Colorado SB 26-189 Excludes Marketing AI. The Pricing Clause Pulled It Back In.

Colorado's House passed SB 26-189 on May 9, 2026, by a 57-6 vote, replacing the contested SB 24-205 with a January 1, 2027 effective date. The new bill explicitly excludes advertising, marketing, search, and content moderation from its definition of a consequential decision. But differentiated pricing inside insurance, lending, housing, and employment still triggers the law, which means lookalike audiences and AI bid logic in those verticals remain inside the regulatory perimeter.

That carve-out is the part trade press is undercovering. The headline framing has been generic, mostly some version of "new state AI law lands in Colorado." But marketing leaders working in the regulated verticals listed above need a different read. The bill creates a soft exemption for the marketing function and a hard inclusion for the moment marketing decisions translate into pricing, eligibility, or access in covered domains. PPC Land's reading of the bill is unusually careful here, which is rare for a marketing trade publication covering legislation.

What the carve-out actually says

The bill defines a covered ADMT (automated decision-making technology) as a system that processes personal data and uses computation to materially influence a consequential decision. The covered domains are narrow and named: education enrollment, employment, residential real estate in Colorado, financial and lending services, insurance, healthcare, and essential government services or public benefits.

The exclusion list is where most marketing teams will look for breathing room, and they will find it. Advertising, marketing, differentiated product recommendations, search, and content moderation are all explicitly excluded from the consequential decision definition. Chatbots that aren't configured for use in eligibility determinations are exempt too, provided they have a written acceptable use policy that prohibits the generated content from being used in such decisions.

That is a meaningful win for the bulk of marketing tooling. A retail brand running a Performance Max campaign with AI-generated creative and lookalike audiences is not going to find its workflow in scope. A media planning team using a generative tool to draft email subject lines is similarly outside the perimeter. The bill's drafters appear to have pulled apart the function of generating awareness from the function of allocating an outcome, and only regulated the second one.

I think the cleanest mental model is this: the law cares about the moment a person gets told yes or no. Or the moment they get charged 14% APR while a similarly situated applicant gets 8%. It does not care whether AI helped find them in the first place.

Where the carve-out leaks back into marketing

The pricing clause is the loophole closer. The bill's definition of an adverse outcome explicitly captures "materially less favorable differentiated pricing or terms compared to similarly situated consumers." That sentence is what reels marketing teams back inside the law if their workflow touches a covered vertical.

An insurance carrier using AI to set quote variations across an applicant pool: covered. A lender using a propensity model to decide which segments see a 0% intro APR offer and which see 19.99%: covered. A residential property manager using an AI system to differentiate rent renewal terms by tenant: covered. The decision logic in each of those workflows looks like marketing optimization on paper. Inside the bill, it is automated decision-making with the consumer rights and 30-day notice obligations that come with it.

From what I have seen in adjacent state-level rulemaking, the carve-out for advertising tends to hold up only as long as the advertising layer doesn't make the price decision. As soon as your CRM is firing different LTV-tier offers at people in covered industries, a state AG's office can argue the marketing tool is operating as part of the consequential decision pipeline. That argument is harder to win in cosmetics. It gets a lot easier in insurance, lending, healthcare, and housing.

The 30-day deployer notice is the operational shock

Once SB 26-189 hits its January 1, 2027 effective date, businesses that deploy a covered ADMT and produce an adverse outcome have to send the consumer a structured notice within 30 days. That notice has to include a plain-language description of the decision and the role the ADMT played, instructions for requesting more information about the system (name, version number, developer, types of personal data used), and an explanation of the consumer's correction and human review rights.

This is the part that breaks the way most teams currently run AI in lifecycle marketing. If the same model that scores leads also influences pricing or access in a covered vertical, then every decline letter, every revoked offer, every reduced credit line needs to flow through a process that didn't exist last quarter. The bill also gives consumers a right to request meaningful human review and reconsideration where commercially reasonable. That phrase is doing a lot of work and the rules will be written by the Department of Law before the effective date.

The numbers nobody is staffing for

Enforcement is exclusive to the Colorado Attorney General, operating through the Colorado Consumer Protection Act. Violations are deceptive trade practices, with civil penalties of up to $20,000 per violation. Records have to be retained for at least three years after a consequential decision.

There is a 60-day cure period before the AG can initiate enforcement, which sounds generous until you read the fine print. The cure right expires on January 1, 2030. After that, the AG can move directly. The cure period also doesn't apply when a developer or deployer knowingly or repeatedly violated the requirements, which is exactly the category most aggressive AI marketing automation will end up in if it isn't deliberately structured to avoid covered domains.

The fiscal note projects $56,286 of state expenditure in fiscal year 2026-27, falling to zero the following year. The Department of Law gets 0.4 FTE of an Assistant Attorney General to do rulemaking. That is a small enforcement footprint, which honestly cuts both ways. It probably means the AG's office picks high-visibility targets early and lets the cure period do most of the work for the rest. If you are running AI-driven decisioning in a covered Colorado vertical and you are above a certain size, you are a likelier candidate than the state's headcount math suggests.

What this means for the xAI lawsuit

SB 26-189 also rewrites the legal landscape for x.AI LLC v. Weiser. The xAI complaint, which the Department of Justice intervened in, attacked SB 24-205 on First Amendment, Dormant Commerce Clause, Due Process, and Equal Protection grounds. The structural problem for xAI now is that the underlying statute it sued over has been repealed and replaced with a different framework that drops the "high-risk AI system" and "algorithmic discrimination" language the original complaint targeted.

According to HR Dive's coverage of the stay order, a magistrate judge already paused enforcement on a joint motion, with xAI required to file a motion for preliminary injunction or amended complaint within 28 days of Colorado adopting either rulemaking under SB 24-205 or replacement legislation. SB 26-189 just started that clock. The case isn't automatically moot, but the new bill's narrower regulatory perimeter and the absence of the contested terms gives the AG's office a much stronger defense than it had against SB 24-205.

The audit you can run before the August special session ends

The compliance work that actually matters is mapping which workflows touch a covered domain. That is the thirty-minute exercise marketing-ops can do this week. Pull a list of every AI tool currently in production. Tag each one with the function it serves: lead generation, creative production, audience targeting, scoring, pricing, access, eligibility, retention. Then tag the industry vertical the tool is deployed against.

Anything in the lead generation, creative, or general targeting columns is almost certainly outside the regulatory perimeter unless it feeds a downstream decision in insurance, lending, housing, employment, healthcare, education, or government services. Anything in the scoring, pricing, access, or eligibility columns within those verticals is inside, and those workflows need a documented human review process and a 30-day adverse-outcome notice template before January 1, 2027.

Most teams will not need to change anything. A retail or DTC brand running standard programmatic plus AI creative is probably untouched. A health insurance carrier or fintech lender using lookalikes to gate offers is going to feel this. The point of mapping is not to panic about the law, it is to find out which side of the line your specific stack sits on.

Colorado tends to set a floor that other states inherit, slowly but reliably. The EU AI Act's December 2027 delay already gave most marketing tools a pass federally. SB 26-189 keeps that pattern at the state level, but only for the marketing function in isolation. The verticals where marketing controls pricing or access stayed inside the perimeter on purpose.

The teams who do the workflow audit before the rules drop in late 2026 will spend a few hours mapping. The teams who wait will spend the cure period reading $20,000 violation notices and explaining to compliance why their PMax bid logic is suddenly part of an adverse outcome notice template. That is not a hypothetical risk in covered verticals. It is what the statute now defines.

Notice Me Senpai Editorial