{
  "id": "CON-NOT-GATED",
  "slug": "con-not-gated",
  "title": "Declining messages must not block the primary action",
  "statement": "The consumer must be able to decline SMS and still complete the purchase, signup, or account creation.",
  "rationale": "Consent that is the price of checkout is coerced, and coerced consent is not consent — the FCC treats it as void and carriers treat it as a blocking defect. It is also self-defeating commercially: a list built this way has the opt-out and complaint rates of a purchased list.",
  "layer": "CONSENT_FLOW",
  "layerSlug": "consent-flow",
  "object": "consent surface",
  "severity": "BLOCKING",
  "detectability": [
    "CRAWL",
    "VISION"
  ],
  "failureClass": "TERMINAL_WEBSITE",
  "authorities": [
    "FCC",
    "TCR",
    "Twilio",
    "AWS"
  ],
  "codes": [
    {
      "provider": "Twilio",
      "code": "30923",
      "remediable": true,
      "generation": "gen2"
    },
    {
      "provider": "Twilio",
      "code": "30931",
      "remediable": true,
      "generation": "gen2"
    }
  ],
  "applicability": {
    "excludeUseCases": [
      "TWO_FACTOR_AUTH",
      "SECURITY_ALERT",
      "FRAUD_ALERT"
    ]
  },
  "applicabilityText": "Applies when the use case is NOT TWO_FACTOR_AUTH, SECURITY_ALERT and FRAUD_ALERT.",
  "universal": false,
  "remediation": "Remove any required-field validation on the consent control and test the form end to end with the box unchecked. Remove asterisks or \"required\" markers from the messaging opt-in, and offer email or voice as an alternative channel where a contact method is genuinely needed.",
  "pitfalls": [
    "A 2FA or fraud-alert program legitimately requires the number — those use cases are excluded from this rule rather than exempted by argument."
  ],
  "catalogIds": [
    "CON-066",
    "CON-067"
  ],
  "phase": "approval",
  "automated": true,
  "url": "https://ekas.io/rules/10dlc/consent-flow/con-not-gated/",
  "markdown": "https://ekas.io/rules/10dlc/consent-flow/con-not-gated.md",
  "registry": "https://ekas.io/rules/10dlc/",
  "updated": "2026-07-25",
  "licence": "CC BY 4.0 — https://creativecommons.org/licenses/by/4.0/"
}