# CON-BOX-BUNDLED — Messaging consent must be separate from terms acceptance

> The messaging opt-in must be its own control, not bundled into a general "I accept the Terms and Privacy Policy" checkbox.

- **Rule ID:** CON-BOX-BUNDLED
- **Layer:** Consent flow (`CONSENT_FLOW`)
- **Checks:** `consent surface`
- **Severity:** BLOCKING — Breaking this rule gets the submission rejected outright.
- **When it bites:** Gates approval — get this wrong and registration is refused
- **How it is detected:** AI judgement over the crawled website or policy page; AI vision over a consent artifact (screenshot, scan, MMS media)
- **Fix type:** Fix the website — no form edit clears it
- **Required by:** CTIA, TCR, Twilio, AWS
- **Applies:** Applies when consent was collected by web form, checkout, account settings, third party and point of sale.
- **Canonical URL:** https://ekas.io/rules/10dlc/consent-flow/con-box-bundled/

## Why this rule exists

A consumer ticking a box to create an account is agreeing to the account, not to marketing texts. Bundling makes the messaging consent unprovable — you cannot show a reviewer, or a court, that the tick meant yes to SMS specifically.

## How to fix it

Split into two adjacent checkboxes: one for accepting the Terms and Privacy Policy, one for agreeing to receive text messages. Only the second one is your consent record.

## Example of a compliant value

```text
☐ I agree to the Terms of Service and Privacy Policy.
☐ Text me: I agree to receive recurring automated marketing text messages from Acme Coffee. Consent is not a condition of any purchase. Msg frequency varies. Msg & data rates may apply. Reply STOP to unsubscribe.
```