# CON-010 — The three subscriber-management attributes must be declared true

> The subscriberOptin, subscriberOptout and subscriberHelp campaign attributes must each be set true, and the HELP declaration must have a keyword set behind it.

- **Rule ID:** CON-010
- **Layer:** Consent flow (`CONSENT_FLOW`)
- **Checks:** `campaign.subscriber_optin + subscriber_optout + subscriber_help`
- **Severity:** BLOCKING — Breaking this rule gets the submission rejected outright.
- **When it bites:** Gates approval — get this wrong and registration is refused
- **How it is detected:** Deterministic (settled in code from the submitted values)
- **Fix type:** Fix the field — a better value in the form clears it
- **Required by:** TCR, Plivo, Twilio
- **Applies:** Applies when the use case is NOT M2M.
- **Canonical URL:** https://ekas.io/rules/10dlc/consent-flow/con-010/

## Why this rule exists

These attributes assert that the programme collects consent, honours opt-outs and answers HELP, which is the baseline claim a campaign makes about itself. Leaving any of them false or unset contradicts every other field in the submission and is a fast, mechanical rejection — Plivo will not even accept the API call. They are also what a carrier relies on when a complaint lands, so declaring HELP with no keyword configured is a claim you will be held to and cannot meet.

## How to fix it

Set all three attributes true, declare at least one HELP keyword, and make sure the claims are real — opt-in evidence attached, opt-out keywords honoured by your platform, and a HELP reply configured. Done when the declaration matches what your platform actually does.

## Example of a compliant value

```text
subscriberOptin: true · subscriberOptout: true · subscriberHelp: true · help_keywords: HELP, INFO
```

## Notes

Three catalog rows, one declaration block: CON-010 (opt-in) is universal except M2M; CON-011 (opt-out) additionally exempts 2FA, which the check applies rather than the applicability tag, since only part of the rule is exempt; CON-012 (help) is universal. The registry spells that use case TWO_FACTOR_AUTH; the catalog spells it 2FA. CON-012 also requires a HELP reply body behind the keyword set — that half is CON-HELP-BACKED, so this rule stops at the keyword set to avoid reporting the same missing message twice. Whether HELP is really answered at runtime is UNDETECTABLE_PRE_SUBMISSION and is not claimed here.