California's Bot Disclosure Law: What SB 1001 Actually Requires

Every few months a business owner reads a headline about AI regulation and concludes that California has made automated phone answering illegal. It has not. California's bot law is narrower and more sensible than the coverage suggests, and complying with it takes about one sentence.

Here is the plain-English version. General information, not legal advice — talk to your attorney about your specific setup.

What the law is

SB 1001, known as the B.O.T. Act, took effect July 1, 2019 and lives at California Business and Professions Code §§ 17940–17943.

The core prohibition: it is unlawful to use a bot to communicate or interact with a person in California, with the intent to mislead the person about its artificial identity, in order to knowingly deceive them about the content of the communication for the purpose of incentivizing a purchase or sale of goods or services in a commercial transaction, or influencing a vote in an election.

There is a safe harbor. A person does not violate the section if the bot discloses that it is a bot — and the disclosure must be clear, conspicuous, and reasonably designed to inform the person that they are communicating with a bot.

What that actually means for a service business

Three things worth noticing about how narrow this is:

Intent to mislead is an element. The law targets deception, not automation. A front desk that identifies itself honestly is not the thing the statute is aimed at.

It is tied to commercial transactions and elections. It is not a general prohibition on automated interaction.

Disclosure is a complete safe harbor. If you disclose clearly, you are within the exception. There is no additional filing, registration, or approval.

So the compliance question is not "can I use this in California." It is "is my disclosure clear and conspicuous."

What clear and conspicuous looks like on a phone line

The statute does not prescribe exact wording. Practical implementations that meet the standard:

In the greeting. A brief statement in the opening that the caller is speaking with an automated assistant. This is the cleanest approach because it happens before the caller invests anything in the conversation.

On request, immediately and honestly. If a caller asks whether they are speaking with a person, the answer is a direct no, followed by continuing to help. Not a deflection, not a joke, not a change of subject.

Both, ideally. The failure mode the statute cares about is a caller who believes they are talking to a human and would have behaved differently if they knew.

What does not meet the standard

Buried disclosure. A mention in the fourth sentence of a long greeting that most callers talk over.

A human name with no clarification. Presenting the assistant with a person's first name and never disclosing is exactly the pattern the law was written about.

Disclosure only in your website terms. A caller on the phone has not read your terms of service.

Evasion when asked. "I'm here to help you today!" in response to "are you a real person?" is the clearest possible bad fact.

Other states have followed

California was first, and it is no longer alone. Colorado, Utah, Maine, and New Jersey all regulate commercial chatbot disclosure in some form, and the FTC's general prohibition on deceptive practices applies nationwide regardless of state law.

The practical implication is that building to the California standard is the efficient choice. One disclosure configuration, deployed everywhere, keeps you clean across the states that regulate it and costs you nothing in the states that do not.

What SB 1001 does not cover

Worth being clear about the boundaries, because these get conflated constantly:

Call recording. That is Penal Code § 632, an entirely separate rule requiring all-party consent for confidential communications. Complying with SB 1001 does not address recording, and vice versa.

Data privacy. California's privacy regime governs what you do with recordings, transcripts, and customer data after the call. Also separate.

Text messaging. Consent and opt-out requirements for SMS are their own regime, largely federal.

Employment decisions. Separate rules apply to automated tools used in hiring.

If you are configuring a front desk in California, all four of those need their own answer.

The five-minute compliance check

Call your own business from a number nobody recognizes and run three tests:

1. Listen to the greeting. Is the automated nature disclosed clearly, early, and in language a distracted caller would catch?
2. Ask directly. Say "am I talking to a real person?" Note exactly what comes back. If it is anything other than a straight answer, that is your fix.
3. Repeat for every entry point. Main line, after-hours, overflow, and every advertising tracking number. The tracking numbers are where gaps hide, because they are usually configured by someone outside the phone system.

Any path that fails is a fifteen-minute configuration change. The reason to do it today is that it is trivial to fix now and awkward to explain later.

The honest bottom line

California's bot law is not an obstacle to using AI on your phones. It is a requirement to be honest about it, which is what you should be doing regardless — a caller who discovers on their own that they were misled is a caller you have lost, and one told plainly at the start almost never cares.

Configure the disclosure, audit every path, document what you did, and move on.

Book a call if you want help auditing your configuration.