AI Chatbot Disclosure Law by State: What Businesses Must Do

TL;DR: State-by-State AI Chatbot Disclosure Law Comparison

The table below is the fastest way to find your jurisdiction. It is not exhaustive, most states have no chatbot-specific law at all, but it covers every law and regulation a US business deploying a customer- or employee-facing chatbot needs to check as of September 2026.

Sources are cited throughout the sections below. Effective dates in this table reflect the status as of September 2026; several have already changed once and may change again — see what's likely coming next.

The Common Denominator: Tell People They're Talking to a Bot

Every law above disagrees on scope, but converges on the same fix: if your chatbot proactively and plainly tells the user it's an AI assistant, before or at the start of the conversation, you clear the disclosure bar in every jurisdiction here, regardless of whether the underlying statute technically applies to you.

Most Heeya-sized businesses fall below the strictest thresholds, California's B.O.T. Act binds only 10-million-visitor platforms, Colorado only bots driving a consequential decision. A five-person firm's FAQ bot is very likely outside the letter of most of these laws today. That is not the same as safe to ignore, for three reasons:

• Thresholds move. Colorado's AI Act has changed its effective date three times since 2024, most recently getting repealed and rewritten entirely by SB 26-189 in May 2026.
• Enforcement tightens without new legislation. A December 2025 city comptroller audit found NYC's decade-old Local Law 144 weakly enforced; the city has since adopted a formal enforcement workbook, tightening the posture without changing a word of the statute.
• Disclosure is nearly free. A one-line opening message and a visible badge cost nothing next to retrofitting disclosure after a demand letter arrives.

If your users also include anyone in the EU, disclosure is not optional at all: see our EU AI Act chatbot compliance guide for Article 50's enforceable transparency duty.

Sector-Specific Traps: Where a "Simple" Chatbot Becomes a Legal Problem

The statutes above mostly exempt general customer-service and FAQ bots. The traps below are the specific features and use cases that pull an otherwise-exempt chatbot back into scope.

Healthcare: diagnosis and treatment language, not just PHI

Texas's TRAIGA imposes a disclosure duty on healthcare providers using AI in diagnosis, treatment recommendations, or triage, separate from any HIPAA question, and Utah names health care among the occupations subject to its "high-risk interaction" trigger. The safest architecture for a medical, dental, or wellness bot: answer from published content only, hours, insurance, services, scheduling, and hand off anything resembling symptoms or treatment advice to a human. That is the pattern behind Heeya's dental practice chatbot: informational answers, a clear human handoff, nothing diagnostic. It is also the same zero-PHI architecture covered in depth in our HIPAA compliant chatbot guide, which this disclosure duty sits alongside rather than replaces.

HR and hiring: self-service is fine, screening candidates is not

NYC Local Law 144 and Illinois HB 3773 both target one function: using AI to screen, rank, or score candidates, or to influence hiring, promotion, discipline, or discharge. A bot answering PTO or benefits questions from your handbook is not an automated employment decision tool under either law, that's the employee self-service use case. The line is crossed the moment you feed it resume text and ask it to shortlist candidates, triggering NYC's bias audit and 10-day notice, and Illinois's notice requirement from January 1, 2026. Keep hiring with a human and an applicant-tracking tool; use a chatbot for HR only for self-service.

Financial services: information is fine, advice and approval decisions are not

Colorado's consequential-decision trigger names financial and lending services explicitly; Utah's high-risk tier covers licensed financial advisors. Listing loan products or rates is informational. Telling an individual whether they personally qualify is a decision, exactly what these laws target, and the kind of interaction California's coming ADMT rules will treat as "significant" once they phase in. Keep the bot to product and rate information; route applications to a loan officer or secure portal.

Ecommerce is the lowest-risk category, with one caveat. SB 243 explicitly excludes ordinary customer-service and business-operations bots, so a straightforward order-status bot isn't what the law targets. The caveat is personalization: a bot built to remember a shopper's preferences and sustain an ongoing, relationship-like persona is exactly the profile SB 243 was written to catch. Keep an ecommerce chatbot's tone transactional and disclose it's AI regardless.

What to Actually Write in Your Widget

The wording below is deliberately plain, no "smart assistant" euphemisms, because every law reviewed here that requires disclosure requires it to be unambiguous. Adapt these to your product; the structure (state it's AI, state the limitation, give a human option) is what matters.

Pair the opening message with a persistent visual cue, a small "AI Assistant" label near the chat bubble that's visible without opening the widget. A message the user can scroll past does not satisfy the "clear and conspicuous" standard used across these statutes; a label they see before they click does. Heeya's widget includes a configurable AI disclosure element and opening-message field for exactly this reason, though the specific wording and placement decisions above remain yours to make and have reviewed. That badge also has to be usable by screen-reader visitors, not just visible ones; see our ADA/WCAG chat widget checklist for how to implement it without failing an accessibility audit.

Transcripts: Retention, Deletion Requests, and What Counts as Personal Information

A chat transcript is not exempt from privacy law just because a bot generated half of it. Under the CCPA/CPRA, any identifier collected in the course of a conversation, a name, an email address, an IP address, a user account ID, makes that transcript "personal information," which gives California residents the right to know what's stored, request deletion, request correction, and opt out of its sale or sharing.

Two things are changing on a defined timeline, not speculatively:

• ADMT rules are finalized, not proposed. The California Privacy Protection Agency's regulations on automated decision-making technology were approved by the Office of Administrative Law on September 23, 2025. Compliance for AI that drives a "significant decision" (employment, financial or lending, healthcare, housing, or education access) begins January 1, 2027, with pre-use notice and risk-assessment obligations specifically starting April 1, 2027.
• A plain customer-service chatbot likely falls outside the "significant decision" trigger, the same logic that keeps most support bots out of Colorado's consequential-decision rules, but this is a reasoned interpretation of the regulation's scope, not a bright-line carve-out stated explicitly for chatbots. If your bot influences employment, lending, healthcare, or housing outcomes in any way, treat ADMT as applicable and get counsel's read before 2027.

Practically, every deployment needs a retention and deletion policy before launch: how long transcripts are kept, who can retrieve them, and a documented process to fulfill a delete request in time. Our guide on AI chatbot data security for enterprise deployments covers the operational side. One caveat for US buyers: Heeya's infrastructure is EU-hosted (OVH), a genuine advantage under GDPR, but EU hosting doesn't exempt a US business from CCPA, those obligations run to your business, not to where a vendor's servers sit.

A Deployment Checklist

Work through this before launch, and again every time you add a new capability (scheduling, personalization, document upload) to an existing bot.

• Identify every state (and NYC specifically, if hiring is involved) where your customers or employees interact with the chatbot
• Add a plain, visible "AI assistant" disclosure before or at the start of every conversation, the shared baseline across every law in this guide
• Add a persistent visual badge near the chat widget, not just an opening message that can be scrolled past
• Confirm the bot never screens, ranks, or scores job candidates without a full review against NYC LL144 and Illinois HB 3773
• Keep healthcare-adjacent bots limited to hours, insurance, services, and scheduling; hand off anything diagnostic or treatment-related to a human
• Keep financial or lending bots limited to product and rate information; route applications and personal eligibility questions to a licensed professional
• Add a visible, working human-contact option inside the widget itself
• Document which AI model or vendor powers the bot and what data sources inform its answers
• Set and document a transcript retention and deletion policy, and confirm how a CCPA access or delete request would actually get fulfilled
• Calendar a compliance review every six months; this landscape has changed materially more than once in the past eighteen months alone
• Have counsel review the final configuration before launch, especially for HR, healthcare, or financial services use cases

What Is Likely Coming Next

Three things to watch rather than assume are settled:

Colorado's January 2027 date may not be final. The AI Act has already been rewritten once, from SB24-205 to the narrower SB 26-189, and law firm trackers note pending litigation (including a challenge from x.AI) that could still affect implementation.

California's ADMT enforcement ramps up through 2027. The regulations are final, but phased compliance dates (January 1 and April 1, 2027) mean the practical enforcement reality, including clearer guidance on what counts as a "significant decision", is still ahead.

NYC and Illinois enforcement is tightening without new statutes. NYC's 2025 comptroller audit and new enforcement workbook, plus Illinois rulemaking still being finalized for HB 3773, both point toward stricter enforcement of laws already on the books. A wait-and-see approach to hiring-tool compliance is riskier in 2026 than it was in 2023.

More states are actively considering AI transparency and employment-AI bills; this list will be out of date within months by design, exactly why disclosure-by-default, not disclosure-by-threshold, is the more durable strategy.

Frequently Asked Questions About AI Chatbot Disclosure Law

Further Reading