# WEB-110 — The age gate must not be trivially bypassable

> The age gate must not be defeatable by dismissing it, by loading a page directly, or by clearing a cookie.

- **Rule ID:** WEB-110
- **Layer:** Website (`WEBSITE`)
- **Checks:** `age-gate implementation`
- **Severity:** HIGH — Rejected by at least one carrier or provider, and a common cause of failure at the rest.
- **When it bites:** Gates approval — get this wrong and registration is refused
- **How it is detected:** Human check — only someone holding the document can settle it
- **Fix type:** Fix the website — no form edit clears it
- **Required by:** Twilio
- **Applies:** Applies to every 10DLC registration.
- **Canonical URL:** https://ekas.io/rules/10dlc/website/web-110/

## Why this rule exists

A gate implemented in front-end code is decoration: it stops nobody who does not want to be stopped, and it stops the reviewer not at all, since the first thing they try is the direct URL. Businesses build it this way because that is what the plugin does, and because the version that actually holds requires the server to know the answer.

## How to fix it

Enforce the gate server-side: refuse to render restricted pages until the age has been submitted and recorded for the session. Done when a direct link, a dismissed dialog and a cleared cookie all still land on the gate.

## Provider rejection codes

| Provider | Code | Resubmission allowed |
| --- | --- | --- |
| Twilio (gen2) | `30956` | yes |

## Check this yourself

**Does the gate still hold after a direct link, a dismissed dialog and a cleared cookie?**

1. Open a restricted URL directly in a private window.
2. Press Escape on the dialog, and try to interact with the page behind it.
3. Clear the cookie and reload. If any of the three gets through, the gate is decoration.

*What wrong looks like:* A front-end plugin renders the page and covers it with an overlay. It stops nobody who does not want to be stopped, and it stops the reviewer not at all — the first thing they try is the direct URL.

## Notes

Nothing we fetch can tell a real gate from a dismissible overlay, so this one is on the user to test: open a restricted product URL directly in a private window, press Escape on the dialog, and clear the cookie between attempts. If any of the three gets through, the gate is decoration and WEB-107 will be judged on it.