{
  "id": "CMP-127",
  "slug": "cmp-127",
  "title": "A consent surface a reviewer cannot reach must be declared as such",
  "statement": "Where the opt-in sits behind a login, is unpublished, is spoken, or is on paper, the submission must say so explicitly.",
  "rationale": "A reviewer who cannot find the opt-in assumes it does not exist, because that is far more often true than the alternative. Saying \"this opt-in is inside the customer account portal, screenshot attached\" converts a dead end into a documented one — the same registration, differing only in whether the reviewer had to guess.",
  "layer": "CAMPAIGN",
  "layerSlug": "campaign",
  "object": "campaign.message_flow",
  "severity": "HIGH",
  "detectability": [
    "AI_FORM"
  ],
  "failureClass": "RETRY_FIELD",
  "authorities": [
    "AWS",
    "Twilio"
  ],
  "codes": [
    {
      "provider": "Twilio",
      "code": "30909",
      "remediable": true
    }
  ],
  "applicabilityText": "Applies to every 10DLC registration.",
  "universal": true,
  "remediation": "Add one sentence naming why the surface is not reachable and what stands in for it. Done when the flow text answers the question a reviewer would otherwise have to ask.",
  "example": "The opt-in toggle sits inside the authenticated account portal and cannot be crawled, so a screenshot taken from a live account is attached: https://cdn.acmecoffee.com/compliance/portal-optin.png",
  "catalogIds": [
    "CON-021"
  ],
  "phase": "approval",
  "automated": true,
  "url": "https://ekas.io/rules/10dlc/campaign/cmp-127/",
  "markdown": "https://ekas.io/rules/10dlc/campaign/cmp-127.md",
  "registry": "https://ekas.io/rules/10dlc/",
  "updated": "2026-07-25",
  "licence": "CC BY 4.0 — https://creativecommons.org/licenses/by/4.0/"
}