{
  "id": "CON-BOX-UNCHECKED",
  "slug": "con-box-unchecked",
  "title": "The consent control must be unchecked by default",
  "statement": "The opt-in control must not be pre-selected; consent must be a deliberate act.",
  "rationale": "A pre-ticked box collects consent from everyone who did not notice it, which is the definition of consent that was not affirmatively given. It is one of the few defects a reviewer can confirm from a single screenshot, so it is caught reliably and rejected without discussion.",
  "layer": "CONSENT_FLOW",
  "layerSlug": "consent-flow",
  "object": "consent surface",
  "severity": "BLOCKING",
  "detectability": [
    "VISION"
  ],
  "failureClass": "TERMINAL_WEBSITE",
  "authorities": [
    "CTIA",
    "FCC",
    "TCR",
    "Twilio",
    "AWS"
  ],
  "codes": [
    {
      "provider": "Twilio",
      "code": "30925",
      "remediable": true,
      "generation": "gen2"
    }
  ],
  "applicability": {
    "consentMethods": [
      "web_form",
      "checkout",
      "account_settings",
      "third_party",
      "pos"
    ]
  },
  "applicabilityText": "Applies when consent was collected by web form, checkout, account settings, third party and point of sale.",
  "universal": false,
  "remediation": "Render the checkbox unchecked on first paint. Check your form builder's default — Shopify, Klaviyo and most form plugins ship marketing consent pre-enabled, so this is usually a settings toggle rather than a code change.",
  "pitfalls": [
    "Capturing the screenshot after you clicked the box proves nothing — take it on a fresh page load."
  ],
  "catalogIds": [
    "CON-052"
  ],
  "phase": "approval",
  "automated": true,
  "url": "https://ekas.io/rules/10dlc/consent-flow/con-box-unchecked/",
  "markdown": "https://ekas.io/rules/10dlc/consent-flow/con-box-unchecked.md",
  "registry": "https://ekas.io/rules/10dlc/",
  "updated": "2026-07-25",
  "licence": "CC BY 4.0 — https://creativecommons.org/licenses/by/4.0/"
}