{
  "id": "OPS-116",
  "slug": "ops-116",
  "title": "Carrier approval is not legal cover",
  "statement": "Litigation exposure must be sized separately for state regimes with a private right of action, and carrier approval must not be treated as legal compliance.",
  "rationale": "The two systems are decided by different bodies against different standards: carriers decide whether traffic is carried, courts decide whether it was lawful, and an approved campaign is routinely both. States with private rights of action and statutory damages per message turn a modest programme into a material liability, and the approval that arrived first is not evidence of anything in that forum.",
  "layer": "OPERATIONAL",
  "layerSlug": "operational",
  "object": "compliance posture and risk model",
  "severity": "LOW",
  "detectability": [
    "HUMAN"
  ],
  "failureClass": "TERMINAL_EXTERNAL",
  "authorities": [
    "state law (GA, WA and others)",
    "courts"
  ],
  "applicabilityText": "Applies to every 10DLC registration.",
  "universal": true,
  "remediation": "Size the exposure per state — messages sent, statutory damages, class exposure — and treat that as the compliance driver rather than the carrier verdict. Done when somebody can state the worst-case number for the states you message into.",
  "notes": "A legal assessment rather than a check. What the user has to do is get advice on the states they reach, and separate that conversation from anything about registration — the two get conflated because approval feels like permission and is not.",
  "phase": "post",
  "automated": false,
  "attestation": {
    "question": "Can somebody state the worst-case statutory-damages number for the states you message into?",
    "howToCheck": [
      "Size the exposure per state: messages sent, statutory damages per message, class exposure.",
      "Get legal advice on the states you reach, and keep that conversation separate from anything about registration.",
      "Treat that number as the compliance driver rather than the carrier verdict."
    ],
    "failureLooksLike": "Carriers decide whether traffic is carried and courts decide whether it was lawful. An approved campaign is routinely both, and approval feels like permission when it is not."
  },
  "url": "https://ekas.io/rules/10dlc/operational/ops-116/",
  "markdown": "https://ekas.io/rules/10dlc/operational/ops-116.md",
  "registry": "https://ekas.io/rules/10dlc/",
  "updated": "2026-07-25",
  "licence": "CC BY 4.0 — https://creativecommons.org/licenses/by/4.0/"
}