AI chatbot disclosure laws for ecommerce brands in 2026: California, Utah, Maine and the EU

The short answer: say it is AI at the start and keep saying it

If a chatbot on your store talks to shoppers on its own, have it say it is an AI assistant in its first message and keep a label in the chat header for the whole conversation. Offer a way to reach a person at any point. The rules below point toward that design, and so does the EU AI Act chatbot rule that has applied since 2 August 2026. The wording and placement of the label still matter, so have counsel check them for each market.

Replies drafted by AI and then reviewed and sent by a person are a different case. They go out from your team. Whether those replies mention AI is a policy question to settle with counsel and write down.

This guide describes the rules as we read them in October 2026, for a US brand. It is general information, not legal advice. Have counsel review your chat design for each market you sell into.

California: the bot disclosure law

California Business and Professions Code sections 17940 to 17943 have been operative since 1 July 2019. They make it unlawful to use a bot to communicate with a person in California online with the intent to mislead them about its artificial identity, in order to incentivize a purchase or sale of goods or services. A business using a bot is not liable under the section if it discloses that it is a bot. The disclosure must be clear, conspicuous and reasonably designed to inform the people the bot talks to.

The law defines a bot as an automated online account where all or substantially all of the actions or posts are not the result of a person. A chat assistant that answers shoppers by itself fits that description. A reply drafted by AI and then reviewed and sent by your team is a weaker fit, but confirm with counsel before you rely on that.

Two other California rules come up in searches. The companion chatbot law, SB 243, excludes a bot used only for customer service or a business's operational purposes, so a support bot that stays within those uses falls inside the exclusion. The California Privacy Protection Agency's rules on automated decisionmaking technology took effect on 1 January 2026, with duties for significant decisions from 1 January 2027. Significant decisions cover areas such as financial or lending services, housing, education, employment and healthcare. An ordinary return decision falls outside those areas. Financial services include installment payment plans, so assess separately any AI that decides on financing or payment plans.

Utah: disclose when asked, or from the start for a safe harbor

Utah Code Title 13, Chapter 77 has covered generative AI in consumer transactions since May 2025. A supplier that uses generative AI to interact with a person in a consumer transaction must disclose that the person is dealing with generative AI and not a human, if the person asks. The question has to be a clear and unambiguous request to find out whether they are talking to a human or to AI. The Division of Consumer Protection can fine up to $2,500 per violation, and the law says it is no defense that generative AI made the statement.

Section 13-77-104 adds a safe harbor. A business avoids enforcement under the disclosure section if its AI clearly and conspicuously discloses, at the outset of the interaction and throughout it, that it is an AI assistant, which is one of the statements the section accepts. For a store chatbot this is the simplest standard to design to.

Maine: no chatbot that passes as human

Maine enacted 10 MRSA section 1500-Y in June 2025. A person may not use an AI chatbot or other computer technology in trade and commerce with a consumer in a way that may mislead a reasonable consumer into believing they are dealing with a human, unless the consumer is told in a clear and conspicuous manner that they are not. A violation counts as a violation of the Maine Unfair Trade Practices Act.

The test is whether a reasonable consumer could be misled. A bot with a human first name and a stock photo is the risky design. A clear label from the first message lowers that risk, and counsel should check its wording and placement.

What does not apply to a store support bot today

QueryNow is based in Texas, so we get asked about TRAIGA, the Texas Responsible Artificial Intelligence Governance Act. It took effect on 1 January 2026. Its duty to tell consumers they are dealing with AI falls on state agencies and, for treatment, on health care providers. Private businesses in general are not required to disclose under it.

Colorado's 2024 AI law, SB 24-205, never took effect. SB 26-189, signed on 14 May 2026, repealed and replaced it with rules on automated decisionmaking in consequential decisions, and the attorney general's rules are due by 1 January 2027. Nothing under it is due from a store's support bot today, and whether the new law keeps a general duty to disclose AI chat is still unclear. Keep watching it if you use AI in decisions about people.

The EU AI Act: Article 50(1) from 2 August 2026

Article 50(1) of the EU AI Act requires providers to design AI systems that interact directly with people so that those people are informed they are dealing with an AI system, unless that is obvious to a reasonably well-informed person. Under Article 50(5), the information must be given in a clear and distinguishable manner at the latest at the first interaction. The Act applies generally from 2 August 2026. The Digital Omnibus on AI, Regulation (EU) 2026/1744, published in July 2026, rewrote the Article 50 paragraph on codes of practice and gave some providers more time to mark AI-generated content, but left paragraph 1 as it was.

The Act reaches providers and deployers outside the EU when the output of their AI system is used in the Union, so a US brand whose chat assistant serves EU shoppers should plan for it. A brand that has a chat agent built and runs it under its own name is likely the provider. A brand that uses a helpdesk vendor's bot is a deployer, and the vendor is the provider. Ask counsel to confirm which you are.

Breaches of Article 50 fall under Article 99(4). For most undertakings the ceiling is EUR 15 million or 3% of worldwide annual turnover for the preceding financial year, whichever is higher, while SMEs get the lower of the two figures. The July 2026 amendment gives small mid-cap enterprises the lower figure as well.

AI and reviews: the FTC rule

Reviews are the other place AI meets shoppers. The FTC's Consumer Reviews and Testimonials Rule, 16 CFR Part 465, took effect on 21 October 2024. It bans fake reviews and testimonials, and the FTC said when it announced the rule that this covers reviews generated by AI. It also bans incentives conditioned on a review expressing a particular sentiment, positive or negative, and the use of threats or knowingly false public accusations to suppress reviews.

The FTC's Endorsement Guides add a broader rule: in procuring, suppressing, boosting or editing reviews, a business should not distort what consumers think of its products. Part 465 also lets a business withhold reviews on neutral grounds, such as abusive content or personal information, when it applies those grounds to every review. The FTC's question and answer guidance says asking only happy customers for reviews is not specifically banned by the rule but could violate the FTC Act.

Our recommended controls for an agent near reviews go further than the rule requires. The agent never writes a review. It drafts replies, a person approves each one before it posts, and no reply accuses a reviewer of lying. Review requests go out without any filter on expected sentiment.

The FTC's maximum civil penalty for a knowing violation of a trade regulation rule is $53,088 per violation, for penalties assessed after 17 January 2025. The same caution applies to listings that AI drafts. The FTC Made in USA Labeling Rule applies online, so an origin claim on a product page should come only from a field a person approved.

Keep card data away from the AI

Chat and email are where shoppers paste card numbers. A hosted checkout such as Shopify's sends card entry to the payment processor, and an AI support tool can work from order references instead. Shoppers still paste card numbers into messages, so remove card data from everything the agent reads or logs, and test that control before launch. Have any system that receives the original message assessed for PCI scope. Log every action the agent takes, with the name of the person who approved it.

PCI DSS v4.0.1 has been the only active version of the standard since 31 December 2024. The PCI Security Standards Council's AI principles, published in September 2025, say AI systems should not be trusted with unprotected sensitive data such as unsecured account data, and that a person should stay in the loop and be held responsible. Its September 2026 information supplement adds that AI should be scoped like any other technology when working out which PCI requirements apply.

Worked example: an AI touchpoint inventory

This is an illustrative example with assumed numbers, not a client result. Take a 120-person brand that sells in every US state and ships to the EU. Each month it handles 9,000 chat conversations and posts 400 review replies. Its team also sends 2,500 email replies a month that AI drafted and a person reviewed, and it drafts 300 product descriptions a quarter.

Start by listing every place AI meets a shopper, then match each to its rule and a control. For this illustration, assume a few hours to set up controls such as the disclosure line, plus time for integration testing and checks that recur. Review time is the other recurring cost. At 30 seconds per review reply, 400 replies take about 3.3 hours a month. At 3 minutes per description, 300 product descriptions take 15 hours a quarter.

Penalty figures show the scale of the risk and predict nothing about any one brand. Utah can fine up to $2,500 per violation. An Article 50 breach in the EU can cost up to EUR 15 million or 3% of worldwide turnover, with the lower figure as the cap for SMEs and small mid-cap enterprises, and the FTC can seek up to $53,088 for each knowing violation of its review rule. Against those numbers, a disclosure line and a review step cost very little.

A checklist before launch

Run through this list before any AI talks to shoppers on your behalf. Our five-day AI Workflow Sprint builds these controls into the prototype from the first day, working on copies of your real tickets. It costs $2,500, and the fee comes off the build. Full refund if we do not find 10 staff hours a week.

• The chat opens with a line saying it is an AI assistant, and the header keeps saying so.
• A shopper can reach a person at any point, and someone has tested the handoff.
• Replies a person sends are reviewed first, and your policy says whether they mention AI.
• The agent never writes a review, and review requests carry no filter on expected sentiment.
• Every product claim comes only from a field a person approved.
• Card numbers are removed from model inputs and logs, and someone has tested that.
• Counsel has reviewed the design for each market you sell into.

Common questions