{
  "id": "CON-BOX-BUNDLED",
  "slug": "con-box-bundled",
  "title": "Messaging consent must be separate from terms acceptance",
  "statement": "The messaging opt-in must be its own control, not bundled into a general \"I accept the Terms and Privacy Policy\" checkbox.",
  "rationale": "A consumer ticking a box to create an account is agreeing to the account, not to marketing texts. Bundling makes the messaging consent unprovable — you cannot show a reviewer, or a court, that the tick meant yes to SMS specifically.",
  "layer": "CONSENT_FLOW",
  "layerSlug": "consent-flow",
  "object": "consent surface",
  "severity": "BLOCKING",
  "detectability": [
    "CRAWL",
    "VISION"
  ],
  "failureClass": "TERMINAL_WEBSITE",
  "authorities": [
    "CTIA",
    "TCR",
    "Twilio",
    "AWS"
  ],
  "applicability": {
    "consentMethods": [
      "web_form",
      "checkout",
      "account_settings",
      "third_party",
      "pos"
    ]
  },
  "applicabilityText": "Applies when consent was collected by web form, checkout, account settings, third party and point of sale.",
  "universal": false,
  "remediation": "Split into two adjacent checkboxes: one for accepting the Terms and Privacy Policy, one for agreeing to receive text messages. Only the second one is your consent record.",
  "example": "☐ I agree to the Terms of Service and Privacy Policy.\n☐ Text me: I agree to receive recurring automated marketing text messages from Acme Coffee. Consent is not a condition of any purchase. Msg frequency varies. Msg & data rates may apply. Reply STOP to unsubscribe.",
  "catalogIds": [
    "CON-055"
  ],
  "phase": "approval",
  "automated": true,
  "url": "https://ekas.io/rules/10dlc/consent-flow/con-box-bundled/",
  "markdown": "https://ekas.io/rules/10dlc/consent-flow/con-box-bundled.md",
  "registry": "https://ekas.io/rules/10dlc/",
  "updated": "2026-07-25",
  "licence": "CC BY 4.0 — https://creativecommons.org/licenses/by/4.0/"
}