{
  "id": "CON-070",
  "slug": "con-070",
  "title": "Declining messages must not degrade the service afterwards",
  "statement": "A consumer who declines SMS at signup must retain the same access to the underlying service as one who accepted.",
  "rationale": "Consent that is free at the form and expensive afterwards is not free. Where declining quietly costs the customer their booking reminders, their delivery window or their account alerts, the pressure to accept is real even though every control on the page was optional — and the consumer discovers it only after they have chosen.",
  "layer": "CONSENT_FLOW",
  "layerSlug": "consent-flow",
  "object": "post-signup service access",
  "severity": "BLOCKING",
  "detectability": [
    "AI_FORM",
    "HUMAN"
  ],
  "failureClass": "TERMINAL_WEBSITE",
  "authorities": [
    "Twilio",
    "FCC"
  ],
  "applicability": {
    "excludeUseCases": [
      "TWO_FACTOR_AUTH",
      "SECURITY_ALERT",
      "FRAUD_ALERT"
    ]
  },
  "applicabilityText": "Applies when the use case is NOT TWO_FACTOR_AUTH, SECURITY_ALERT and FRAUD_ALERT.",
  "universal": false,
  "remediation": "Walk the journey yourself with the box unticked: create the account, place the order, make the booking, and check that everything a subscriber would receive still reaches you by another channel. Fix whatever only arrives by text. Done when the two journeys differ in the channel and nothing else.",
  "notes": "DETECTABLE ONLY BY THE CUSTOMER. Nothing we can crawl shows what happens to an account after signup, so this is surfaced as a warning with the test the user must run themselves: sign up twice, once declining, and compare what the declining account can do and receive. Twilio applies it as the post-signup half of the same standard CON-069 tests at the form.",
  "phase": "approval",
  "automated": true,
  "attestation": {
    "question": "Have you walked the signup yourself with the SMS box left unticked, and confirmed the account still gets everything a subscriber gets, by some other channel?",
    "howToCheck": [
      "Create two accounts, place two orders or make two bookings: one accepting SMS, one declining.",
      "Compare what each receives and can do — confirmations, reminders, delivery windows, account alerts, support access.",
      "Anything the declining account never receives at all is the defect. Move it to email or in-app."
    ],
    "failureLooksLike": "The declining customer gets no appointment reminder, because reminders were only ever built as texts. Every control on the form was optional, and declining still cost them the service."
  },
  "url": "https://ekas.io/rules/10dlc/consent-flow/con-070/",
  "markdown": "https://ekas.io/rules/10dlc/consent-flow/con-070.md",
  "registry": "https://ekas.io/rules/10dlc/",
  "updated": "2026-07-25",
  "licence": "CC BY 4.0 — https://creativecommons.org/licenses/by/4.0/"
}