{
  "id": "OPS-061",
  "slug": "ops-061",
  "title": "A later form fill does not undo an earlier opt-out",
  "statement": "A consumer who opted out must not be re-subscribed on the strength of a subsequent form submission without a fresh, separately documented opt-in.",
  "rationale": "Somebody who unsubscribed in March and buys something in June has given you their number for the order, not permission to restart the programme they left. Systems do it automatically because the checkout writes the number to the marketing list the same way it always did, and the result is a consumer receiving messages from a programme they explicitly quit — the pattern that produces the angriest complaints.",
  "layer": "OPERATIONAL",
  "layerSlug": "operational",
  "object": "consent record against opt-out record",
  "severity": "HIGH",
  "detectability": [
    "UNDETECTABLE_PRE_SUBMISSION"
  ],
  "failureClass": "TERMINAL_EXTERNAL",
  "authorities": [
    "FCC"
  ],
  "applicabilityText": "Applies to every 10DLC registration.",
  "universal": true,
  "remediation": "Check the suppression list before writing any new consent, and require an explicit, separately recorded opt-in — not a pre-ticked box on a checkout — before removing a number from it. Done when a previously-opted-out number stays suppressed through an ordinary purchase.",
  "example": "Checkout writes consent → suppression list hit → consent stored as pending, no messages sent, and the customer is shown the opt-in box unticked.",
  "pitfalls": [
    "Treating the new consent as newer and therefore controlling is the intuitive data model and the wrong one; an opt-out is a standing instruction, not a timestamped preference."
  ],
  "notes": "A comparison between two records that only exist after launch. What the user has to check is the order of operations at their own signup surfaces — most write consent first and reconcile later, if at all.",
  "phase": "post",
  "automated": false,
  "attestation": {
    "question": "Does a previously opted-out number stay suppressed through an ordinary purchase?",
    "howToCheck": [
      "Check the order of operations at every signup surface: most write consent first and reconcile later, if at all.",
      "Require an explicit, separately recorded opt-in — not a pre-ticked checkout box — before removing anyone from the suppression list.",
      "Test it with a number that opted out months ago."
    ],
    "failureLooksLike": "Someone who unsubscribed in March buys something in June and the checkout writes their number back to the marketing list. Treating the newer record as controlling is the intuitive data model and the wrong one."
  },
  "url": "https://ekas.io/rules/10dlc/operational/ops-061/",
  "markdown": "https://ekas.io/rules/10dlc/operational/ops-061.md",
  "registry": "https://ekas.io/rules/10dlc/",
  "updated": "2026-07-25",
  "licence": "CC BY 4.0 — https://creativecommons.org/licenses/by/4.0/"
}