Bots are perfectly legal. Unless, of course, they’re programmed or designed to do illegal things.
To paraphrase legal scholars Mark Lemley and Bryan Casey, well-drafted laws prohibit verbs, not nouns. There are millions of ways that you could code or program an automated system that generates almost no legal risk whatsoever. And there plenty of ways that someone who codes an automated system could get into legal trouble.
A Roomba that goes around your house cleaning up pet hair is totally fine. A Roomba that is souped up with razor blades that goes around chopping away at people’s lower extremities is not.
There is only one law in the United States that is targeted specifically at bots, and that is California’s, B.O.T. (“Bolstering Online Transparency”) Act. What that law says is that it is illegal for a person or entity to use a bot to communicate or interact online with a person in California to incentivize a sale or transaction of goods or services or to influence a vote in an election without disclosing that the communication is via a bot.
It only applies to public-facing websites that have a presence in California and that have at least 10 million monthly U.S. visitors or users.
Other than that, bots (and the people and entities who code them) are generally governed by the same laws that govern people. Of course, some laws tend to apply to bots more often than others. For instance, bots have been subject to breach of contract laws, the Computer Fraud and Abuse Act, and the Digital Millennium Copyright Act when allegedly being used to buy huge amounts of concert tickets in advance of human buyers. Ticketmaster LLC v. Prestige Entertainment, Inc., Dist. Court, C.D. Cal. 2018. They’ve been sued for breach of contract, trademark infringement, trespass to chattels, and fraud for allegedly manipulating viewer counts of offensive videos on Twitch. Twitch Interactive v. Does (N.D. Cal. 2019). And they’ve been sued for fraud and breach of contract for allegedly mimicking fake users (specifically, female users) on the Ashley Madison website in order to induce actual (mostly male) users to make purchases. In Re Ashley Madison Customer Data Security Breach Litigation (E.D. Mo. 2016).
In essence, if a person could get in trouble for certain behavior, there’s a good chance a bot (and the people and entities who code them) could get into trouble for them, too.
If you have any more questions, you should get into touch with a law firm that has expertise in the Computer Fraud and Abuse Act, trademark infringement, and law of trespass to chattels.