# CON-DOUBLE-OPTIN-CART — Abandoned-cart programs require double opt-in

> Abandoned-cart messaging requires a confirmed double opt-in and must not treat cart placement as consent.

- **Rule ID:** CON-DOUBLE-OPTIN-CART
- **Layer:** Consent flow (`CONSENT_FLOW`)
- **Checks:** `campaign.message_flow`
- **Severity:** BLOCKING — Breaking this rule gets the submission rejected outright.
- **When it bites:** Gates approval — get this wrong and registration is refused
- **How it is detected:** AI judgement over the submitted form
- **Fix type:** Fix the website — no form edit clears it
- **Required by:** T-Mobile, CTIA
- **Applies:** Applies to every 10DLC registration.
- **Canonical URL:** https://ekas.io/rules/10dlc/consent-flow/con-double-optin-cart/

## Why this rule exists

Putting an item in a cart is explicitly not consent to be texted about it, and the number is usually linked to the cart by a cookie the consumer never saw. T-Mobile therefore mandates a confirmed double opt-in for this pattern specifically — one of the very few places double opt-in is required rather than optional.

## How to fix it

Add a confirmation step so the consumer opts in twice, disclose in your terms how the phone number is linked to the cart, send at most one notification per shopping event within 48 hours, and never allow order completion by text reply.

## Notes

Double opt-in is OPTIONAL under CTIA generally. Do not generalise this rule into a universal double-opt-in requirement.