI offering emotional support or therapy-like help - Other duties: Keep a protocol that refers users who mention suicidal ideation to crisis services.; For minor account holders: no points or rewards at unpredictable intervals meant to increase engagement.; For minor account holders: reasonable measures against sexual content, claims of being human, simulated emotional dependence and romantic role-play.; Offer privacy and account tools to account holders and, as the act sets out, parents or guardians of minors. - Exemptions: Chatbots used only for customer service, business operations, productivity, internal research or technical assistance.; Services primarily designed for commercial use by businesses, or open only to people under a commercial agreement with the operator.; A feature within another application, tools limited to a narrow and discrete topic, and limited video-game chatbots.; Tools for developers or researchers, and voice assistants on consumer devices. - Penalties: $1,000 per violation, up to $500,000 per operator, or actual damages if greater, plus an injunction. Enforced by Idaho Attorney General only.. - Sources: S 1297 as amended (Idaho Legislature) ; S 1297 bill status (Idaho Legislature) - Last reviewed: 2026-11-02 ### Iowa Conversational AI Chatbot Safety Act (SF 2417) - Jurisdiction: Iowa - Citation: Iowa Code ch. 554J (SF 2417, approved May 2, 2026) - Status: enacted, starts later; effective 2027-07-01 (The act says it applies July 1, 2027. The Attorney General must adopt rules.) - Page: https://botnotice.app/laws/iowa-conversational-ai-chatbot-safety-act - Summary: Covers public AI services whose primary purpose is simulating human conversation. If a reasonable person would believe they are talking to a human, the operator must show a persistent disclaimer or one after every three hours of continuous interaction. Known minors get a persistent disclaimer, or one at the start of each interaction and every three hours, plus limits on sexual content and random rewards. Operators must keep a suicide and self-harm protocol and must not suggest the service provides licensed psychology or behavioral health care. - Who must comply: People who develop a conversational AI service and make it available to the public in Iowa. - What to disclose: Clear and conspicuous disclosure that the service is artificial intelligence. - When: If a reasonable person would believe it is human: a persistent disclaimer, or one after every three hours of continuous interaction. For minor account holders: a persistent disclaimer, or at the start of each interaction and at least every three hours. Repeat every 3 hours. For minors, every 3 hours. - Applies to: Chatbot with memory, persona, or relationship features; AI offering emotional support or therapy-like help - Other duties: Keep a protocol that refers users who mention suicide or self-harm to crisis services.; For minors: no points or rewards at unpredictable intervals meant to increase engagement.; Reasonable measures against statements that make people believe it is human, including simulated emotional dependence and romantic role-play with minors.; Offer privacy and account tools to minor account holders and, as the act sets out, their parents or guardians. - Exemptions: Services primarily designed for commercial use by businesses to help customers get services or buy goods from them.; Services used by a business solely for internal purposes.; A feature within another application without that primary purpose, and tools limited to a narrow and discrete topic.; Research and development tools, and voice assistants on consumer devices. - Penalties: The greater of actual damages or $1,000 per violation, up to $500,000 per operator, plus an injunction. Enforced by Iowa Attorney General.. - Sources: SF 2417 enrolled (Iowa Legislature) ; Governor's approval letter, May 2, 2026 - Last reviewed: 2026-11-02 ### Georgia AI Companion Chatbot Law (SB 540) - Jurisdiction: Georgia - Citation: Ga. SB 540 (signed May 11, 2026), adding O.C.G.A. § 39-5-6 - Status: enacted, starts later; effective 2027-07-01 - Page: https://botnotice.app/laws/georgia-conversational-ai-safety-act - Summary: Covers AI companion chatbots: systems designed to simulate a sustained human-like relationship by retaining past interactions, asking unprompted emotional questions and sustaining a dialogue on personal matters. Operators must disclose that the user is talking to AI at the start of each session and at least every three hours (every hour for minors), protect minors from sexual, romantic and manipulative content, offer minors and parents account tools, keep a suicide and self-harm protocol, and use age assurance before any sexually explicit feature. - Who must comply: People who own, control, or develop and make available an AI companion chatbot to Georgia users. - What to disclose: Clear and conspicuous disclosure that the user is interacting with an AI companion chatbot, not a natural person. - When: At the beginning of each interaction or session and at least every three hours; every hour if the operator knows or should know the user is a minor, or the chatbot is directed or marketed to minors. Repeat every 3 hours. For minors, every 1 hours. - Applies to: Chatbot with memory, persona, or relationship features; AI offering emotional support or therapy-like help - Other duties: Keep a protocol for severe harm and emotional crises, with 988 referrals, and publish a summary and the yearly number of crisis referrals.; For known minors, offer tools to manage privacy, notifications, safety settings and relationship features.; Use age assurance before any feature that may generate sexually explicit content.; Do not program the chatbot to claim it is licensed to give mental health, medical or counseling services unless the operator is authorized to. - Exemptions: AI used solely for a business's internal purposes.; AI designed and marketed primarily for software development, research, technical assistance or enterprise productivity.; Customer-service chatbots that do not sustain a relationship across interactions or are not designed to elicit emotional attachment.; Stand-alone speakers and virtual assistants, narrowly tailored educational tools, and limited video-game, film, TV and theme-park features, subject to the conditions in the definition. - Penalties: Up to $10,000 per knowing violation, plus compensatory damages, costs and attorney's fees, and an injunction. Each day in violation is a separate violation for each user affected. Enforced by Georgia Attorney General, who may give 30 days to cure a first violation that does not involve knowing misconduct, sexual exploitation of a minor or self-harm. - Sources: SB 540 text (Georgia Governor's Office) ; Privacy Daily: Georgia AI chatbots bill signed, will take effect July 2027 - Last reviewed: 2026-11-02 ### Connecticut AI Responsibility and Transparency Act (SB 5 / Public Act 26-15) - Jurisdiction: Connecticut - Citation: Conn. Public Act 26-15, §§ 4 to 12 (signed May 27, 2026) - Status: enacted, starts later; effective 2027-01-01 (AI companion rules start Jan 1, 2027. The employment sections take effect Oct 1, 2026, but their notice duties apply to technology deployed on or after Oct 1, 2027. The AG's 60-day cure option covers employment violations through Dec 31, 2027, not the companion rules.) - Page: https://botnotice.app/laws/connecticut-ai-responsibility-transparency-act - Summary: If an AI companion would make a reasonable person believe they are talking to a human, the operator must give a clear notice: visible throughout, or at the first interaction in any 24 hours and at least every three hours (every hour for users under 18). Operators must keep and post a self-harm protocol, stop the AI from claiming to be human, and for known minors block romantic or sexual interaction and manipulative techniques. From Oct 1, 2027, employers using automated employment decision technology must give written notice before the decision. - Who must comply: Operators of AI companions used in Connecticut; employers using automated employment-related decision technology, and its developers. - What to disclose: Clear and conspicuous notice that the user is communicating with an AI companion. - When: When a reasonable person would believe it is human: static notice visible throughout, or at the first interaction in any 24-hour period and at least every three hours (every hour for users under 18). Repeat every 3 hours. For minors, every 1 hours. - Applies to: Chatbot with memory, persona, or relationship features; AI offering emotional support or therapy-like help; AI in hiring, screening, or HR decisions - Other duties: Keep a protocol to detect risk of suicide, self-harm or violence, refer users to help including 988, and post it on your website.; Stop the AI from claiming to be human, including when asked.; For known minors: measures against romantic or sexual interaction and manipulative techniques, plus screen-time and account tools for them and their parents.; From Oct 1, 2027: written notice before an employment decision, and plain-language notice when employees or applicants interact with the technology, unless obvious.; From Oct 1, 2026: employers filing a federal layoff notice must tell the Labor Department if the layoffs relate to AI. - Exemptions: Chatbots used only for business operations, customer service, patient care, education or financial services, and not marketed to consumers as a companion.; Limited video-game chatbots, stand-alone voice assistants and narrowly tailored educational tools.; Narrow task-specific tools whose main function is not discussing mental health, and health-support tools that do not act human or meet social or emotional needs.; Companies that only license a model and do not set how it reaches users. - Penalties: An unfair or deceptive trade practice: up to $5,000 per wilful violation, and up to $25,000 for violating an injunction. No private lawsuits. Enforced by Connecticut Attorney General only.. - Sources: Public Act 26-15 (Connecticut General Assembly) ; Conn. Gen. Stat. ch. 735a, including § 42-110o (civil penalties) - Last reviewed: 2026-11-02 ### Tennessee ban on AI posing as mental-health professionals (SB 1580) - Jurisdiction: Tennessee - Citation: Tenn. Public Chapter 647 (2026), Tenn. Code Ann. § 33-1-205 - Status: in force; effective 2026-07-01 - Page: https://botnotice.app/laws/tennessee-ai-mental-health-misrepresentation - Summary: A person who develops or deploys an AI system may not advertise or represent to the public that it is, or can act as, a qualified mental health professional. A violation is an unfair or deceptive act under the Tennessee Consumer Protection Act, with a $5,000 civil penalty per violation. - Who must comply: Anyone who develops or deploys an AI system and advertises or represents it to the public in Tennessee. - What to disclose: No AI notice is required. Do not advertise or represent the AI as a qualified mental health professional, or as able to act as one. - When: Whenever the system is advertised or represented to the public. - Applies to: AI offering emotional support or therapy-like help - Exemptions: None stated in the act. - Penalties: $5,000 per violation, plus the penalties and remedies of the Tennessee Consumer Protection Act, which lets a person with an ascertainable loss sue. Enforced by Under the Tennessee Consumer Protection Act: Attorney General; private lawsuits for an ascertainable loss. Private right of action. - Sources: Tenn. Public Chapter 647 (Tennessee Secretary of State) ; SB 1580 bill information (Tennessee General Assembly) - Last reviewed: 2026-11-02 ### Nevada AI mental-health restrictions (AB 406) - Jurisdiction: Nevada - Citation: Nev. AB 406 (2025), NRS 433.567 - Status: in force; effective 2025-07-01 - Page: https://botnotice.app/laws/nevada-ai-mental-health-ab-406 - Summary: AI providers may not say or imply that an AI system can provide professional mental or behavioral health care, and may not offer a system programmed to do what would be professional care if a person did it. Licensed providers may use AI only for administrative support, not to give care directly. Public schools may not use AI to do the job of a school counselor, psychologist or social worker. - Who must comply: Anyone who operates or provides an AI system for use in Nevada; licensed mental and behavioral health providers. - What to disclose: No AI notice is required. Do not market or present AI as a mental-health provider or as able to give professional care. - When: Ongoing. - Applies to: AI offering emotional support or therapy-like help - Other duties: Providers must independently review AI-generated reports or session notes for accuracy. - Exemptions: Administrative uses (scheduling, billing, records, session notes) by licensed providers.; Self-help materials that do not claim to offer professional care. - Penalties: Up to $15,000 per violation. Enforced by Nevada Division of Public and Behavioral Health; licensing boards discipline providers. - Sources: AB 406 enrolled (Nevada Legislature) ; NRS chapter 433, including NRS 433.084 and 433.567 - Last reviewed: 2026-11-02 ### Illinois Wellness and Oversight for Psychological Resources Act (HB 1806) - Jurisdiction: Illinois - Citation: Ill. Public Act 104-0054 - Status: in force; effective 2025-08-01 - Page: https://botnotice.app/laws/illinois-wellness-oversight-psychological-resources-act - Summary: Only a licensed professional may provide, advertise or offer therapy or psychotherapy to the public in Illinois, including through AI. Licensed professionals may use AI only for administrative and supplementary support, and AI may not make therapeutic decisions, talk with clients therapeutically, or detect emotions or mental states. - Who must comply: Anyone offering therapy or psychotherapy services to the public in Illinois, including through AI; licensed professionals who use AI. - What to disclose: No general AI notice is required. Do not offer AI therapy. A licensed professional using AI on a recorded or transcribed session must tell the patient in writing and get consent. - When: Ongoing; before AI is used on a recorded or transcribed session. - Applies to: AI offering emotional support or therapy-like help - Exemptions: Administrative and supplementary support by licensed professionals, who remain fully responsible.; Religious counseling and peer support.; Public self-help and educational materials that do not claim to offer therapy. - Penalties: Up to $10,000 per violation, set by the Department after a hearing. Enforced by Illinois Department of Financial and Professional Regulation.. - Sources: Illinois Public Act 104-0054 ; HB 1806 bill status (Illinois General Assembly) - Last reviewed: 2026-11-02 ### Illinois AI in Employment amendment (HB 3773) - Jurisdiction: Illinois - Citation: 775 ILCS 5/2-102(L) (Illinois Human Rights Act, Public Act 103-0804) - Status: in force; effective 2026-01-01 - Page: https://botnotice.app/laws/illinois-ai-employment-notice-hb-3773 - Summary: It is a civil rights violation for an employer to fail to give an employee notice that it uses AI for recruitment, hiring, promotion, renewal, training selection, discipline, discharge, tenure or other terms of employment. It is also one to use AI with the effect of discriminating, or to use ZIP codes as a proxy for protected classes. The statute leaves the conditions, timing and means of notice to Department of Human Rights rules. The Department withdrew its draft rules in June 2026, but the notice duty remains. - Who must comply: Employers with Illinois employees or applicants. - What to disclose: Notice that AI is used for employment decisions. The statute says "employee", but the uses it covers include recruitment and hiring, so tell applicants too. - When: The statute sets no time and leaves it to rules not yet adopted. Telling people before AI is used is the safe reading. - Applies to: AI in hiring, screening, or HR decisions - Other duties: Do not use AI in a way that has the effect of discriminating.; Do not use ZIP codes as a proxy for protected classes. - Exemptions: None specified in the statute. - Penalties: Civil-rights remedies under the Illinois Human Rights Act (damages, fees, injunctions). Enforced by Illinois Department of Human Rights and Human Rights Commission; private complaints.. Private right of action. - Sources: 775 ILCS 5/2-102 (Illinois General Assembly) ; Public Act 103-0804 ; 775 ILCS 5/8A-104 (relief) ; Seyfarth: Department of Human Rights withdraws proposed AI rules - Last reviewed: 2026-11-02 ### New Hampshire chatbot protections for minors (HB 143) - Jurisdiction: New Hampshire - Citation: N.H. RSA 639:3, III-a; RSA 507:8-k (2025, ch. 270) - Status: in force; effective 2026-01-01 (RSA 507:8-k says an operator is liable to a child, parent or next friend, and the bill's title promises a private right of action, but the same section says the attorney general "shall have the sole right of action". We mark it as no private suit until a court says otherwise.) - Page: https://botnotice.app/laws/new-hampshire-hb-143-minors - Summary: Applies to owners and operators of online services whose sole purpose is responsive, open-ended generative AI communication. They commit child endangerment, and are civilly liable, if they know when directing a communication to a child that it is made with the intent to facilitate, encourage, offer, solicit or recommend that the child imminently engage in sexually explicit conduct, drug or alcohol use, self-harm or suicide, or violent crime. - Who must comply: Owners and operators of an online service whose sole purpose is responsive, open-ended generative AI communication, reachable by New Hampshire children. - What to disclose: No AI notice is required. The law bans certain communications to children. - When: Ongoing. - Applies to: Chatbot with memory, persona, or relationship features; AI offering emotional support or therapy-like help - Other duties: Do not knowingly direct these communications to a child. - Exemptions: Cloud, telecommunications and information service providers, for content made or supplied by someone else.; AI chat that is integral or incidental to a video game, TV, streaming, movie or similar interactive experience. - Penalties: A misdemeanor under the child endangerment law. Civil liability for damages caused, and at least $1,000 per violation. Enforced by Prosecutors; for civil actions, the New Hampshire Attorney General after 90 days' written notice and a chance to cure.. - Sources: N.H. RSA 639:3 (General Court) ; N.H. RSA 507:8-k (General Court) - Last reviewed: 2026-11-02 ### EU AI Act: Article 50 transparency obligations - Jurisdiction: European Union - Citation: Regulation (EU) 2024/1689, Art. 50 - Status: in force; effective 2026-08-02 (Art. 50(2) machine-readable marking for systems already on the market may be deferred to Dec 2, 2026 under the AI Omnibus; Commission guidelines published May 2026.) - Page: https://botnotice.app/laws/eu-ai-act-article-50 - Summary: Any AI system that interacts directly with people (chatbots, virtual assistants, AI phone systems) must inform them they are dealing with AI unless it is obvious. Deployers must label deepfakes and disclose AI-generated text published to inform the public, and must tell people when emotion-recognition or biometric-categorisation systems are used. Applies to businesses anywhere whose systems reach EU users. - Who must comply: Providers and deployers of AI systems used by people in the EU, regardless of where the business is located. - What to disclose: Clear and distinguishable notice, at the latest at first interaction, that the person is interacting with an AI system; visible labels on deepfakes; disclosure of AI-generated public-interest text. - When: Before or at the first interaction or exposure; not buried in footers or terms. - Applies to: Customer-service / FAQ chatbot; Sales, lead-capture, or booking chatbot; Chatbot with memory, persona, or relationship features; AI phone / voice agent; AI-generated marketing text, images, or video; AI-generated 'people' in ads - Other duties: Do not strip machine-readable AI markers from generated content.; Accessible presentation of notices. - Exemptions: Where AI use is obvious to a reasonably well-informed person.; Assistive edits that don't substantially alter content.; Certain law-enforcement uses. - Penalties: Up to €15 million or 3% of worldwide annual turnover, whichever is higher (the lower amount for SMEs and start-ups). Enforced by National market-surveillance authorities of each EU member state.. - Sources: Article 50 (EU AI Act Service Desk) ; European Commission FAQ — Transparency obligations under Article 50 ; Greenberg Traurig — Commission details transparency obligations under the AI Act (June 2026) - Last reviewed: 2026-09-09 ### UK consumer law: AI agents and chatbots (DMCC Act 2024, CMA guidance) - Jurisdiction: United Kingdom - Citation: Digital Markets, Competition and Consumers Act 2024, Part 4 Chapter 1 (unfair commercial practices); CMA, Complying with consumer law when using AI agents (9 March 2026) - Status: in force; effective 2025-04-06 - Page: https://botnotice.app/laws/uk-consumer-law-ai-agents - Summary: The UK has no AI-specific disclosure statute. Its general consumer law applies instead: since 6 April 2025 the Digital Markets, Competition and Consumers Act 2024 bans misleading actions and omissions that could change a consumer's decision, and the Competition and Markets Authority can enforce it directly. The CMA's March 2026 guidance on AI agents says that if dealing with AI rather than a person might affect a customer's decision, the business should tell them, and that an AI agent should be labelled so customers are not misled into thinking a real person is providing the service. It gives customer-service chatbots as an example. - Who must comply: Every business that deals with consumers in the United Kingdom, including through a chatbot, voice agent or other AI agent. - What to disclose: Do not lead a customer to believe a person is serving them when it is AI, where that could affect their decision. Label the AI agent. - When: Before the consumer relies on the interaction; practically, at the start of a conversation. - Applies to: Customer-service / FAQ chatbot; Sales, lead-capture, or booking chatbot; Chatbot with memory, persona, or relationship features; AI phone / voice agent; AI giving financial, legal, or medical guidance - Other duties: The business is responsible for what its AI agent says, as it is for an employee.; Keep records showing what the customer was told and when. - Exemptions: No formal exemption; the test is whether the practice could affect the average consumer's decision. - Penalties: CMA direct enforcement: fines up to 10% of worldwide turnover, orders to compensate affected consumers. Enforced by Competition and Markets Authority; Trading Standards; consumer rights of redress.. - Sources: CMA: Complying with consumer law when using AI agents (gov.uk, 9 March 2026) ; Digital Markets, Competition and Consumers Act 2024 (legislation.gov.uk) ; Digital Markets, Competition and Consumers Act 2024 (Commencement No. 2) Regulations 2025 - Last reviewed: 2026-10-07 ## Pending bills (not law yet) - United States (federal): FCC AI-voice disclosure rule (NPRM). Proposed in 2024 (FCC 24-84); not in 47 C.F.R. § 64.1200 as of Nov 2, 2026. Would require callers to disclose AI use at the start of AI-generated calls and when getting consent. - United States (federal): GUARD Act. Introduced 2025. Federal companion-chatbot disclosure and minor-protection bill. - United States (federal): Executive Order 14365 / DOJ AI Litigation Task Force. Active. Federal effort to challenge 'onerous' state AI laws in court. Child-safety laws are expressly carved out of preemption. Colorado's Act is already under DOJ challenge. - California: SB 1119 (Adam's Law) chatbot safety. Signed Sept 10, 2026 (Chapter 190); main duties start July 1, 2027. Child-safety duties for companion chatbots that allow users under 18. Folded into the SB 243 entry. - Michigan: SB 760 kids chatbot safety. Passed Senate May 2026; in House committee. Would add disclosure and minor-safety duties. - Pennsylvania: HB 2006 companion chatbot safety / SB 1090 general AI disclosure. Passed one chamber each. SB 1090 (49-1 in Senate) would create general AI disclosure duties. - New Jersey: A4732 / A5272 companion chatbot disclosure. In committee. Would require clear and conspicuous non-human disclosure. - New York: S 9051 kids chatbot safety; S 6954 synthetic content provenance. Passed legislature; awaiting Governor (through Dec 31, 2026). Adds minor protections and provenance labeling. - Massachusetts: S2632 AI therapy ban. Proposed. Would prohibit AI chatbots for therapeutic use. - North Carolina: S 963 Chatbot Licensing Act. In committee. Would license health-related chatbots. - Ohio: HB 813 AI watermarking and disclosure. In committee. General AI content disclosure. Not legal advice. Check the linked sources or a lawyer for your situation.