Should You Tell Leads They're Talking to AI? Disclosure, TCPA, GDPR and Opt-Outs

My view: never deny being an AI, always answer honestly when someone sincerely asks, and disclose up front wherever the law or your industry expects it. In a growing number of places the law already requires disclosure in some situations, and in practice, honesty rarely hurts conversion as much as people fear. What loses leads is a slow, unhelpful reply, not a helpful one that happens to be from AI.

This comes up in nearly every setup I do with ReplySetter. This post explains the main rules I'm aware of and the approach I recommend. It isn't legal advice. Laws differ by country and state and change often, so check with a lawyer for your situation.

What the law says (in broad strokes)

California: the BOT Act (SB 1001)

Since 2019, California law has made it unlawful to use a bot to communicate with a person in California online with the intent to mislead them about its artificial identity in order to encourage a sale or influence a vote, unless the bot clearly discloses it's a bot. Sales conversations are squarely in scope.

The EU AI Act

The EU AI Act includes transparency obligations, applying from August 2026, that require AI systems which interact directly with people to be designed so people are informed they're interacting with an AI, unless that's obvious from the context. If you have leads in the EU, plan for disclosure.

Other US state laws

Several states have passed or are considering AI disclosure laws. Utah's AI law, for example, requires disclosure in certain situations, including when a consumer asks whether they're talking to AI. Expect more of these.

Consumer protection in general

Regulators like the US FTC treat deceptive practices seriously. Telling someone "I'm a real person" when you're not is the kind of thing that creates risk under general consumer protection law.

Separate but related: messaging consent

Disclosure is about who's talking. Consent is about whether you can message the person at all.

• SMS in the US (TCPA): marketing texts generally require prior express written consent. Carriers also require A2P 10DLC registration for business texting. Replying to someone who texted you first is different from texting a cold list.
• AI voice calls (TCPA): in 2024 the FCC ruled that AI-generated voices count as "artificial" under the TCPA, so the robocall consent rules apply.
• Email (CAN-SPAM, GDPR, PECR): rules on consent, identification and opt-outs differ by country.
• Meta platforms: the 24-hour messaging window limits what you can send on Messenger, Instagram and WhatsApp. See booking calls from Messenger and WhatsApp.
• GDPR: for EU and UK leads, you need a lawful basis to process their data, and they have rights to access and delete it.

Does disclosing AI hurt conversions?

In my experience, less than people expect, for a few reasons:

• People care about being helped, quickly and accurately.
• Many already assume instant replies at 11pm aren't from a person.
• Getting caught pretending is far worse than being upfront.
• Disclosure can be light: "I'm Sam, the AI assistant for Bright Smile, the team's copied in for anything I can't help with" sounds friendly, not robotic.

If you want certainty for your business, A/B test a disclosed opener against your current one and compare booking rates. See A/B testing.

The approach I recommend

1. Never deny being AI. If someone sincerely asks "is this a bot?", answer yes.
2. Disclose up front where required, and consider it everywhere for trust.
3. Use a human-sounding but honest identity: "the team's assistant" rather than pretending to be the owner.
4. Offer a human. "Want me to get someone from the team?" builds trust.
5. Respect opt-outs in any wording, not just "STOP".
6. Only message people you're allowed to message.
7. Keep records of consent and opt-outs.

Handling opt-outs properly

Opt-outs are where AI can actually be better than old systems, because it understands natural language. A keyword system only catches "STOP". An AI setter can recognise "please don't message me again", "remove me", "not interested, stop" and similar.

In ReplySetter, an opt-out tool marks the contact, stops the agent, cancels follow-ups and, on GoHighLevel, can apply your opt-out tag. Paused and opted-out contacts never get nudged.

Data and privacy

A few practical points:

• Only collect what you need to qualify and book.
• Don't put sensitive data in chat you don't need (health details, financial account numbers).
• Know where your data goes: your CRM, the AI platform, the AI provider.
• Be able to export and delete a person's data on request.

ReplySetter includes tools to find, export and erase a contact's data for GDPR requests, and you bring your own AI provider key, so you choose which provider processes the conversations.