Could AI Chatbots Become the Next Target for Consumer Lawsuits?

AI chatbot laws are coming. The lawsuits likely won't be far behind.

Twelve states have enacted, or are actively considering, laws regulating consumer-facing AI chatbots. Although most of these laws will not take effect until 2027, businesses have a valuable opportunity to prepare before the first cases begin shaping the law.

Not Every Chatbot Is Regulated

These laws generally regulate the business deploying the chatbot, regardless of who developed the underlying AI model.

Most states exempt traditional customer service chatbots, internal business tools, and similar technologies. However, Georgia and Washington remove that exemption when customer service chatbots sustain ongoing relationships or elicit emotional responses. As AI customer service becomes more conversational, businesses should periodically reassess whether their chatbot still qualifies for an exemption.

Transparency Is the New Baseline

Every chatbot law requires users to know they are interacting with AI rather than a human.

While the disclosure requirements vary by state, businesses should expect to provide clear AI disclosures and, in some states, periodic reminders during extended conversations. Several states also prohibit chatbots from claiming to be human.

Age Matters

Only a handful of states currently require affirmative age verification. Colorado requires operators to estimate or obtain users' ages using commercially reasonable methods. Georgia requires age assurance before users access sexually explicit chatbot features, and New York may soon follow if pending legislation is signed.

Additional Protections for Younger Users

Nearly every state imposes heightened safeguards when minors use regulated chatbots. Those safeguards generally include enhanced AI disclosures, restrictions on sexually explicit or manipulative content, limits on relationship-building features, and, in some states, parental controls.

Private Lawsuits Are the Biggest Risk

While most chatbot laws are enforced exclusively by state attorneys general, California, Oregon, and Washington allow consumers to sue businesses directly. Potential exposure includes:

• California: Greater of actual damages or $1,000 per violation, plus potential injunctive relief and attorney's fees and costs.

• Oregon: Greater of actual damages or $1,000 per violation, plus potential injunctive relief and attorney’s fees.

• Washington: Actual damages plus discretionary treble damages under the Consumer Protection Act, capped at $25,000, while the Attorney General may separately seek up to $7,500 per violation.

Even without private lawsuits, attorney general enforcement can be substantial. Colorado authorizes up to $5,000 per violation, with each chatbot output constituting a separate violation, while Georgia authorizes $10,000 per knowing violation, with each day and affected user potentially constituting a separate violation.

The first wave of lawsuits has not yet arrived because most of these laws have not yet taken effect. But businesses should use that runway to evaluate their chatbot disclosures, functionality, and guardrails before plaintiffs’ attorneys do.