Why "the notice is on the site" isn't an answer
Picture the complaint. A letter in March says that on September 19 a visitor chatted with your website and was never told the assistant was AI. You know the notice is on the site. But:
- The site has changed since September. A redesign, a new chat vendor, a plugin update. Nobody can say what the page showed on that day.
- A screenshot taken today proves nothing about last September, and one produced later can be challenged as staged.
- Your chat vendor's logs, if they exist, show the conversation. They don't show the notice.
- The notice may have silently stopped working for a few weeks. It happens more than people think, usually after a site update.
So the business is left saying "we believe so." Regulators and courts treat a claim that can't be shown much the same as one that isn't true.
What a good record stores
A record that can answer the question needs, for every time the notice appears, an entry with:
- What happened: the notice was shown, shown again, acknowledged, or a person took over the chat.
- Where and when: the page and the time, to the second.
- Who, without identifying them: a fingerprint that lets you confirm later that a particular visitor was shown the notice, without storing their address, name or anything else about them.
- A link to the entry before it: so that changing or deleting any entry breaks the chain and shows.
The last point is what turns a log into evidence. Anyone can keep a spreadsheet of "notice shown" rows. What makes a record credible is being able to demonstrate that nobody has edited it since it was written. Our page on how the disclosure record works describes the version BotNotice keeps: no personal data, a one-way fingerprint that changes daily, a hash chain checked every day, and a nightly copy in separate storage.
How a record is used when it matters
Nothing is decrypted, because nothing was encrypted. The record is matched to a complaint by recomputing the same fingerprint from details that arrive with it.
- You open the day named in the complaint. The record gives you every entry from that day, the integrity check for that period, the off-site copy and its checksum, the monitoring results showing the notice was present on your pages, and the exact wording in force that day.
- If your chat provider's logs give the visitor's address and browser for that conversation, the fingerprint is recomputed and the matching entries are pulled. You can now say: a visitor with those details was shown the notice at 14:02 on the contact page, before the conversation began.
- The evidence report packages all of it as one document for your lawyer, with the method described so the other side can check it.
The properties that matter when records are questioned are the ones this is built around: made at the time, in the ordinary course of business, by an automated process; integrity that can be demonstrated rather than claimed; contemporaneous wording; and no personal data to argue over. The Federal Rules of Evidence, for example, allow certified records of a process shown to produce a reliable result, and hash values are the usual way to show it.
What it doesn't prove
Honesty here is worth more than a bigger claim.
- It proves display, not reading. The notice was shown to that visitor at that time. No system can prove someone read it.
- The fingerprint corroborates, it doesn't identify. Shared office networks, VPNs and phones on carrier networks mean several people can share a fingerprint for a day.
- Matching needs the visitor's details from somewhere, usually the chat provider's logs. Without them you still have the day's entries, the monitoring proof and the wording, which is often what a lawyer needs first.
- It's evidence, not a guarantee. Good records make a strong position. They don't make a claim go away by themselves, and no law requires a record as such. The value is practical: being able to answer the question.
- It starts the day you start. Nothing is recorded about the months before.
Which laws make this matter
The ones with money attached. California's companion chatbot law gives individuals a private right of action. Utah's and Maine's laws carry fines per violation, and a chatbot with no notice commits one per conversation. The FTC treats a bot that pretends to be human as deception. In every case, the first request will be for records, and the business that has them ends the conversation early.
For the notice itself, our disclosure examples page has wording for chatbots, phone assistants, handoffs and minors. For which rules reach you, the state-by-state index is the quickest route.
Frequently asked questions
Isn't a screenshot enough?
A screenshot shows the page on the day it was taken. It says nothing about the day in the complaint, and it can be disputed as staged. A record written at the time, with integrity that can be checked, is a different kind of evidence.
Does the record store my visitors' personal data?
Not the one BotNotice keeps. It holds a one-way fingerprint that changes daily and cannot be turned back into a person, along with the page, the time and what happened. No addresses, names or chat content. That also means the record can't leak anything if it's ever seen by the wrong person.
How long should records be kept?
Longer than the limitation period for the claims you're worried about. Seven years covers the consumer protection claims these laws create, which is why plans with records keep entries for seven years.
Can I keep a record myself?
You can log every time your notice appears, if your chat tool lets you, and keep the log somewhere it can't be quietly edited. The hard parts are the tamper evidence, the daily checking, the off-site copies and the retention. That's the work a records service does for you.
Not legal advice. Whether a record is sufficient for a particular claim depends on the claim, the jurisdiction and the other facts.