Bot or Not: California Mandates Disclosure of Online Accounts Used by Bots

February 11, 2019

On September 30, 2018, California Governor Jerry Brown signed into law Senate Bill 1001, the nation’s first “bot” disclosure regulation. The law, which takes effect on July 1, 2019, requires that any automated online account, which constitutes a “bot,” conspicuously identify itself as a bot if it is being used to engage a person in California in order to influence the person to make a purchase or vote. This requirement cannot be met by conveying the disclosure in fine print. Although SB 1001 is a California law, its broad language covers all communication with a person in California. Thus, this new rule could affect how companies across the nation manage customer relationships and advertise. 

SB 1001 is shorter than most laws and seems straightforward, but its broad terms could encompass a wide range of e-commerce. The law does not provide aggrieved consumers a right to sue, but it is part of California’s Unfair Competition Law, which gives the state Attorney General broad enforcement authority to levy fines of up to $2,500 per violation, as well as equitable remedies.

Bots come in many forms and are growing in number every day. In 2017, researchers estimated that as many as 15% of Twitter’s active accounts were used by bots, many of which were used deceptively. In 2018, Twitter purged spam bots from its site, at a rate of 9.9 million accounts per week. Various other types of software could also be considered a “bot” under this new law. For example, many companies use automation to schedule the posting of promotional messages on social media during peak viewing hours. Other bots on websites manage customer relations online, such as fielding user questions and directing users to appropriate resources. In 2018, Google gave a demonstration of “Duplex,” an artificial intelligence-based assistant that used natural language processing and speech synthesis to place a telephone call to a local business to make a restaurant reservation, engaging in interactive conversation that even included filler speech (e.g., "um," "ah") and pauses to sound like a human.

The new California law does not prohibit all of these technologies or even require disclosure in all cases. However, the fines for violations are potentially steep, and the law reaches beyond the borders of California. Although disclosures are required only when a bot interacts online with a person in California, it is difficult to know for certain whether any given user is in California, and companies using bots might be compelled to issue the required disclosure to all users to avoid liability. At a maximum fine of $2,500 per violation, even a website with only a few dozen daily visitors could rapidly accumulate hundreds of thousands of dollars in fines.

It is important to note that these terms, such as "engage" and "interact," aren’t defined. As such, companies using bots should proceed with caution because the language is broad, and seemingly normal and innocuous marketing behavior could fall within its ambit. If you would like assistance with complying with California’s bot law, please contact one of our Information Technology attorneys.