It is illegal at the federal level, but to enforce that takes kind of a lot of effort and money so it's not often that they do get prosecuted. To prosecute, I think it would be another matter all together. Bots are actually hidden behind VPN tunnels or other ways to obfuscate where they're actually coming from. It may be difficult to actually find the people that are running these bots