# OPS-384 — Nothing goes out before the opt-in

> Messages may be sent only after the consumer has opted in; the single opt-out acknowledgement is the only permitted exception.

- **Rule ID:** OPS-384
- **Layer:** Operational (`OPERATIONAL`)
- **Checks:** `send-time consent check`
- **Severity:** BLOCKING — Breaking this rule gets the submission rejected outright.
- **When it bites:** Falls due after approval, once you are live and sending
- **How it is detected:** Not knowable before submission — reported with its deadline
- **Fix type:** Hard stop — not remediable, resubmission will not help
- **Required by:** CTIA, FCC, all MNOs
- **Applies:** Applies to every 10DLC registration.
- **Canonical URL:** https://ekas.io/rules/10dlc/operational/ops-384/

## Why this rule exists

This is the obligation the whole framework exists to enforce, and it is worth stating separately because the failure is rarely a decision to send unsolicited messages — it is a list imported without provenance, a form that wrote consent before the box was ticked, or a test send to a colleague's number that went to the whole file. The consequence does not scale with the intent.

## How to fix it

Check consent at send time against a per-number record, never against list membership, and make an unconsented number impossible to include rather than unlikely.

## Check this yourself

**Does your send path check a per-number consent record, or does it check list membership?**

1. Trace one send to the thing it actually reads. Segments are built by people; consent records are not.
2. Make an unconsented number impossible to include rather than unlikely.
3. The single opt-out acknowledgement is the only message permitted without a prior opt-in.

*What wrong looks like:* A list imported without provenance, a form that wrote consent before the box was ticked, or a test send to a colleague that went to the whole file. The consequence does not scale with the intent.

## Notes

The runtime form of everything the CONSENT_FLOW layer checks at registration. What the user has to verify is that their send path reads a consent record rather than a segment — segments are built by people and consent records are not.