The age gate must not be trivially bypassable

The requirementstatement

The age gate must not be defeatable by dismissing it, by loading a page directly, or by clearing a cookie.

Severityseverity: HighHIGHRejected by at least one carrier or provider, and a common cause of failure at the rest.
When it bitesphase: Gates approvalapprovalGet this wrong and the brand or campaign is refused at registration.
What is checkedobject: age-gate implementation
Where it liveslayer: WebsiteWEBSITE
How Ekas settles itdetectability: Human checkHUMAN; Only someone holding the document or making the call can settle it. Ekas tells you exactly what to look at.
What the fix involvesfailureClass: Fix the websiteTERMINAL_WEBSITE; The fix lives on your site. No amount of rewording the form clears it.
Who requires itauthorities: Twilio
When it appliesapplicabilityText: Applies to every 10DLC registration.

Why this rule existsrationale

A gate implemented in front-end code is decoration: it stops nobody who does not want to be stopped, and it stops the reviewer not at all, since the first thing they try is the direct URL. Businesses build it this way because that is what the plugin does, and because the version that actually holds requires the server to know the answer.

How to fix itremediation

Enforce the gate server-side: refuse to render restricted pages until the age has been submitted and recorded for the session. Done when a direct link, a dismissed dialog and a cleared cookie all still land on the gate.

Provider rejection codescodes

The code you get back when this rule is what failed, and whether that provider lets you resubmit.

Provider	Code	Resubmit
Twiliogen2	30956	Yes

Check this yourselfattestation

No tool can settle this one for you. Here is the check, and what wrong looks like.

Does the gate still hold after a direct link, a dismissed dialog and a cleared cookie?

1Open a restricted URL directly in a private window.
2Press Escape on the dialog, and try to interact with the page behind it.
3Clear the cookie and reload. If any of the three gets through, the gate is decoration.

What wrong looks like: A front-end plugin renders the page and covers it with an overlay. It stops nobody who does not want to be stopped, and it stops the reviewer not at all — the first thing they try is the direct URL.

Notesnotes

Nothing we fetch can tell a real gate from a dismissible overlay, so this one is on the user to test: open a restricted product URL directly in a private window, press Escape on the dialog, and clear the cookie between attempts. If any of the three gets through, the gate is decoration and WEB-107 will be judged on it.

Rules you will hit next

Other website rules at the same severity. A registration is judged as a whole, not rule by rule.

WEB-018The site must be readable in EnglishHighHIGH WEB-019The site must stay live for the whole vetting window, not just at submissionHighHIGH WEB-026The site must look established rather than erected for the registrationHighHIGH WEB-028A campaign landing page is not the brand websiteHighHIGH WEB-030E-commerce brands need a published catalogHighHIGH WEB-032The business name must be visible on the page, not only in the markupHighHIGH

All website rules

WEB-110 is one of 93 website rules in the 915-rule 10DLC registry. Free to cite under CC BY 4.0.