{
  "id": "WEB-110",
  "slug": "web-110",
  "title": "The age gate must not be trivially bypassable",
  "statement": "The age gate must not be defeatable by dismissing it, by loading a page directly, or by clearing a cookie.",
  "rationale": "A gate implemented in front-end code is decoration: it stops nobody who does not want to be stopped, and it stops the reviewer not at all, since the first thing they try is the direct URL. Businesses build it this way because that is what the plugin does, and because the version that actually holds requires the server to know the answer.",
  "layer": "WEBSITE",
  "layerSlug": "website",
  "object": "age-gate implementation",
  "severity": "HIGH",
  "detectability": [
    "HUMAN"
  ],
  "failureClass": "TERMINAL_WEBSITE",
  "authorities": [
    "Twilio"
  ],
  "codes": [
    {
      "provider": "Twilio",
      "code": "30956",
      "remediable": true,
      "generation": "gen2"
    }
  ],
  "applicabilityText": "Applies to every 10DLC registration.",
  "universal": true,
  "remediation": "Enforce the gate server-side: refuse to render restricted pages until the age has been submitted and recorded for the session. Done when a direct link, a dismissed dialog and a cleared cookie all still land on the gate.",
  "notes": "Nothing we fetch can tell a real gate from a dismissible overlay, so this one is on the user to test: open a restricted product URL directly in a private window, press Escape on the dialog, and clear the cookie between attempts. If any of the three gets through, the gate is decoration and WEB-107 will be judged on it.",
  "phase": "approval",
  "automated": false,
  "attestation": {
    "question": "Does the gate still hold after a direct link, a dismissed dialog and a cleared cookie?",
    "howToCheck": [
      "Open a restricted URL directly in a private window.",
      "Press Escape on the dialog, and try to interact with the page behind it.",
      "Clear the cookie and reload. If any of the three gets through, the gate is decoration."
    ],
    "failureLooksLike": "A front-end plugin renders the page and covers it with an overlay. It stops nobody who does not want to be stopped, and it stops the reviewer not at all — the first thing they try is the direct URL."
  },
  "url": "https://ekas.io/rules/10dlc/website/web-110/",
  "markdown": "https://ekas.io/rules/10dlc/website/web-110.md",
  "registry": "https://ekas.io/rules/10dlc/",
  "updated": "2026-07-25",
  "licence": "CC BY 4.0 — https://creativecommons.org/licenses/by/4.0/"
}