{
  "id": "OPS-083",
  "slug": "ops-083",
  "title": "Carrier deactivation files must be ingested daily",
  "statement": "The carrier deactivation feeds must be processed every day and the listed numbers removed from every opt-in list.",
  "rationale": "Around a hundred thousand US numbers are deactivated daily and most are reissued to somebody else within months. A consent record follows the number, so an unscrubbed list sends order details, appointment reminders or marketing to a stranger who never opted in — and delivery succeeds, so nothing in the sending metrics reveals it. The carriers publish the feeds specifically to make this preventable, which is why failing to consume them reads as negligence rather than bad luck.",
  "layer": "OPERATIONAL",
  "layerSlug": "operational",
  "object": "deactivation feed ingest job",
  "severity": "BLOCKING",
  "detectability": [
    "EXTERNAL_DATA",
    "HUMAN"
  ],
  "failureClass": "TERMINAL_EXTERNAL",
  "authorities": [
    "T-Mobile",
    "AT&T",
    "CTIA",
    "AWS"
  ],
  "applicabilityText": "Applies to every 10DLC registration.",
  "universal": true,
  "remediation": "Confirm which party consumes the feeds — most CPaaS platforms offer it, several charge for it, and a few leave it entirely to the sender — then run the ingest daily and log each run with its timestamp. Done when a number deactivated on Monday is off your list on Tuesday.",
  "example": "Daily 06:00: pull the T-Mobile and AT&T deactivation files, suppress the listed MDNs, log run_at and record count.",
  "pitfalls": [
    "Delivery failures are not a substitute. A reassigned number delivers perfectly — to the wrong person — so bounce handling never finds these."
  ],
  "notes": "Absorbs OPS-084 and OPS-086, the same daily ingest against a second carrier feed and against a platform-mediated deactivation report. The feeds are carrier data we cannot see. What the user has to establish is whether their provider ingests them on their behalf, whether it is enabled on their account, and what the retention window on those report objects is — several platforms delete them after a few days, so a missed run cannot be replayed. OPS-085 is the approval-side twin: whether the programme describes doing this at all.",
  "catalogIds": [
    "OPS-084",
    "OPS-086"
  ],
  "phase": "post",
  "automated": false,
  "attestation": {
    "question": "Is a number deactivated on Monday off your list on Tuesday — and who is running that ingest?",
    "howToCheck": [
      "Establish which party consumes the carrier deactivation feeds: most CPaaS platforms offer it, several charge for it, and a few leave it entirely to the sender.",
      "Confirm it is enabled on your account, runs daily, and logs each run with a timestamp.",
      "Check the retention window on the report objects — several platforms delete them after a few days, so a missed run cannot be replayed."
    ],
    "failureLooksLike": "Around a hundred thousand US numbers are deactivated daily and most are reissued within months. Delivery to a reassigned number succeeds perfectly — to a stranger — so bounce handling never finds these."
  },
  "url": "https://ekas.io/rules/10dlc/operational/ops-083/",
  "markdown": "https://ekas.io/rules/10dlc/operational/ops-083.md",
  "registry": "https://ekas.io/rules/10dlc/",
  "updated": "2026-07-25",
  "licence": "CC BY 4.0 — https://creativecommons.org/licenses/by/4.0/"
}