# Live chat, privacy and the law: what a US business should check

> What a small US business should check before putting a live chat widget or AI chatbot on its website: California CIPA chat-wiretapping suits, the status of SB 690, bot-disclosure laws, CCPA notice, TCPA texting consent and HIPAA. Status as of 18 September 2026.

Published: September 18, 2026 · Updated: September 18, 2026 · Prices and limits verified: September 18, 2026 · By the live-chat.reviews team

This page was researched and drafted with AI assistance from the sources listed on it. We have not installed or tested these products ourselves. Method: [How we review](https://live-chat.reviews/en-us/how-we-review)

The United States has no general federal privacy statute. For a small business adding a chat widget, the risk that costs real money is a California wiretapping claim over the third-party vendor behind the widget. Everything below states the position as of 18 September 2026 and links to the statute, regulator or analysis it rests on.

> **General information, not legal advice.** This page summarizes public sources for buyers of chat software. It is not legal advice, it does not cover every state, and several points below are marked as unverified. If you receive a demand letter or handle health or financial data, talk to a lawyer licensed in your state.

**The short version**

- Show a notice at or above the chat input **before the first message**: chats are recorded, a named third-party vendor processes them, link to the privacy policy.
- Read the vendor contract: the vendor may use transcripts only to provide the service to you, with no model training or product improvement for its own benefit.
- Label an AI bot as a bot in its first message, and make it answer "am I talking to a human?" truthfully.
- Do not rely on SB 690. It does not cover chat-wiretapping claims.
- Get prior express written consent before sending marketing texts to numbers collected in chat.
- Health providers: sign a business associate agreement with the chat vendor before any patient information goes through chat.

## Why a chat widget gets a California business sued

The California Invasion of Privacy Act (CIPA) dates from 1967. [Penal Code § 631(a)](https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=PEN&sectionNum=631) punishes reading a communication in transit without the consent of all parties, and its fourth clause reaches anyone who "aids, agrees with, employs, or conspires with" the person doing so. A website cannot eavesdrop on its own conversation. The theory therefore runs through the vendor: the chat provider is cast as a third party intercepting the visitor's messages, and the site owner as the one who aided it.

The money comes from [Penal Code § 637.2](https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=PEN&sectionNum=637.2), which allows a civil claim for "Five thousand dollars ($5,000) per violation" or three times actual damages, whichever is greater, with no need to prove actual harm. That figure, claimed per violation and without proof of harm, is what drives the demand letters and class actions.

### The unresolved question: extension or capability

Courts disagree on when a software vendor counts as a third party. A [July 2026 Jones Walker analysis](https://www.joneswalker.com/en/insights/blogs/ai-law-blog/the-chatbot-on-the-witness-stand-part-2-ai-at-the-drive-thru-voice-ordering.html?id=102n7uf) describes the two frameworks. Under the **extension** test, the vendor is treated like a tape recorder the website operates, and is not a separate listener unless it uses the data for its own purposes. Under the **capability** test, it is enough that the vendor is capable of using the data for its own benefit, for example to train a model. The research behind this page found no California Supreme Court ruling and no 2026 appellate decision that settles the split.

The case names usually attached to the two tests are Graham v. Noom for extension, and Javier v. Assurance IQ and Ambriz v. Google for capability. Those names are reported in secondary summaries and were not confirmed by us against the opinions.

Recent Ninth Circuit decisions cut both ways. In Gutierrez v. Converse (9 July 2025), the court affirmed summary judgment for Converse because the plaintiff showed at most that the chat vendor could access messages, not that it read them in transit; the decision is unpublished and therefore not binding precedent ([National Law Review summary](https://natlawreview.com/article/no-wire-no-violation-converses-cipa-win-affirmed-ninth-circuit-court-appeals)). In June 2025, Thomas v. Papa John's confirmed that a party cannot eavesdrop on its own communications, while Mikulsky v. Bloomingdale's revived a § 631 claim that adequately alleged the retailer aided a third-party vendor ([Mayer Brown analysis](https://www.mayerbrown.com/en/insights/publications/2025/06/the-ninth-circuit-briefly-speaks-on-cipa-section-631)). The practical reading: a well-pleaded vendor claim can still survive a motion to dismiss, and Converse's win came later, at summary judgment, on the evidence.

Plaintiffs also plead § 632.7, on recording cellular communications, for chats sent from phones. A [2023 law-firm survey](https://www.hlc.com/en/publications/california-courts-weigh-in-on-wave-of-live-chat-class-actions) describes the case law on that theory as inconsistent; we did not verify any newer ruling.

## SB 690 is not the fix

SB 690 started in 2025 as a broad "commercial business purpose" exemption from CIPA. That version stalled and was removed by amendment on 2 July 2026. The rewritten bill passed both houses on 28 August 2026 and, per the [official bill history](https://leginfo.legislature.ca.gov/faces/billStatusClient.xhtml?bill_id=202520260SB690), was enrolled and presented to the Governor on 4 September 2026.

The final text amends only § 637.2, so that only the Attorney General can sue over pen-register and trap-and-trace claims under § 638.51 arising from websites and apps. [Sidley's analysis](https://www.sidley.com/en/insights/newsupdates/2026/09/californias-sb-690-clears-the-legislature-what-it-means-for-cipa-website-tracking-claims) states that §§ 631 and 632 remain available to private plaintiffs. Chat-wiretapping suits are untouched.

> **Status as of 18 September 2026.** The official bill history shows no action after 4 September 2026: SB 690 was neither signed nor vetoed when we checked. Law firms expected a decision by 30 September 2026, with the change operative on 1 January 2027 if signed. We have not verified the outcome. Either way, it changes nothing for a chat widget.

## What lowers the risk

1. **Notice before the first message.** Put a short line at or above the chat input: the conversation is recorded, a named third-party vendor processes it, and a link to the privacy policy. Section 631 turns on the consent of all parties, and a notice that appears only after the first message has been sent comes too late for that message. Check during a trial whether the widget has a pre-chat form or a consent line you can edit.
2. **A contract that keeps the vendor in the extension box.** The Jones Walker article advises reviewing vendor contracts for "model training, product improvement, analytics, benchmarking, downstream uses, retention periods." Look for terms saying the vendor uses transcripts only to provide the service to you. This matters most for AI features, where the vendor or its model provider may want the data. See [how live chat, chatbots and AI agents differ](https://live-chat.reviews/en-us/guides/live-chat-vs-chatbot-vs-ai-agent).
3. **A retention period you chose.** Ask how long the vendor keeps transcripts by default and whether you can shorten it. Where the CCPA applies, your notice has to state a retention period anyway.

Where transcripts are hosted is not a US legal requirement. It becomes one if you also serve visitors in the EU or the UK, in which case see [live chat software with EU hosting](https://live-chat.reviews/en-us/best/eu-hosted-live-chat). Our [review method](https://live-chat.reviews/en-us/how-we-review) rates what each vendor documents about hosting and data processing terms; it does not assess any vendor's CIPA exposure.

## If a bot answers first: disclosure laws

| Law | What it asks | Status as of 18 September 2026 |
| --- | --- | --- |
| [California BOT Act, Bus. & Prof. Code § 17941](https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=BPC&sectionNum=17941) | Do not use a bot to mislead a person in California about its artificial identity in order to incentivize a sale. Disclosing that it is a bot is a complete defense. | In force since 1 July 2019. How the law's 10-million-visitor "online platform" definition limits it for ordinary business sites was not resolved in our research; disclosing is the safe course. |
| [Utah Code 13-75-103 (SB 226 of 2025)](https://le.utah.gov/Session/2025/bills/enrolled/SB0226.pdf) | Tell a person they are talking to generative AI, not a human, if they clearly ask. A clear disclosure by the AI is a safe harbor. It is no defense that the AI made the violative statement. | In force since 7 May 2025. Any 2026 amendments were not verified. |
| [Maine, 10 MRSA § 1500-Y](https://www.maine.gov/pfr/consumercredit/laws_rules/new/pl294.pdf) | Do not use an AI chatbot in trade or commerce in a way that may mislead a reasonable consumer into thinking they are dealing with a human, unless the consumer is clearly and conspicuously notified. | Approved 12 June 2025. Effective date reported as 24 September 2025, not confirmed by us on a primary page. |
| [Colorado HB 26-1263](https://leg.colorado.gov/bills/hb26-1263) | Operators of a "conversational artificial intelligence service" must tell users it is AI. | Signed 29 May 2026, effective 1 January 2027. Whether ordinary customer-service bots are excluded was not verified. |

_State bot-disclosure rules most relevant to a customer-service chat widget._

Two laws that sound relevant mostly are not. California's companion-chatbot law, SB 243, [expressly excludes](https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=BPC&sectionNum=22601) a bot "used only for customer service" or a business's operational purposes. Colorado's AI Act was repealed and re-enacted by [SB 26-189](https://leg.colorado.gov/bills/sb26-189), signed 14 May 2026, around automated decision-making in consequential decisions, with duties from 1 January 2027; a support bot that makes no such decisions is largely outside it. An [Orrick survey from April 2026](https://www.orrick.com/en/Insights/2026/04/2026-State-Chatbot-Laws-Key-Provisions-and-Regulatory-Trends) lists further state chatbot laws arriving in 2026 and 2027, most aimed at companion or mental-health bots. Check each statute's customer-service exclusion before assuming it applies.

One practice satisfies all of them: the bot says it is a bot in its first message and answers truthfully when asked.

## The FTC: do not oversell the bot

Section 5 of the FTC Act bars deceptive and unfair practices, and the FTC has said plainly that it covers AI. Announcing [Operation AI Comply](https://www.ftc.gov/news-events/news/press-releases/2024/09/ftc-announces-crackdown-deceptive-ai-claims-schemes) on 25 September 2024, the agency stated that "there is no AI exemption from the laws on the books." On 1 July 2026 the FTC [sought comment on a policy statement about AI accuracy](https://www.ftc.gov/news-events/news/press-releases/2026/07/ftc-seeks-public-comment-policy-statement-addressing-ai-accuracy); the comment period closed on 31 July 2026 and we found no final statement. That proposal targets AI developers more than a business running a support bot. The buyer's takeaway is narrower: do not claim on your site that the bot is more accurate or more capable than it is.

## CCPA notice, texting consent and HIPAA

- **CCPA/CPRA notice at collection.** If the CCPA applies to your business, [Civil Code § 1798.100(a)](https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV&sectionNum=1798.100) requires you to tell consumers "at or before the point of collection" what categories of personal information you collect, for what purposes, and how long you keep them. For chat, link that notice in or next to the widget or pre-chat form. One notice that also mentions recording and the vendor does double duty for CIPA.
- **TCPA consent for texts.** A mobile number typed into a pre-chat form does not authorize marketing texts. Under [47 CFR 64.1200](https://www.law.cornell.edu/cfr/text/47/64.1200), autodialed or prerecorded telemarketing calls and texts to wireless numbers need prior express written consent, and an opt-out such as replying STOP must be honored within ten business days. A broader rule that would apply one opt-out to all message types from the same sender is [reported by Hunton](https://www.hunton.com/privacy-and-cybersecurity-law-blog/fccs-tcpa-global-revocation-rules-now-effective-january-2027) as delayed to 31 January 2027; we could not fetch the FCC's own page.
- **HIPAA.** A clinic, dentist or health plan whose chat may receive protected health information needs a written business associate agreement with the chat vendor first, under [45 CFR 164.502(e)](https://www.law.cornell.edu/cfr/text/45/164.502). Many chat vendors sign one only on higher plans, which makes it a buying criterion. Among the products we cover, [LiveChat](https://live-chat.reviews/en-us/reviews/livechat) documents HIPAA with a BAA on its Enterprise plan and [Intercom](https://live-chat.reviews/en-us/reviews/intercom) lists HIPAA support on its Expert plan. Confirm the plan and the BAA in writing before you sign.

## Sources

- [California Penal Code § 631](https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=PEN&sectionNum=631)
- [California Penal Code § 637.2](https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=PEN&sectionNum=637.2)
- [SB 690 (2025-2026), official bill history](https://leginfo.legislature.ca.gov/faces/billStatusClient.xhtml?bill_id=202520260SB690)
- [Sidley: California's SB 690 clears the legislature (3 September 2026)](https://www.sidley.com/en/insights/newsupdates/2026/09/californias-sb-690-clears-the-legislature-what-it-means-for-cipa-website-tracking-claims)
- [Jones Walker: capability and extension tests, vendor-contract advice (July 2026)](https://www.joneswalker.com/en/insights/blogs/ai-law-blog/the-chatbot-on-the-witness-stand-part-2-ai-at-the-drive-thru-voice-ordering.html?id=102n7uf)
- [National Law Review: Gutierrez v. Converse, Ninth Circuit (July 2025)](https://natlawreview.com/article/no-wire-no-violation-converses-cipa-win-affirmed-ninth-circuit-court-appeals)
- [Mayer Brown: Thomas v. Papa John's and Mikulsky v. Bloomingdale's (June 2025)](https://www.mayerbrown.com/en/insights/publications/2025/06/the-ninth-circuit-briefly-speaks-on-cipa-section-631)
- [Law-firm survey on hlc.com: California courts on live-chat class actions (July 2023)](https://www.hlc.com/en/publications/california-courts-weigh-in-on-wave-of-live-chat-class-actions)
- [FTC: Operation AI Comply (25 September 2024)](https://www.ftc.gov/news-events/news/press-releases/2024/09/ftc-announces-crackdown-deceptive-ai-claims-schemes)
- [FTC: request for comment on AI accuracy policy statement (1 July 2026)](https://www.ftc.gov/news-events/news/press-releases/2026/07/ftc-seeks-public-comment-policy-statement-addressing-ai-accuracy)
- [California Bus. & Prof. Code § 17941 (BOT Act)](https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=BPC&sectionNum=17941)
- [California Bus. & Prof. Code § 22601 (SB 243 definitions)](https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=BPC&sectionNum=22601)
- [Utah SB 226 (2025), enrolled text](https://le.utah.gov/Session/2025/bills/enrolled/SB0226.pdf)
- [Maine P.L. 2025 ch. 294](https://www.maine.gov/pfr/consumercredit/laws_rules/new/pl294.pdf)
- [Colorado SB 26-189](https://leg.colorado.gov/bills/sb26-189)
- [Colorado HB 26-1263](https://leg.colorado.gov/bills/hb26-1263)
- [Orrick: 2026 state chatbot laws (April 2026)](https://www.orrick.com/en/Insights/2026/04/2026-State-Chatbot-Laws-Key-Provisions-and-Regulatory-Trends)
- [California Civil Code § 1798.100](https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV&sectionNum=1798.100)
- [47 CFR 64.1200 (TCPA rules)](https://www.law.cornell.edu/cfr/text/47/64.1200)
- [Hunton: TCPA revoke-all rule delayed to January 2027](https://www.hunton.com/privacy-and-cybersecurity-law-blog/fccs-tcpa-global-revocation-rules-now-effective-january-2027)
- [45 CFR 164.502 (HIPAA business associates)](https://www.law.cornell.edu/cfr/text/45/164.502)

## Frequently asked questions

### Is there a federal law that regulates live chat on my website?

No single one. The United States has no general federal privacy statute. A chat widget is covered by a patchwork: state wiretapping and privacy laws such as California's CIPA and CCPA, state bot-disclosure laws, the FTC Act's ban on deceptive practices, the TCPA if you text chat leads, and HIPAA if you are a health provider.

### Converse won its chat-wiretapping case. Does that mean the risk is over?

No. In Gutierrez v. Converse (9 July 2025) the Ninth Circuit affirmed a win for the retailer because the plaintiff could not show the vendor read messages in transit, but the decision is unpublished and not binding ([summary](https://natlawreview.com/article/no-wire-no-violation-converses-cipa-win-affirmed-ninth-circuit-court-appeals)). In the same summer, Mikulsky v. Bloomingdale's let a third-party-vendor claim proceed. Courts remain split on the underlying test, so notice at chat start and a tight vendor contract are still worth having.

### Did SB 690 end chat-wiretapping lawsuits?

No. The final bill only moves pen-register and trap-and-trace claims under § 638.51 to the Attorney General. Claims under § 631, the section used against chat widgets, stay available to private plaintiffs. As of 18 September 2026 the [official bill history](https://leginfo.legislature.ca.gov/faces/billStatusClient.xhtml?bill_id=202520260SB690) showed the bill on the Governor's desk, neither signed nor vetoed; we have not verified what happened after that date.

### What should the notice at chat start say?

Three things, in plain words, shown before the visitor sends the first message: the conversation is recorded, a named third-party vendor processes it on your behalf, and a link to your privacy policy. If a bot answers first, say so in the same place. Have a lawyer review the wording if California visitors are a meaningful share of your traffic.

### Do I have to tell visitors they are talking to a bot?

In practice, yes. California's BOT Act makes disclosure a complete defense, Utah requires a truthful answer when a person asks, and Maine requires clear notice where a consumer could otherwise think they are dealing with a human. Colorado HB 26-1263 adds a disclosure duty from 1 January 2027, although its treatment of customer-service bots was not verified. A bot that introduces itself as a bot meets all of them.

### Can I text someone who gave a phone number in the chat?

Not for marketing, unless you have prior express written consent that clearly authorizes those messages. Under [47 CFR 64.1200](https://www.law.cornell.edu/cfr/text/47/64.1200) a person can revoke consent by any reasonable method, such as replying STOP, and you must honor it within ten business days.

> **Scored on a public rubric, from pages you can open.** Every score on this site comes from five published criteria: free-plan usability, cost as you add agents, AI billing clarity, channels and integrations, and data location and compliance. Each price and limit is stored once, links to its source, and shows the same value on every page. Rubric v1.0 · We have not installed or speed-tested these widgets yet, and no page here claims we did. [Read the full method](https://live-chat.reviews/en-us/how-we-review)

## Keep reading

- [Is a free live chat plan enough for your team?](https://live-chat.reviews/en-us/guides/is-a-free-live-chat-plan-enough)
- [Per-seat vs per-workspace pricing: what your team size does to the bill](https://live-chat.reviews/en-us/guides/per-seat-vs-per-workspace-pricing)
- [How live chat vendors bill for AI](https://live-chat.reviews/en-us/guides/how-live-chat-vendors-bill-for-ai)
- [Live chat vs chatbot vs AI agent](https://live-chat.reviews/en-us/guides/live-chat-vs-chatbot-vs-ai-agent)
- [Best live chat software in 2026](https://live-chat.reviews/en-us/best/live-chat-software)
- [Free-plan audit: does your team fit a free live chat plan?](https://live-chat.reviews/en-us/tools/free-plan-audit)

---

Canonical: https://live-chat.reviews/en-us/guides/live-chat-privacy-and-the-law