# OPS-116 — Carrier approval is not legal cover

> Litigation exposure must be sized separately for state regimes with a private right of action, and carrier approval must not be treated as legal compliance.

- **Rule ID:** OPS-116
- **Layer:** Operational (`OPERATIONAL`)
- **Checks:** `compliance posture and risk model`
- **Severity:** LOW — Best practice. Worth fixing, rarely fatal on its own.
- **When it bites:** Falls due after approval, once you are live and sending
- **How it is detected:** Human check — only someone holding the document can settle it
- **Fix type:** Wait on an external system or a required interval
- **Required by:** state law (GA, WA and others), courts
- **Applies:** Applies to every 10DLC registration.
- **Canonical URL:** https://ekas.io/rules/10dlc/operational/ops-116/

## Why this rule exists

The two systems are decided by different bodies against different standards: carriers decide whether traffic is carried, courts decide whether it was lawful, and an approved campaign is routinely both. States with private rights of action and statutory damages per message turn a modest programme into a material liability, and the approval that arrived first is not evidence of anything in that forum.

## How to fix it

Size the exposure per state — messages sent, statutory damages, class exposure — and treat that as the compliance driver rather than the carrier verdict. Done when somebody can state the worst-case number for the states you message into.

## Check this yourself

**Can somebody state the worst-case statutory-damages number for the states you message into?**

1. Size the exposure per state: messages sent, statutory damages per message, class exposure.
2. Get legal advice on the states you reach, and keep that conversation separate from anything about registration.
3. Treat that number as the compliance driver rather than the carrier verdict.

*What wrong looks like:* Carriers decide whether traffic is carried and courts decide whether it was lawful. An approved campaign is routinely both, and approval feels like permission when it is not.

## Notes

A legal assessment rather than a check. What the user has to do is get advice on the states they reach, and separate that conversation from anything about registration — the two get conflated because approval feels like permission and is not.