State chatbot laws are shifting from baseline transparency requirements to a more targeted, risk-based approach, with requirements that vary depending on how chatbots are used. In particular, states are beginning to distinguish among chatbot use cases and to tailor deployer obligations based on how a chatbot interacts with users. As these laws often place compliance obligations on the chatbot deployer, not just the developer, they present shifting compliance obligations on companies that may use chatbots in a range of circumstances.

For companies deploying consumer-facing chatbots, obligations vary depending on whether the chatbot serves basic customer-service functions, engages with users on health-related matters, or supports more immersive, companion-style interactions. The growing patchwork of obligations requires attention to varied state laws and can create risks if companies do not have the proper disclosures or consent in place.

Below, we explore the state patchwork in further detail and highlight practical steps deployers can take to develop compliance strategies and minimize risks.