docs/compliance.md
# Compliance — what NOT to do on LinkedIn LinkedIn's User Agreement explicitly prohibits a lot of automation that agents like this make easy. Read once, configure agent behavior accordingly. ## Hard prohibitions (account suspension risk) - **No bulk connection requests via API or scraping.** LinkedIn doesn't expose connection-send via API specifically because it's been used for spam. Doing it via Browserbase gets accounts restricted. - **No view-bots or follow-bots.** Even via Browserbase. Hardware fingerprinting + rate-limiting catches these fast. - **No scraping public profile data without consent.** This was tested in the hiQ Labs case — the legal status is unsettled but LinkedIn's TOS still prohibits. - **No impersonation.** The agent posts AS Steve, signed in via OAuth as Steve. It must not pretend to be anyone else. ## Soft prohibitions (visible to LinkedIn but won't suspend) - More than ~100 connection requests per WEEK on a free account - More than ~5-10 posts per DAY (algorithm down-ranks above this) - More than ~50 comments per HOUR - Posting the SAME text twice in 24h (algorithm flags as duplicate) ## Comms-compliance hand-off For ANY outbound that hits non-Steve recipients (DMs, connection-request notes, comments on posts where you're not already in the thread), this agent should ALWAYS gate through Steve's `comms-compliance` subagent first. That subagent enforces: - CAN-SPAM (subject lines, opt-out, physical address requirement for commercial messaging) - CCPA / CPRA (California privacy) - TCPA (telecom — relevant if SMS is added later) - Federal DNC list (Do Not Call) - Per-state DNC lists (Utah CPR is the strictest) - §17529.5 (California email-spam statute) For LinkedIn specifically: - Connection-request notes are NOT email but DO carry an implicit TCPA-like "do you want to receive this" signal. Treat as cold outbound. - Comments on someone's post where you're already responding to a thread = fine, no compliance check needed. ## Algorithm-friendly behavior - Post during high-engagement windows (Tue-Thu 8-10am or 4-6pm Pacific) - Vary post format: some text-only, some with images, some with links - Reply to comments on your own posts within 1 hour of them landing - Comment on others' posts (substantive, see `templates/comment-helpful.md`) to keep your "active engagement" score up ## Data retention - This agent does NOT store post history beyond the LinkedIn URN (which is public anyway). If you want a local log for audit/analytics, add a `posts.jsonl` file written by `lib/linkedin.ts` (TODO). - OAuth tokens live in `.env.local` only. Rotate by re-running the OAuth flow at `/auth` (overwrites the existing token).