{
  "id": "WEB-109",
  "slug": "web-109",
  "title": "The age gate must come before the restricted content, not after it",
  "statement": "The age gate must be presented before any age-restricted content is accessible, including on a page reached by a direct link.",
  "rationale": "A gate that appears after the visitor has already seen the product has protected nobody — the harm the rule addresses happened on page load. The usual cause is a gate wired into the home page template only, so every deep link from a message, a search result or a QR code lands past it.",
  "layer": "WEBSITE",
  "layerSlug": "website",
  "object": "page flow ordering",
  "severity": "BLOCKING",
  "detectability": [
    "CRAWL"
  ],
  "failureClass": "TERMINAL_WEBSITE",
  "authorities": [
    "Twilio",
    "Aerialink"
  ],
  "codes": [
    {
      "provider": "Twilio",
      "code": "30956",
      "remediable": true,
      "generation": "gen2"
    }
  ],
  "applicabilityText": "Applies to every 10DLC registration.",
  "universal": true,
  "remediation": "Enforce the gate on every restricted URL rather than on the home page, and check the answer server-side before the page renders. Done when pasting a product URL into a fresh browser shows the gate first.",
  "pitfalls": [
    "For a QR opt-in the date of birth must be captured before consent is collected, not on the confirmation step — a gate after the number has been submitted is too late for both requirements."
  ],
  "notes": "Conditional on age-restricted content being present, the same condition as WEB-107, and carried in the criteria for the same reason: tagging on the declared ageGated attribute would exempt exactly the brands that under-declare.",
  "phase": "approval",
  "automated": true,
  "url": "https://ekas.io/rules/10dlc/website/web-109/",
  "markdown": "https://ekas.io/rules/10dlc/website/web-109.md",
  "registry": "https://ekas.io/rules/10dlc/",
  "updated": "2026-07-25",
  "licence": "CC BY 4.0 — https://creativecommons.org/licenses/by/4.0/"
}