{
  "id": "CON-064",
  "slug": "con-064",
  "title": "A kiosk or terminal must not pre-fill the consumer's number",
  "statement": "A payment terminal or kiosk collecting messaging consent must require the consumer to enter their number, not present one already filled in.",
  "rationale": "A number the terminal already knows — from the card, the loyalty account, or the last transaction — turns the consent step into a confirmation of something the consumer never supplied for this purpose. They tap Yes to a number on screen without deciding to hand it over, and the resulting record cannot show that they did.",
  "layer": "CONSENT_FLOW",
  "layerSlug": "consent-flow",
  "object": "kiosk consent screen",
  "severity": "HIGH",
  "detectability": [
    "VISION"
  ],
  "failureClass": "TERMINAL_WEBSITE",
  "authorities": [
    "Twilio"
  ],
  "codes": [
    {
      "provider": "Twilio",
      "code": "30925",
      "remediable": true,
      "generation": "gen2"
    }
  ],
  "applicability": {
    "consentMethods": [
      "pos"
    ]
  },
  "applicabilityText": "Applies when consent was collected by point of sale.",
  "universal": false,
  "remediation": "Configure the terminal to present an empty number field at the consent step, even where the number is already on the account. Done when the screenshot shows a blank field and a keypad rather than a masked number and a Confirm button.",
  "pitfalls": [
    "Masking the pre-filled number does not fix it — the consumer still did not type it, and a reviewer reads the mask as evidence the number came from somewhere else."
  ],
  "notes": "Sourced from vendor guidance rather than published carrier text; the underlying obligation is that consent must be an affirmative act by the consumer, which the pre-filled field removes. Cite that if a user pushes back on the rule as stated.",
  "phase": "approval",
  "automated": true,
  "url": "https://ekas.io/rules/10dlc/consent-flow/con-064/",
  "markdown": "https://ekas.io/rules/10dlc/consent-flow/con-064.md",
  "registry": "https://ekas.io/rules/10dlc/",
  "updated": "2026-07-25",
  "licence": "CC BY 4.0 — https://creativecommons.org/licenses/by/4.0/"
}