California's bot law only bites when deception is the point

The conversation

California's Bot Disclosure Act, passed as Senate Bill 1001 and codified in the Business and Professions Code, became operative on 1 July 2019. It does not regulate chatbots as a category. Instead, the statute's own text makes it unlawful to use a bot to communicate with someone online, with intent to mislead them about the bot's artificial identity, to incentivize a purchase or sale or to influence a vote in an election. The law grew out of concern about automated accounts posing as people, not ordinary customer-service chat.

What the documents show

The codified statute, Business and Professions Code section 17941, defines a bot as an automated online account where all or substantially all posts are not the result of a person, and it limits liability entirely: a person using a bot faces no violation if the bot discloses that it is one. Section 17940 narrows the law further by defining an online platform as a site or app with 10 million or more unique monthly United States visitors for most of the preceding year, so smaller sites fall outside the regime described here. The disclosure itself must be clear, conspicuous and reasonably designed to inform the person they are dealing with a bot; the statute's own history note records it was added in 2018, took legal effect 1 January 2019, and became operative 1 July 2019.

The system boundary

The boundary the statute draws is around intent and context, not around the presence of automation itself. A support bot, a scheduling assistant or a research tool that never pretends to be a human, and that is not being used to push a sale or a vote through deception, sits outside section 17941 as written. The disclosure duty is also a safe harbor: once a bot operator disclosure that clears the ‘clear, conspicuous’ bar exists, the statute's own text removes liability, which functions as the law's built-in escalation path from silence to compliance rather than a ban on bot use.

Where it fails

The statute's text does not name an enforcement agency or private right of action within section 17941 itself, and it applies only above the 10-million-visitor threshold, so a great many bot deployments, including most small and mid-sized business chatbots, are not reached by this particular law at all. A builder relying on SB 1001 alone for disclosure practice would be relying on a narrower rule than the phrase ‘bot disclosure law’ suggests.

• Does the deployment ever operate with intent to mislead a person about a purchase, sale, or vote, the specific conduct this statute reaches?
• Does the operating platform meet or fall under the 10-million-visitor threshold that triggers the law's coverage?
• Is a clear and conspicuous bot disclosure already built into the interaction, regardless of whether this particular statute applies?

This entry describes only what the codified California statute states; it is not a general guide to when a chatbot should identify itself, a question other states and the EU AI Act answer more broadly.