Outreach Compliance for Small Teams: CAN-SPAM Requirements, State Laws and AI Prospecting Rules
Picture a three-person company that sends forty cold emails a week. One of them is the founder, who writes them at night. Nobody has read the law. The footer has a company name and nothing else, the "unsubscribe" instruction is a line of gray text that says "reply STOP," and the person who handles replies is on holiday for two weeks. Nothing has gone wrong yet. (This is an illustration, not a case study.)
Small teams are often unsure whether the rules apply to them, assume the rules are for big senders, or lose track of changes. This guide is a plain-language walk through what matters for a small team doing outreach in 2026: what the CAN-SPAM requirements actually say and the myths around them, how cold email law beyond CAN-SPAM (state privacy laws and rules outside the US) touches cold email compliance, the platform rules for LinkedIn, what changed with the Colorado AI law (the brief that started this guide is out of date, and we explain how), how to keep a register of opt-outs, and a template and checklist you can use.
A note on what this is. It is general information, not legal advice. We are not lawyers. It is built from public sources, each listed at the end with the date we read it, and we say where a source was second-hand or where we could not open the original. Laws change and differ by country and state. Where the stakes are real, such as a regulatory letter, a large list or a regulated industry, talk to a qualified lawyer.
- CAN-SPAM covers business-to-business email. The FTC’s guide lists seven requirements and states there is no B2B exception.
- The footer is the easy part: accurate sender details, an honest subject line, a physical postal address and a working opt-out honored within 10 business days.
- State and non-US rules add duties, not just this one. California treats business contact data as personal information. The UK treats named work emails as personal data.
- The Colorado AI Act you may have read about was repealed and replaced in 2026 and now targets automated decisions about consequential matters such as jobs, lending or housing. A cold email is not one of them. Do not copy dates and penalties from older summaries.
- Keep a register: where each address came from, when you sent, and when anyone opted out. A suppression list is the one record you should never delete.
- CAN-SPAM decoded: what is required and what is a myth
- State laws, privacy rules and what changes outside the US
- LinkedIn outreach: platform rules and real limits
- Prospecting with AI: the Colorado law and practical rules
- Keeping consent and opt-out records: where, and for how long
- An email template and footer that meet the CAN-SPAM requirements
- The 2026 pre-send checklist
- When it is time to hand it to someone
- Frequently asked questions
- Sources
CAN-SPAM decoded: what is required and what is a myth
CAN-SPAM is the US federal law on commercial email. The Federal Trade Commission publishes a guide for businesses. We read it on November 1, 2026, and it is the main source for this section. It lists seven requirements.
The seven requirements, in plain language
| # | Requirement | What it means for your cold email |
|---|---|---|
| 1 | No false or misleading header information | The From, To and Reply-To fields, and the routing, must be accurate. Use your real name and a domain you control. |
| 2 | No deceptive subject lines | The subject has to match the content. "Re: our call" on a first email, when there was no call, is a trap. |
| 3 | Identify the message as an ad | Where it applies, make clear that it is a commercial message. A plain sales email should not pretend to be something else. |
| 4 | Tell recipients where you are located | Include a valid physical postal address. The FTC guide says this can be a street address, a post office box registered with the US Postal Service, or a private mailbox registered with a commercial mail receiving agency. |
| 5 | Tell recipients how to opt out | A clear, easy way to say stop. You cannot charge a fee or ask for more than an email address, and you cannot make the person do more than reply or visit a single web page. |
| 6 | Honor opt-outs promptly | Within 10 business days. Do not send more commercial email to that address, and do not sell or transfer it. |
| 7 | Monitor what others do on your behalf | If a tool, an agency or a freelancer sends for you, you are still responsible for what goes out. |
The FTC guide lists penalties of up to $53,088 for each email that violates the law. That amount is adjusted periodically, so check the current figure. The same guide says the law covers all commercial email, including business-to-business messages, and that there is no exception for B2B.
Myths we see most often
| Myth | What the FTC guide and plain reading say |
|---|---|
| "It is B2B, so CAN-SPAM does not apply." | False. The guide states that the law makes no exception for business-to-business email. |
| "I am too small for this to matter." | The guide defines coverage by the content and purpose of the message, not by sender size. We saw no small-sender exception in what we read. |
| "I use a tool, so the tool is responsible." | False. Requirement 7 puts responsibility on the business whose product is being promoted, even when someone else sends. |
| "An opt-out is optional if the email is useful." | False. Requirement 5 applies to every commercial message. |
| "I have ten days to start honoring an opt-out, so I can do it in a batch at month end." | Ten business days is a ceiling, not a target. Honor it as soon as you can, and apply it to every campaign and tool at once. |
| "A tiny gray footer counts." | An opt-out hidden where nobody can find it is a risk. Make it easy to see and easy to do. |
| "CAN-SPAM means I need permission before I email." | CAN-SPAM’s requirements concern how you send and how people can stop you. It is not built around prior permission the way laws in some other countries are. That does not make every send safe: other laws, platform rules and mailbox providers have their own demands. |
- One tool honors opt-outs, another does not. A person who unsubscribes from a sequence in one tool is emailed from a second tool the next week.
- Opt-outs arrive as replies. "Please remove me" written in a reply is an opt-out. Someone has to read replies and act.
- A subject line that implies a relationship. "Following up on your request" when there was no request.
- No postal address, because the team works remotely. A registered mailbox solves this.
- A freelancer or agency sends and nobody checks. Requirement 7 puts the responsibility on you.
If you are building a prospecting workflow, the opt-out rule belongs in the automation, not in someone’s memory. Our guide to the research workflow behind AI cold email covers the sending side, and the missed-lead follow-up system covers warm leads, where the same opt-out rule applies. If you want the suppression check wired into your own stack, the Request a Custom Workflow page is where you describe it and get a quote.
State laws, privacy rules and what changes outside the US
CAN-SPAM is the floor in the US, not the whole building. Two other layers matter for outreach: privacy laws that treat contact details as personal information, and rules in other countries. Here is what we could verify, and what we could not.
California: business contact data is personal information
Jackson Lewis, a law firm, writes in its CCPA guide (read November 3, 2026) that "there is no general B2B exception under the CCPA" and no exclusion for personal information about a California resident acting in a commercial capacity. In practice that means a business email address, phone number or job title of a California contact can be personal information under the CCPA. The same source says the law applies to a for-profit business that does business in California, collects Californians’ personal information, and meets one of three thresholds: annual gross revenue above $25 million (adjusted to $26.625 million from January 1, 2025), buying, selling or sharing the personal information of 100,000 or more consumers or households a year, or getting at least 50 percent of annual revenue from selling consumers’ personal information.
What that means for a small team: a three-person company is unlikely to meet any of those thresholds by itself, but if your tool vendor, data provider or a larger client does, expect contract clauses and requests that flow down to you. It also means that if a California contact asks you to delete their data or stop contacting them, the simple, safe response is to do it. Treat requests as non-negotiable.
The other states
One comparison page we read (privacyterms.io, dated September 2, 2026, with figures it says were verified as of August 2026) states that 19 of the 20 US states with comprehensive privacy laws it covered exempt business-to-business data, and that California is the single exception. That is a second-hand summary of many statutes, so use it as a signal, not as a basis for a decision. Check the law of each state where you send in volume, and do not assume that your contact’s location equals the law that applies to you.
The brief for this guide also mentioned "new 2026 state laws with a harmonized opt-out" for email. We looked for a verifiable source on a new email opt-out standard that applies across states and did not find one, so we do not describe one here. If you read about such a law, find the statute or an official summary before you act on it. Until then, the safest approach is already the one CAN-SPAM requires: an easy opt-out, honored fast, applied everywhere.
The UK: PECR and the UK GDPR
The UK Information Commissioner’s Office (ICO) has a page on business-to-business marketing (read November 3, 2026). Its main points:
- Corporate subscribers. The ICO states that the PECR rule on direct marketing by email "does not apply to corporate subscribers." Companies and limited liability partnerships are the examples it gives.
- Sole traders and some partnerships are classed as individual subscribers and get the same protections as individuals. To email them you generally need specific consent or the narrow "soft opt-in." If you are unsure which a contact is, the ICO advises treating them as an individual subscriber.
- Opt-outs. For corporate subscribers PECR does not explicitly require you to honor an opt-out, but the ICO says you should, since continuing "serves little purpose."
- UK GDPR still applies. A named employee’s work email address is personal data. The ICO says that if you process the personal data of business contacts you must comply with the UK GDPR, and that individuals have an absolute right to stop their data being used for direct marketing.
The practical rule that comes out of this: honor every opt-out, in every country, immediately. It satisfies the ICO’s advice, the CAN-SPAM rule and common sense.
EU, Canada and elsewhere
We did not research the rules of EU member states, Canada (which has its own anti-spam law, known as CASL) or other countries for this guide, and we are not going to guess. If a meaningful share of your list sits outside the US and the UK, get local advice before you send, or leave those contacts out until you have it.
- Use one standard for everyone: accurate headers, an honest subject, a postal address, an easy opt-out, honored within days.
- Keep sole traders and unclear cases out of UK outreach unless you have specific consent.
- Record the source of every address, so you can answer a question about it.
- Delete personal data on request unless you have a reason to keep it, and keep the opt-out record itself.
LinkedIn outreach: platform rules and real limits
Messages on LinkedIn (may be an affiliate link) are governed by two things at once: the law (which cares about how you collect and use personal data and about marketing messages) and LinkedIn’s own rules (which care about how you behave on the platform). Breaking the second set usually costs you an account long before any regulator gets involved.
What we could and could not verify
LinkedIn’s help center has a page titled "Prohibited software and extensions" and another on automated activity. Both blocked our access when we tried to read them, so we cannot quote them. One article that summarizes LinkedIn’s User Agreement says the agreement prohibits automated access including bulk connection requests, mass messaging and scraping, and describes a graduated response from warning to restriction to a permanent ban. That is the author’s paraphrase, not LinkedIn’s wording, and the article cites no help page. Read LinkedIn’s current terms and help pages yourself and rely on them, not on a summary.
Practical limits that hold whatever the fine print says
- Send by hand from your own account. A tool that logs in as you and sends in bulk is the usual cause of restrictions. Use AI for research and drafting, and press send yourself.
- A connection is not consent to marketing email. Someone accepting a connection request has agreed to be connected. Do not move their address from a profile into your email list without a separate reason and an opt-out.
- Do not scrape. Collecting profile data at scale with a script can breach LinkedIn’s terms and can create data protection duties you did not plan for.
- The same honesty rules apply. Do not pretend a connection request is something else, and do not fake a relationship.
- Keep records. Note where you found the contact and what you sent.
The LinkedIn lead scoring and outreach workflow on this site reads from a table, scores leads, drafts two messages and puts them in a sheet for review. It never sends on its own, and its page has a section on legal and account risks. That design is deliberate: the review step is where a person decides whether a message is appropriate.
A spreadsheet that ranks your repetitive tasks by what is worth automating first. List the task, rate how often it happens, how long it takes, how error-prone it is and how many tools it touches, and the sheet orders your list. Enter your email below and we will send the download link.
Prospecting with AI: the Colorado law and practical rules
Older summaries of the Colorado AI Act often give an effective date of February 1, 2026, a penalty of $20,000 per violation and an exemption for companies with fewer than 50 employees. The brief for this article carried the same figures. We checked, and they are out of date. Here is what we found.
What happened to the Colorado AI Act
| Date | What happened | Source |
|---|---|---|
| 2024 | Colorado passes SB 24-205, a law on high-risk AI systems and algorithmic discrimination. | Background in all three sources |
| Before June 30, 2026 | The effective date, originally in early 2026, had been pushed to June 30, 2026. | Tech Times (July 1, 2026) |
| April 2026 | xAI sues over SB 205; the federal government files a companion complaint. A stipulated federal court order blocks the state from enforcing SB 205 for now. | McDermott Will & Schulte (May 27, 2026) |
| May 14, 2026 | Governor signs SB 26-189, which repeals and replaces SB 24-205 with a narrower, notice-based law. | McDermott; Eckert Seamans (June 12, 2026) |
| January 1, 2027 | The new law’s effective date. The Attorney General must finish rulemaking by then. | McDermott; Tech Times |
According to those summaries, the new law is about automated decision-making technology used in consequential decisions about Colorado residents: the categories named include employment, health care, housing, lending and insurance. It drops the earlier law’s duty of care against algorithmic discrimination, its annual impact assessments and its general disclosure whenever a consumer interacts with an AI system. What remains is mainly notice: telling people when such a tool is used to make a consequential decision, and explaining an adverse outcome in plain language within 30 days, with rights to correct data and ask for human review. The Attorney General enforces it, with a 60-day period to fix problems before enforcement, and one law-firm summary says practical enforcement is unlikely before late 2027.
What this means for a cold email program
- A cold email is not a consequential decision. Based on the categories the sources list, sales outreach is not what this law targets. The sources we read do not address marketing.
- The old figures should not be repeated. The February 1, 2026 date, a $20,000 penalty and a fewer-than-50-employees exemption all come from older summaries of the repealed law. The 2026 sources we read do not give a penalty amount or mention a small-company exemption. Do not assume either.
- The line to watch is where AI decides something about a person’s access. If your AI scoring decides who is offered a job, credit, housing, insurance or health care, the new law may apply. For a team using AI to research a company and draft a sales email, it probably does not, but ask a lawyer if your product touches those areas.
- Laws change fast here. A court order, the rulemaking and possible amendments could all move things before January 2027. Check the Colorado Attorney General’s site before relying on any summary, including this one.
Practical rules for AI-assisted outreach, whatever the law says
Some rules do not depend on a statute. They follow from the seven CAN-SPAM requirements and from basic honesty:
- Do not claim a human wrote what a tool wrote if it matters to the recipient. A message from a named person that a person reviewed and approved is a message from that person. A message sent by an agent posing as a person who never saw it is not.
- Do not let the model invent facts. A made-up detail in a cold email can make a subject line or a claim misleading, which is exactly what requirement 2 forbids.
- Keep a person in the approval step and keep the research brief next to each message, so you can show what a statement was based on.
- Do not use AI to disguise who you are: no fake sender names, no look-alike domains, no invented references to a prior conversation.
- Apply the opt-out in the automation, across every tool, before every send.
Answer truthfully and briefly. A sentence such as: "I use AI tools to help research and draft, and I review every message before it is sent" is accurate for a workflow that has a person approve every message. If your process does not match that description, change the process, not the sentence.
Keeping consent and opt-out records: where, and for how long
Rules are only useful if you can prove you followed them. A small register, kept in the same sheet that runs your outreach, answers most questions anyone could ask: where did you get this address, when did you write, and when did they ask you to stop.
The register: what to record
| Column | What it holds | Why |
|---|---|---|
| The address, exactly as used | The key for every check. | |
| Name and company | The contact and organization | Helps you answer who this is. |
| Source | Where the address came from: own research, referral, event list, purchased list (and which provider) | You must be able to say how you got it. |
| Source date | When you got it | Old data is riskier data. |
| Region (if known) | US state or country | Different rules may apply. |
| First sent / last sent | Dates | Shows what you sent and when. |
| Template version | Which version of the message went out | Lets you reconstruct what they saw. |
| Status | Active, replied, opted out, bounced, removed on request | Drives the suppression check. |
| Opt-out date and channel | When and how they asked to stop (reply, link, other) | Proves you acted on time. |
| Action taken and date | Added to suppression list; data deleted or kept | Proves the loop closed. |
The suppression list: the record you never delete
Your suppression list holds every address that has asked to stop, bounced for good, or been removed on request. Two rules:
- Check it before every send, in every tool. If your outreach tool and your newsletter tool keep separate lists, merge them.
- Do not delete it, even when someone asks you to erase their data. If you delete the address, you cannot stop yourself from emailing it again. Keep the minimum needed to honor the opt-out and say that is what you keep.
How long to keep other records
We did not find a single retention period for outreach records in the CAN-SPAM guide we read, and retention rules for personal data differ by law. Two reference points, neither a universal rule: one summary of the new Colorado law says deployers must keep documentation for three years, which is specific to that law’s scope, and many teams use a policy of keeping send logs for a few years so they can answer a complaint. A reasonable small-team policy is to keep the suppression list for as long as you send email, and keep send logs for a fixed period you choose, write down, and apply consistently. Ask your lawyer or accountant whether a longer period applies to your industry.
Handle opt-outs that arrive in the wrong place
- A reply that says stop, remove me or not interested is an opt-out. Add it to the register within a day.
- A reply to an old thread, a forwarded message or a note to a colleague counts too, once you see it. Tell your team where opt-outs land.
- Out-of-office and automatic replies are not opt-outs. Do not remove people because of them, and do not send until they are back if it would be awkward.
- Someone complains to your tool provider or mailbox host. Treat it as an opt-out and look into what happened.
A shared suppression list, a check before every send and a log are easy to describe and tedious to wire across tools. Describe your setup on the request page. We review it, send a quote, and you decide whether to go ahead.
An email template and footer that meet the CAN-SPAM requirements
Below is a template you can adapt. Every name and address in it is invented. It is a starting point built from the seven requirements in Section 1, not a legally reviewed document. Have a lawyer look at your final version if you send in volume or in a regulated industry.
The email, step by step
From: Sam Rivera <sam@northlinehq.example>
Subject: the Austin office
Hi Dana, I read that you opened the Austin office last month. When a team goes from one location to two, lead routing often breaks first. Has that come up yet?
I build small automations that handle that handoff. If it is not a priority, tell me and I will not write again.
Sam Rivera, Northline Automation
————————
This is a business email about automation services from Northline Automation, 123 Example Street, Suite 4, Austin, TX 78701, USA. If you do not want to hear from us again, reply with the word stop or click unsubscribe, and we will remove you within 2 business days.
What each part does:
| Part | CAN-SPAM requirement it serves | Notes |
|---|---|---|
| From: real name and a domain you control | 1. Accurate header information | No look-alike domains, no borrowed names. |
| Subject that matches the body | 2. No deceptive subject lines | Do not imply a prior conversation that did not happen. |
| "This is a business email about…" | 3. Identify the message as an ad | Plain wording. Adapt to your message. |
| Postal address | 4. Where you are located | A street address, a USPS-registered PO box or a registered private mailbox. |
| Reply STOP or click unsubscribe | 5. How to opt out | Easy, free, no extra information. The text is yours to word. |
| Removed within 2 business days | 6. Honor opt-outs promptly | The law allows 10 business days. A shorter promise you can keep is better than a longer one you might miss. |
| Your own checks on any sending tool | 7. Monitor what others do | Read what your tool and any agency actually send. |
Replies to use when someone opts out or objects
Hi [Name], understood. I have removed [email] from my list and you will not hear from me again. If you would like me to delete the details I hold about you as well, tell me and I will. Thanks, [Your name]
Hi [Name], fair question. I found your work email through [source, for example: your company's public team page / a referral from X / an event attendee list]. I wrote because [one-sentence reason]. If you would rather I did not contact you, say so and I will remove you today. Thanks, [Your name]
The second reply works only if the register in Section 5 has the answer. If you cannot say where an address came from, that is a signal to stop using it.
Settings to check in your sending tool
- Footer text is added to every email, including follow-ups and one-off messages sent outside a sequence.
- The unsubscribe link or reply handling stops all sequences for that address, not only the current one.
- The postal address is filled in. Many tools leave it empty by default.
- Bounces and complaints go to the suppression list automatically.
- You can export the list, so you can merge it with other tools.
The 2026 pre-send checklist
Use this before you launch any new campaign, and again every quarter. It is a working checklist, not a legal opinion. Where an item depends on your situation, the answer is a question for your lawyer.
| # | Check | Done when |
|---|---|---|
| 1 | The From name and address are real and match the person who will answer | A person you can name will reply. |
| 2 | The subject line matches the body and does not imply a relationship that does not exist | You would be comfortable showing it to the recipient. |
| 3 | The message makes clear it is a business or promotional email | The footer or the body says so plainly. |
| 4 | A valid postal address is in the footer | It is a street address, a registered PO box or a registered private mailbox. |
| 5 | An easy opt-out is in every message | Reply STOP or a link works, with no fee and no extra information. |
| 6 | A named person watches replies for opt-outs | Opt-outs reach the register within a day. |
| 7 | One suppression list covers every tool | A test address opted out in one tool is blocked in the others. |
| 8 | Every address has a recorded source and date | The register has no empty Source cells. |
| 9 | Contacts from the UK or EU are handled by a separate rule | Sole traders and unclear cases are excluded, or you have specific consent. |
| 10 | California and other state requests are handled | Someone knows what to do when a deletion request arrives. |
| 11 | If AI drafts messages, a person reviews and approves each one | The research brief is kept next to the message. |
| 12 | The AI is not used to decide access to jobs, credit, housing, insurance or health care | If it is, you have asked a lawyer about state ADMT rules. |
| 13 | Platform rules are read, not assumed | You have read the current LinkedIn terms and the sender guidance for your mailbox provider. |
| 14 | Any agency or tool that sends for you is reviewed | You have seen real samples of what they send. |
| 15 | A retention policy exists and is written down | It names how long you keep the suppression list and send logs. |
- The checklist is done once, then forgotten. Tools change defaults and new campaigns get added.
- The register lives in one person’s head. When they leave, so does the history.
- The footer is added by hand, so it is missing from a one-off email.
- No one owns it. Name one person and one review date.
When it is time to hand it to someone
You can run all of this with a spreadsheet and discipline. The parts that tend to fail are the repetitive ones: merging suppression lists across tools, checking every outgoing message for the footer, logging each send. These are exactly the kind of task that a small workflow handles better than a person’s memory.
At LeenLabs we build n8n workflows for tasks like these. You describe the task once on a single form, including the tools you use. We review it and send a quote. You pay 40% to start, and the remaining 60% when we deliver the workflow. There is no bidding round and no profiles to compare. We do not promise legal outcomes. A workflow cannot make a message lawful, but it can make sure your own rules are applied every time.
Tell us which tools hold your lists, how opt-outs reach you and which checks you want before every send. You get a quote, and you decide whether to go ahead.
To see how these workflows are put together first, browse the free workflows, which come with JSON you can import, or read more about us. The Zoho CRM data quality audit workflow is a good example of the kind of recurring check that suits automation.
Frequently asked questions
What are the CAN-SPAM requirements for a cold email?
The FTC’s guide lists seven: no false or misleading header information, no deceptive subject lines, identify the message as an ad where it applies, include a valid physical postal address, tell recipients how to opt out, honor opt-outs within 10 business days, and monitor what others do on your behalf. Section 1 explains each one in plain language. This is general information, not legal advice.
Does CAN-SPAM apply to B2B cold email?
Yes. The FTC guide states that the law covers all commercial email, including business-to-business messages, and that there is no B2B exception.
Is cold email legal in the US?
CAN-SPAM does not ban cold email. It sets requirements for how you send it and how people can stop you. Other laws, platform rules and mailbox provider policies can add limits, so meeting CAN-SPAM does not make every campaign safe.
What is the penalty for violating CAN-SPAM?
The FTC guide we read lists penalties of up to $53,088 for each violating email. The amount is adjusted periodically, so check the current figure on the FTC site.
What is the Colorado AI Act’s effective date?
The original law, SB 24-205, was repealed and replaced by SB 26-189, signed on May 14, 2026. According to the law-firm and news summaries we read, the new law takes effect on January 1, 2027, and enforcement depends on rulemaking and an ongoing federal court matter. Details may change, so check the Colorado Attorney General’s site.
Does the Colorado AI law apply to cold email or AI prospecting?
The sources we read describe it as covering automated decision-making technology used in consequential decisions such as employment, health care, housing, lending and insurance. They do not address sales outreach. If you use AI to decide who gets access to those things, ask a lawyer. For researching and drafting sales emails, it is probably not the main concern.
Do I need consent to send cold email in the UK or EU?
It depends on who the recipient is. The UK ICO says the PECR email rule does not apply to corporate subscribers but does apply to sole traders and some partnerships, and that the UK GDPR applies to named employees’ work emails. We did not research EU member states’ rules, so get local advice before emailing contacts there.
How long should I keep opt-out records?
We found no single legal period in the CAN-SPAM guide. Keep the suppression list for as long as you send email, since deleting it means you could email someone who asked to stop. For send logs, choose a fixed period, write it down and apply it consistently, and ask your lawyer whether your industry requires longer.
Sources
- Federal Trade Commission, CAN-SPAM Act: A Compliance Guide for Business. Read on November 1, 2026. Seven requirements, 10 business days to honor opt-outs, no exception for business-to-business email, penalty of up to $53,088 per violating email (adjusted periodically). The details about postal addresses and opt-out mechanics come from the same guide.
- Jackson Lewis, CCPA FAQ guide (jacksonlewis.com). Read on November 3, 2026. No general B2B exception under the CCPA; coverage thresholds.
- privacyterms.io, State Privacy Law Exemptions 2026 (privacyterms.io). Dated September 2, 2026; read November 3, 2026. Second-hand comparison; treat as a signal and verify state by state.
- UK Information Commissioner’s Office, Business-to-business marketing (ico.org.uk). Read on November 3, 2026.
- McDermott Will & Schulte, Colorado AI law in flux (mcdermottlaw.com). Client alert dated May 27, 2026; read November 3, 2026.
- Eckert Seamans, Colorado repeals and replaces its landmark AI statute (eckertseamans.com). Dated June 12, 2026; read November 3, 2026.
- Tech Times, Colorado AI Law Reset (techtimes.com). Published July 1, 2026; read November 3, 2026. News summary, not the statute.
- LinkedIn Help pages on prohibited software and automated activity: not read by us (both blocked our access). A third-party paraphrase of LinkedIn’s User Agreement was consulted and is not relied on for specifics.
- Not used: the "harmonized state opt-out" email laws mentioned in the brief (no verifiable source found), and the older Colorado figures (February 1, 2026, $20,000 per violation, fewer-than-50-employees exemption), which relate to the repealed law. Read the statutes or official summaries before relying on any summary, including these.
- About Us: who we are and how we work
- Free Workflows: n8n workflows with JSON you can import
- Request a Custom Workflow: describe a task and get a quote
- Terms of Service
- Privacy Policy
This article is general information and not legal, tax or financial advice. Laws and rules differ by country and state and change over time. Check with a qualified professional about your own situation.