California’s Bolstering Online Transparency Act — SB 1001 of 2018, operative from 1 July 2019 — is usually described as requiring chatbots in California to identify themselves. It does not. It prohibits a specific kind of deception and offers disclosure as the way out of liability, and the difference decides whether the statute applies to your product at all.
The operative provision
The Act is codified at Cal. Bus. & Prof. Code §§ 17940–17943; the text is published by the California Legislative Counsel at leginfo.legislature.ca.gov. The prohibition in § 17941(a) is built from three stacked requirements, all of which must be present:
- a person uses a bot to communicate or interact with another person in California online;
- with the intent to mislead the other person about its artificial identity;
- for the purpose of knowingly deceiving the person about the content of the communication, in order either to incentivise a purchase or sale of goods or services in a commercial transaction, or to influence a vote in an election.
Two separate mental states, then, plus a purpose limitation. A support bot that never pretends to be human, and whose operator has no intention that anyone be misled about anything, is outside § 17941(a) even if it never says “I am a bot”. That is the opposite of how the statute is usually summarised.
This describes what the section says; it is not legal advice, and intent is a fact question decided on evidence about your organisation, not on the text of a disclosure. The safe practice — disclosing — is cheap and is discussed below.
What counts as a bot
§ 17940 defines a bot as an automated online account where all or substantially all of the actions or posts of that account are not the result of a person. Three observations follow.
First, the definition is account-shaped. It was drafted with social media in mind, and applying it to a chat widget embedded in a website, a voice agent on a phone line, or an API-driven assistant inside somebody else’s product requires some construction. Nothing in the section says an “account” must be on a social network, but the fit is imperfect and no California appellate decision has settled it.
Second, “all or substantially all” means a hybrid does not escape by having a human occasionally intervene, but it also means an agent that drafts messages a human reviews and sends is arguably not a bot at all. Where the line is has not been litigated.
Third, “online” is defined broadly in § 17940 as appearing on any public-facing internet website, web application or digital application, including a social network or publication. It is not restricted to social media, and it is not restricted by size.
Two purposes, and nothing else
The purpose limitation is the boundary of the statute and it is startlingly narrow given how the law is discussed. The deception must be aimed at incentivising a purchase or sale of goods or services in a commercial transaction, or at influencing a vote in an election.
That leaves a great deal outside. A bot that manufactures the appearance of grassroots support for a policy, that impersonates a human in a customer service context without any transaction in view, that runs an emotional-companionship product, or that generates political content outside an election context, is not covered by § 17941(a) on its face. Those harms are real; this is not the statute that addresses them. Some are reached by the general unfair-competition law, some by newer California statutes, and some by nothing at all.
§ 17941(b) then supplies the safe harbour: a person does not violate the section if the person discloses that the communication is from a bot. The disclosure must be clear, conspicuous and reasonably designed to inform the person that they are communicating with a bot. There is no prescribed form, no prescribed timing beyond that, and no requirement to repeat it — but “reasonably designed to inform” is an objective test, so a disclosure buried in a terms page is not one. Because the safe harbour is cheap and the intent analysis is expensive, disclosing is the sensible default even where the prohibition plainly does not apply.
The ten-million-visitor misreading
A very large number of summaries state that SB 1001 only applies to platforms with at least ten million unique monthly United States visitors. That figure is in the Act, and it is not in the prohibition.
§ 17940 defines “online platform” using the ten-million-visitor test, and “online platform” is the term used in § 17942, which provides that the chapter does not impose a duty on service providers of online platforms — including a duty to affirmatively review, monitor or enforce compliance. The threshold is therefore part of an immunity for large platforms, not a scope limit on the duty imposed on the person deploying the bot. The prohibition in § 17941 uses “online”, which has no size test.
Practically: a two-person company running a bot on its own website has no ten-million-visitor exemption. A large platform hosting other people’s bots has no policing duty. Those are different propositions and the summaries collapse them.
Enforcement, and what has replaced it
The Act contains no enforcement provision of its own: no agency is named, no penalty is set, and no private right of action is created in terms. Whether a violation can be pursued through California’s Unfair Competition Law, Bus. & Prof. Code § 17200, as an unlawful business practice is an open question that has not been answered by a published California decision, and a UCL plaintiff would still need to establish standing through injury in fact and lost money or property. The honest summary is that SB 1001 has been enforced rarely if at all, and that its practical force has been as a drafting reference and a compliance baseline rather than as a source of litigation.
What has changed since 2019 is everything around it. California has added disclosure and provenance duties that are broader and that do come with enforcement: the AI Transparency Act’s provenance requirements on large generative AI providers, discussed in the SB 942 page; a healthcare-specific disclosure duty for AI-generated clinical communications; digital replica provisions covering performers; and legislation on companion chatbots aimed squarely at the emotional- interaction case SB 1001 does not reach. Other states have taken the general route instead — Utah’s AI Policy Act ties disclosure to being asked and to regulated occupations, and Colorado requires it whenever a consumer interacts with an AI system unless it would be obvious.
The European position is different again and worth knowing if you ship in both markets: Article 50 of the EU AI Act imposes an unconditional duty to inform natural persons that they are interacting with an AI system unless it is obvious to a reasonably well-informed person, with no intent element and no commercial-purpose limit, and it is backed by the Act’s penalty regime. That is set out in the chatbot disclosure duty page. A product built to satisfy Article 50 satisfies SB 1001 many times over; the reverse is not true.
Top comments (0)