{
  "id": "CON-040",
  "slug": "con-040",
  "title": "The consent basis must be an explicit opt-in, not an implied one",
  "statement": "The submission must rest on a consumer act that agreed to messaging — not on an existing relationship, a published number, or a prior transaction.",
  "rationale": "Implied consent is the theory behind most of the numbers that generate complaints: the consumer gave a number to book a table or buy a part, and reads the marketing text that follows as a stranger having got hold of it. Carriers therefore treat \"they are our customers\" as no consent at all, and a submission that argues the relationship rather than describing an act is rejected on the argument itself.",
  "layer": "CONSENT_FLOW",
  "layerSlug": "consent-flow",
  "object": "campaign.message_flow + consent artifact",
  "severity": "BLOCKING",
  "detectability": [
    "AI_FORM"
  ],
  "failureClass": "TERMINAL_EVIDENCE",
  "authorities": [
    "AWS",
    "Bandwidth",
    "FCC"
  ],
  "applicabilityText": "Applies to every 10DLC registration.",
  "universal": true,
  "remediation": "Describe the moment the consumer agreed — what they ticked, said, signed or texted, and where — and attach the evidence of it. Where no such moment exists, collect fresh consent before registering: an existing customer list cannot be argued into an opt-in. Done when the flow names an act rather than a relationship.",
  "example": "Customers tick an unchecked box reading \"Text me Acme Coffee offers\" at https://acmecoffee.com/checkout before the order is placed; the ticked state, timestamp and disclosure version are stored against the order.",
  "pitfalls": [
    "\"Customers provide their number when booking\" describes collection, not consent — the number arriving is not the same event as agreeing to be texted."
  ],
  "notes": "The catalog classes this VISION on the toll-free path (Bandwidth TFV 1402). Authored as AI_FORM because the implied-consent claim is made in the message flow rather than visible in the artifact, and the artifact half is already judged by CON-ART-002. Bandwidth applies it specifically to toll-free verification; it is left universal because the underlying FCC standard is.",
  "phase": "approval",
  "automated": true,
  "url": "https://ekas.io/rules/10dlc/consent-flow/con-040/",
  "markdown": "https://ekas.io/rules/10dlc/consent-flow/con-040.md",
  "registry": "https://ekas.io/rules/10dlc/",
  "updated": "2026-07-25",
  "licence": "CC BY 4.0 — https://creativecommons.org/licenses/by/4.0/"
}