2022-03-20: Compliance with Twilio's Acceptable Use Policy.

[ejaxon]

Twilio sent the following message on March 14, 2022. I am somewhat concerned that we may not be in compliance if we don't implement a confirmation step.

I am somewhat reluctant to do that for 2 reasons. One is just the added complexity, but we can manage that. The other is that it disallows, e.g., a lawyer signing up their client's phone for them while they are in jail, since their phone is off and held by the jail. This is something my wife does as their lawyer so they don't have to remember to do it after getting out.

---

Ahoy!

Maintaining consumer trust is the biggest challenge and opportunity in business messaging today. Consumers expect to receive wanted and personalized communications when and where they need, while being protected from spam and unwanted messaging.

In partnership with you and the entire ecosystem, Twilio aims to support messaging as a high engagement channel. Sending messages through a trusted platform like Twilio ensures you can depend on:

1. High message deliverability: Your customers can depend on every message reaching their handset when they expect it.
2. Sustained engagement from end users: You can depend on SMS/MMS as a channel with higher response rates than nearly any other channel.
3. A strong reputation with carriers: Your business continues to be viewed as a strong ecosystem partner who prioritizes the trust of consumers.

In a continued effort to maintain a high deliverability and high engagement ecosystem, Twilio is updating our systems and policies to proactively identify and not accept messages in violation of Twilio’s Acceptable Use Policy before they reach carrier networks. These changes will occur on April 12, 2022. Specifically:

• SMS/MMS messages directed to United States and Canada phone numbers that are proactively identified as messages in violation of Twilio’s Acceptable Use Policy will be returned as an error prior to reaching carrier networks.
• API Response Headers for messages sent will include Message Submitted. Pending content verification for US/Canada destination numbers. This will not slow down the delivery of your messages. If a message is identified and returned, you will receive an error code to help you identify necessary changes.

What’s next for you?

• Review Twilio’s Acceptable Use Policy and Messaging Policy, and ensure all messages that you or your customers send comply.
• Twilio is updating its Messaging Policy, Country Specific Requirements, Privacy Notice and Data Protection Addendum to provide clear notice that we proactively identify and do not accept messages in violation of Twilio’s Acceptable Use Policy. Your continued use of Twilio to send SMS/ MMS, acknowledges your acceptance of our updated terms. If you wish to opt out, you will need to discontinue use of our messaging services.
• Review your current terms and conditions/user policies and confirm your customer and recipient consents are adequate. If you are an Independent Software Vendor (“ISV”) providing messaging services to other businesses, ensure your customers reflect these changes with their recipients.
• Review your Application(s). While we don’t anticipate any adverse impact to your Applications as a result of the change to our API Response Header, we recommend you have your developers review it/(them) all the same. To stay up to date on the change for the API Response Header, refer to Twilio’s Changelog.

NOTE: Customers with an approved Business Associate Agreement (BAA) will continue to be exempted from proactive identification of message content due to HIPAA privacy restrictions. However, these customers remain subject to review of your message content if carrier and/or consumer complaints are received, or other risk indicators, such as high error rates are present.

We strive to keep you updated with the latest information, best practices and industry requirements to maintain deliverability and in keeping consumers safe. Thank you for doing your part, and let us know how we can help.

Sincerely,

Team Twilio

[ejaxon]

After a conversation with a lawyer in this space, the basic conclusions are:

• We do not need to implement an extra confirmation via SMS for signup. It's sufficient to send a confirmation text and let the recipient know that they can text stop to unsubscribe.
• We do need to add a reminder about how to unsubscribe to every text we send, as well as identification of the site/URL. That's covered in a couple recent issues.
• We probably need to add some logging as documentation of "consent", which means we'll need to store the phone numbers longer than we'd like. Max is 4 years (the statute of limitations), but probably enough to keep around for a much shorter period, enough to demonstrate that we operate as we say we operate (consent here basically means the sequence of a. someone signs up a number, b. we send a confirmation SMS with instructions on unsubscribing, c. we unsubscribe when asked and log that fact). I'll create a separate issue for this.