Rule
Consent for marketing messages must be explicitly captured and verifiable.
Why
Sending marketing messages to unconsented recipients violates CAN-SPAM, GDPR, TCPA, and carrier codes of conduct.
Must
- Record opt-in timestamp, channel, source page, and consent copy version at sign-up.
- Implement double-opt-in for SMS/RCS marketing where legally required.
- Process STOP (opt-out) replies within 24 hours maximum.
- Honor opt-out globally across all marketing campaigns on that channel.
Should
- Use START/HELP/STOP standard keywords without alteration.
- Separate transactional and marketing consent records.
Anti-patterns
- Pre-ticking a marketing consent checkbox.
- Sending marketing messages to transactional-only subscribers.
- Opt-out that applies only to one campaign.
Test Cases
- STOP reply prevents all subsequent marketing sends.
- Opt-in record stores consent copy version at time of collection.
Telemetry
- opt_in_collected
- opt_out_processed
- send_blocked_opted_out
- double_opt_in_confirmed