Just Tell Them It's AI

This is not legal or professional advice. I am not a lawyer. The sources I cite may be incomplete, my interpretation of them may be wrong, and the law changes. Do your own research and hire a qualified attorney before you act on any of this.

There is no single AI disclosure law. There's a federal enforcement backbone that already covers some of this without ever using the word "AI," a federal rule specifically about AI disclosure that's been proposed and stalled for two years, and a wave of state statutes moving so fast that one state's flagship AI law was repealed and rewritten before it ever took effect. Knowing which layer applies to your specific use case, chatbot, voice agent, or generated content, is the actual compliance question. Here's what's real right now.

What's already binding, federally

The Federal Communications Commission ruled on February 8, 2024 that an AI-generated voice counts as an "artificial voice" under the TCPA. That ruling took effect immediately and is still the law. It doesn't ban AI voice calls. It means an AI voice call is regulated exactly like any other artificial or prerecorded voice call always has been: you need the caller's prior express consent (written consent if it's telemarketing), you have to identify who's calling, and you have to offer a way to opt out. None of that is new. What's new is that AI voice no longer gets treated as a gray area. The same $500 to $1,500 per-call exposure covered in the telemarketing piece on this site applies in full.

What's not binding yet: a specific requirement that an AI voice call announce itself as AI at the start of the call. The FCC proposed exactly that in August 2024, alongside a matching requirement for AI-generated texts. Comments closed at the end of that year. As of this writing, it still hasn't been finalized into a rule, and multiple firms tracking the docket now expect a final rule sometime between late 2026 and early 2027, if it comes at all under an FCC leadership that has signaled a lighter regulatory touch. Build to the proposed standard now if you're running AI voice or text outbound. Don't assume it's required yet.

Separately, the FTC's ordinary deception authority, the same Section 5 covered in the blue bubble piece, already applies to AI the same way it applies to anything else. In September 2024 the agency opened "Operation AI Comply," a sweep against companies overstating what their AI does. The first case named DoNotPay, which marketed an "AI lawyer" that had never been tested against an actual attorney's work; DoNotPay settled for $193,000. The operation has continued past the change in administration, though the agency walked back at least one of its own orders in December 2025 after concluding the original complaint didn't hold up. That's a small, honest data point that the FTC's own AI enforcement isn't uniformly settled either.

What states are actually doing, and it's not uniform

California runs two separate laws that don't cover the same thing. The older one, SB 1001 (2019), makes it unlawful to run a bot that intentionally misleads someone about being a bot, if the bot is trying to sell something or influence a vote. It only applies to platforms with more than 10 million monthly U.S. visitors, and California's Attorney General enforces it through the state's unfair competition law, not a private lawsuit, for up to $2,500 per violation. Most small and mid-size business chatbots fall outside this one on the visitor-count threshold alone. The newer one, SB 243, took effect January 1, 2026 and is scoped specifically to companion chatbots, the emotional-connection kind, not ordinary customer service bots. It requires proactive disclosure at the start of a session (not just when asked), plus crisis-referral protocols if a user signals self-harm risk. A bill to extend SB 243's proactive standard to ordinary customer service bots, AB 1609, was still moving through committee as of this spring. Until it passes, an ordinary sales or support chatbot in California is governed by the older, narrower, threshold-gated law, not the new strict one.

Utah went the other direction. Its AI Policy Act originally required broader disclosure, then got narrowed by a 2025 amendment. As it stands now, a business using generative AI to interact with customers only has to disclose that fact if the user directly and clearly asks, or in specific high-risk interactions. That's a lower bar than California's companion-chatbot rule.

Colorado is the cautionary tale for the whole category. In 2024, Colorado passed the country's first comprehensive AI law, a broad risk-based framework covering AI used in employment, housing, credit, and healthcare decisions. It never took effect as written. The legislature delayed it once, delayed it again, and in May 2026 repealed it outright and replaced it with a much narrower disclosure-and-rights framework focused on automated decision-making tools, now scheduled for January 1, 2027, pending the state Attorney General finishing rulemaking. A state's most ambitious AI law collapsed under its own compliance cost before a single business was ever required to follow it. That's the environment this is moving in.

A real wave of new state laws hit in 2026, and several of them have teeth. New York's AI companion law has required proactive AI disclosure plus crisis-referral protocols since November 2025. Washington and Oregon each passed chatbot disclosure laws this year that include something California's laws don't: a private right of action. Oregon's carries statutory damages of $1,000 per violation, meaning an individual user, not just a state regulator, can sue directly. Nebraska, Idaho, Connecticut, and Tennessee all passed their own versions this year, mostly focused on companion and mental-health-adjacent bots, mostly requiring disclosure at the start of a session and periodic reminders during it. The pattern across nearly all of them: disclose you're AI before substantive conversation starts, disclose again if asked, and if the bot operates anywhere near emotional support or mental health, add crisis-referral protocols on top.

What this actually means for a business running AI chatbots or voice agents

The honest floor, regardless of which state your users are in or which of these laws technically covers your specific bot: disclose that it's AI, clearly, at the start of the interaction, and again if asked. That single practice satisfies the strictest version of every law above, sits comfortably inside FTC Section 5's deception standard, and costs nothing to implement. The laws that don't yet require it in your state might next year. The ones that already do carry real penalties, and a couple of them let the user sue you directly for a fixed dollar amount per conversation.

Waiting to find out which specific statute applies to your specific bot before you disclose is optimizing for the wrong variable. The floor is cheap. The patchwork is not.

Again: this is not legal or professional advice. Sources can be incomplete and interpretations can be wrong. Verify anything here against the primary source and talk to a qualified attorney before you act on it.