California AI Chatbot Laws: BOT Act, SB 243, and AB 1609

Picture an online store whose chat assistant introduces itself as Maya. She has a friendly avatar, says things like “give me one second to check that,” and quietly closes a surprising number of sales. Her instructions say nothing about being human in either direction. Is that a problem in California?

It can be, and as of this fall the answer carries more weight. California regulates AI chatbots through several laws that stack on top of each other. The 2019 BOT Act already makes it unlawful to use a bot that misleads people about being a bot in order to drive a sale. SB 243 has governed companion chatbots since January 1, 2026. On September 28, 2026, Governor Newsom signed AB 1609, the Right to Human Customer Service Act, which bars large businesses from passing off a customer service chatbot as a person and requires a real path to a human.

If your chatbot talks to customers in California, at least one disclosure rule probably applies to it already. The harder question is who inside your organization owns that answer.

What California Laws Regulate AI Chatbots?

California has no single chatbot statute. It has a stack, written in different years for different problems, and one sales or support bot can fall under more than one of them. Here is where each piece stood as of mid October 2026.

The BOT Act: the 2019 law most sales teams forgot about

For anyone using AI to sell, the oldest law in the stack matters most. California’s BOT Act, codified at Business and Professions Code section 17941, makes it unlawful to use a bot to communicate with someone in California online with the intent to mislead them about its artificial identity in order to encourage a purchase or sale of goods or services. The statute gives you a way out in the form of a disclosure that is clear, conspicuous, and reasonably designed to tell people they are dealing with a bot.

When legislators wrote it in 2018, they were mostly thinking about automated social media accounts pushing products and political messages. Those bots were crude by today’s standards and fairly easy to spot. Generative AI changed what a bot can do in a conversation. A modern sales assistant can match your tone, remember what you asked about ten minutes ago, apologize for a delay that never happened, and close with a discount code at exactly the moment you hesitate. That is a far more persuasive presence than anything the BOT Act’s authors had in front of them. The law’s language still covers it, because the test turns on intent to mislead and a commercial purpose, not on the technology. There is no revenue threshold and no minimum audience size for the businesses using the bot. A local car dealership with an AI chat widget is as exposed as a national retailer.

SB 243: companion chatbots and the reasonable person test

SB 243 is the law that made national headlines. It defines a companion chatbot as an AI system with a natural language interface that gives adaptive, humanlike responses and can sustain a relationship across multiple interactions. Operators must tell users clearly that they are talking to AI whenever a reasonable person could otherwise be misled. They also need published protocols for responding to suicidal ideation and self harm, reminders at least every three hours for users known to be minors, and annual reports to the state’s Office of Suicide Prevention starting July 1, 2027. Senator Steve Padilla’s office has a plain language summary of SB 243 if you want the legislative history.

Bots used solely for customer service or business operations are excluded. For most sales deployments that exclusion holds. Where I start to worry is when marketing teams give a bot a personality, memory across sessions, and an emotional register designed to keep people chatting. “Solely” is a narrow word. A brand assistant that remembers your name, asks how your week went, and nudges you to come back every few days starts to resemble the products SB 243 was written for. SB 243 also lets users sue directly, which changes the risk math in a way the BOT Act never did.

AB 1609: the new customer service chatbot law

AB 1609, authored by Assemblymember Rick Chavez Zbur, applies to businesses with more than $500 million in gross annual revenue that sell goods or services to California consumers. It prohibits representing a customer service chatbot as a human. The law also requires a disclosure when a reasonable person would be misled into thinking they are talking to a person, even if the business never made that claim outright. Covered businesses must offer an easy way to request a human during business hours and make a good faith effort to connect within 15 minutes, or offer an appointment with a person within one business day. Requests sent by email, web form, or voicemail are outside the 15 minute rule.

The governor’s office framed the bill around everyday frustration, promising less time “running in circles with customer service chatbots.” Enforcement sits with public prosecutors, and there is no private right of action. The bill summaries don’t name a delayed start date. California statutes without an urgency clause generally take effect on January 1 of the following year, so plan around January 1, 2027 and confirm against the chaptered bill text.

SB 1119 and the rest of the country

SB 1119, known as Adam’s Law, takes effect January 1, 2027 and pushes companion chatbot operators further. It requires a child safety risk assessment before launching features likely to reach minors, along with age assurance, independent audits, and penalties up to $15,000 per affected child for intentional violations.

California is far from alone here. At least 15 other states, including New York, Utah, Colorado, and Washington, have passed chatbot laws of their own, and many of their effective dates land in 2027.

Why Should Organizations Care If They Fall Under the $500 Million Line?

Because the revenue threshold belongs to only one of these laws. The BOT Act applies to any person using a bot, with no size cutoff. SB 243 applies to any operator that makes a qualifying chatbot available to a user in California, which means a company in Ohio or Germany is covered if Californians can reach the product. Building on a third party model doesn’t move the obligation to the model provider either. The business offering the chatbot to users stays responsible for what it says.

There is also the contract problem. Large enterprises that do fall under AB 1609 will push disclosure and handoff requirements down to their vendors, agencies, and platform partners. If your company builds or runs chat experiences for bigger clients, expect those questions in security questionnaires and master service agreements well before any regulator calls.

My European clients will recognize all of this. The EU AI Act’s Article 50 transparency rules, which require telling people when they are interacting with an AI system, began applying on August 2, 2026. A company selling into both markets now has two regimes asking for nearly the same disclosure, which makes a single global standard the cheapest path.

Where Do Sales Chatbots Go Wrong?

My background is behavioral psychology, and this is the part of the topic I find most interesting. People extend trust to things that feel human. A name, a face, a typing indicator, and a little small talk all make a visitor more willing to share details and more likely to accept a recommendation. Marketing teams add those cues for that reason, and the law cares about them for the same one.

The failures I run into are rarely malicious. They come from good intentions and nobody owning the decision.

Shadow bots worry me most, because every other failure on that list is easy to fix once someone knows the bot exists.

How Do You Make a Customer Facing Chatbot Compliant in California?

None of this requires a large legal budget. It requires someone to look at what the bot actually does and write down who is accountable for it.

Inventory every bot that talks to customers

Check your website, mobile app, SMS programs, social media inboxes, and any marketing or CRM platform with a built in assistant. Record who owns each one, what model it runs on, and which vendor hosts it.

Disclose at the start of the conversation

Put the disclosure in the first message, in plain words, before the bot asks for anything. A line like “I’m an AI assistant. You can ask for a person at any time.” handles the BOT Act and the reasonable person test in SB 243 and AB 1609, and it happens to match the EU rule too.

Test what the bot says when someone asks if it’s human

Ask it directly and sideways, then try again after a long conversation. Bots that answer honestly in a fresh session sometimes drift after twenty turns of friendly back and forth.

Build the human handoff before you need it

Even if you sit below the AB 1609 revenue line, a working escalation path is the simplest proof that your bot was never meant to trap anyone. Log every handoff request and how long it took.

Treat the system prompt like a controlled document

The instructions that tell a bot how to behave are policy. Changes should go through review, keep a version history, and include a check that the disclosure language survived the edit.

Read the vendor contract

Find out who is responsible for disclosure, logging, and crisis handling under your agreement. If the contract is silent, you are carrying all of it.

Why AI Training Is Now a Compliance Issue

Every law in this article regulates choices people make while building and running a system. Somebody picks the persona and writes the prompt, and someone else decides whether an escalation button exists at all. Those people usually sit in marketing, sales operations, or customer experience, and most of them have never read a word of state AI law.

That gap is where training earns its keep. Teams deploying chatbots need enough AI literacy to understand how these systems behave, where they drift, and why a disclosure line matters. A course like Training Camp’s AI Foundations Boot Camp covers that ground for people who use and configure AI tools every day. The people who own policy need something deeper. If you are the one writing the rules, start with what AI governance actually means in practice, then look at how the AIGP maps to the EU AI Act, NIST AI RMF, and ISO 42001, since the same governance habits satisfy California and Brussels at once. Privacy teams will also find overlap with the data handling basics in why data privacy matters, because every chatbot conversation is personal data the moment a customer types their name.

Frequently Asked Questions About California’s AI Chatbot Laws

Does California require chatbots to disclose that they are AI?

Yes, in several situations. The BOT Act requires a clear disclosure when a bot is used to encourage a sale or influence a vote and could otherwise mislead people about being a bot. SB 243 requires companion chatbots to disclose that they are AI when a reasonable person could be misled, and AB 1609 imposes a similar rule on customer service chatbots at businesses with more than $500 million in annual revenue.

What is California AB 1609?

AB 1609 is the Right to Human Customer Service Act, signed by Governor Newsom on September 28, 2026. It applies to businesses with more than $500 million in gross annual revenue that serve California consumers, prohibits presenting a customer service chatbot as human, and requires a good faith effort to connect customers with a human agent within 15 minutes or offer an appointment within one business day.

When does AB 1609 take effect?

The bill was chaptered on September 28, 2026 as Chapter 733. California laws without an urgency clause generally take effect January 1 of the following year, so businesses should plan for January 1, 2027 and confirm the operative date in the chaptered text.

Does SB 243 apply to sales or customer service chatbots?

Usually not. SB 243 excludes bots used solely for customer service, business operations, productivity, internal research, or technical assistance. A sales bot designed with a persistent personality, memory, and relationship building features can drift toward the companion chatbot definition, so review those features carefully.

What are the penalties for violating California’s chatbot laws?

The BOT Act is enforced by the Attorney General under the Unfair Competition Law. AB 1609 carries civil penalties of up to $5,000 for a first violation and up to $10,000 for each later violation, enforced by public prosecutors. SB 243 lets injured users sue for actual damages, injunctive relief, and attorney’s fees, and SB 1119 adds penalties up to $15,000 per affected child for intentional violations starting in 2027.

Do California chatbot laws apply to companies outside California?

Yes. SB 243 applies to any operator that makes a covered chatbot available to users in California, and the BOT Act covers bots communicating with people in California online. A company headquartered in another state or country can still be covered.

How can my team get trained on AI governance and compliance?

Start with AI literacy for the people who configure and deploy chatbots, then add formal governance training for the people who own policy. The IAPP Artificial Intelligence Governance Professional (AIGP) credential is a common choice for governance owners, and Training Camp offers an AIGP Boot Camp alongside its broader AI courses.