X Openai Twilio Compliance Traffic 0bab76f

---
name: x-openai-twilio-compliance-traffic-0bab76f
description: Rules you must follow for Twilio messaging and voice traffic. Covers TCPA (consent tiers, quiet hours, DNC), GDPR (EU consent, right to deletion), PCI DSS (payment recording, Pay verb), HIPAA (BAA, PHI), FDCPA (debt collection limits), CAN-SPAM, WhatsApp policies, SHAKEN/STIR, and consent management patterns. Use this skill proactively when developers have working traffic to ensure they follow the rules.
---

### 导出副本边界与技能别名

迁移、安装、修复和经验回写只作用于当前加载的目标宿主技能副本。原 Codex 技能/MCP、下载的源码和 `original-skills` 均为来源材料，不因执行本副本而写入；只有用户另行明确要求配置 Codex 产品本身时，才按该产品流程处理指定目标。脚本需要安装目录或状态目录时，显式提供目标路径；不得从 `CODEX_HOME` 隐式推断写入位置。

跨技能名称可能沿用源库别名。先查 [技能别名表](../../skill-aliases.json)，优先选择同来源、同插件的条目，再使用其 `id` 调用或读取对应入口；不得假定旧 `$skill`、`superpowers:skill` 名称在新宿主直接注册。不能确定目标时先核对，不替换真实产品命令或 Shell 环境变量。

## 跨宿主使用约定

本副本供支持 Agent Skills 的客户端使用。先检查当前宿主实际提供的工具、权限和已连接服务，再执行正文工作流。原文中的宿主工具标识是能力参考；只有实际发现该工具时才可调用，其他宿主应使用经核验的等价 MCP、CLI 或 API。没有等价能力的步骤必须报告不可用，不能虚构调用或完成状态。

技能资源以本技能目录为基准；输出写入当前项目中用户指定的位置。通过技能名称或自然语言触发，具体快捷命令由宿主决定。涉及真实产品、模型 API、协议字段和官方网址的名称保持原意。授权、审批、隐私和工具范围限制在迁移后仍然有效；不得为兼容而扩大权限。具体依赖与迁移说明见同目录 `PORTABILITY.md`。

## Overview

Compliance failures block sends, get numbers suspended, and expose your customer to legal liability. This skill covers the **ongoing rules** that apply to live traffic — what you can send, when, and to whom.

**Lifecycle:** Choose numbers (`twilio-numbers-senders`) → Register them (`twilio-compliance-onboarding`) → Follow traffic rules (this skill) → Secure everything (`twilio-security-hardening`)

For registrations required before traffic works (A2P 10DLC, toll-free verification, WhatsApp/RCS sender approval, voice trust programs), see `twilio-compliance-onboarding`.

---

## TCPA (Telephone Consumer Protection Act)

Applies to all US voice calls and SMS.

### Consent Requirements

| Communication type | Consent required | Notes |
|-------------------|-----------------|-------|
| Informational SMS (order updates) | Prior express consent | Providing phone number during transaction usually qualifies |
| Marketing SMS | Prior express written consent | Must be clear and conspicuous, separate from T&C |
| Manual voice calls | None for existing business relationship | 18-month window |
| Autodialed / prerecorded voice | Prior express consent (informational) or written (marketing) | AI voice agents typically count as autodialed and must disclose who is calling |
| Emergency / fraud alerts | No consent required | Must be genuinely urgent |

### Quiet Hours

- **8:00 AM – 9:00 PM** in the recipient's local time zone
- Applies to telemarketing and non-emergency calls
- Your application must determine the recipient's time zone — Twilio does not enforce this
- Use `twilio-lookup-phone-intelligence` to determine carrier/region for time zone inference

### Do Not Call

- Maintain an internal Do Not Call list
- Honor opt-outs within 10 business days (best practice: immediately)
- Scrub against the National Do Not Call Registry for telemarketing

---

## GDPR (EU/EEA)

### Consent for Communications

| Basis | When it applies | Requirements |
|-------|----------------|-------------|
| Explicit consent | Marketing messages, new customer outreach | Must be freely given, specific, informed, unambiguous. Pre-checked boxes do NOT qualify. |
| Legitimate interest | Transactional messages, existing customer relationship | Requires documented balancing test. Must offer opt-out. |
| Contractual necessity | Order confirmations, shipping updates | Directly related to contract performance |

### Right to Deletion

Applies to ALL data stored by your application via Twilio:
- Call recordings and transcripts
- SMS/messaging logs
- Conversation Memory observations and profiles
- Conversation Intelligence operator results
- Customer profiles in your database

**Implementation:** Build a deletion endpoint that removes data from all systems. Twilio retains message logs for 400 days — you can delete recordings via API but cannot delete message logs from Twilio's system before the retention window.

### Call Recording Consent

- EU calls require explicit consent before recording, or a documented legitimate interest basis
- Play a recording notice at the start of every call: `<Say>This call may be recorded for quality assurance.</Say>`
- Store consent records with timestamp

---

## PCI DSS (Payment Card Industry)

### Never Record Card Numbers

- If recording calls, **pause recording** during payment:

**Python**
```python
# Pause recording when customer gives card number
client.calls(call_sid).recordings(recording_sid).update(status="paused")

# Use <Pay> verb instead of collecting card numbers verbally
response = VoiceResponse()
response.pay(
    payment_connector="stripe_connector",
    charge_amount="49.99",
    currency="usd",
    status_callback="https://yourapp.com/pay-status"
)
```

- Never let an LLM process, log, or repeat card numbers
- Never store card numbers in Conversation Memory observations or Conversation Intelligence transcripts

### PCI Mode Warning

**PCI Mode is IRREVERSIBLE and account-wide.** Once enabled:
- All recordings are encrypted
- Transcript access is restricted
- Cannot be disabled — ever

**Recommendation:** If you need PCI compliance for one use case, create a separate sub-account. See `twilio-account-setup`.

---

## HIPAA (Healthcare)

### Requirements

- **BAA required:** Execute a Business Associate Agreement with Twilio before handling PHI
- **Recording encryption:** Mandatory for any call recording containing PHI
- **PHI minimization in TTS:** Don't speak full patient details via `<Say>`. Use minimum necessary information.
- **API key rotation:** Regular rotation required. See `twilio-iam-auth-setup`
- **Access controls:** Restrict who can access recordings and transcripts

### Safe Notification Content

| Channel | Safe | Unsafe |
|---------|------|--------|
| SMS | "Your appointment is tomorrow at 2pm" | "Your appointment with Dr. Smith for diabetes follow-up" |
| Voice IVR | "Press 1 to confirm your upcoming appointment" | "Press 1 to confirm your cardiology appointment" |
| Email | Can include more detail if encrypted/authenticated | Never send PHI in subject line |

---

## FDCPA / Regulation F (Debt Collection)

### Requirements

- **Mini-Miranda disclosure** required on every communication: "This is an attempt to collect a debt and any information obtained will be used for that purpose."
- **Call attempt limits:** Max 7 call attempts per debt per 7-day rolling window
- **Voicemail:** Must include disclosure or use limited-content message (name, phone number, request to call back — no mention of debt)
- **SMS consent:** Requires separate consent from voice consent
- **Time restrictions:** Same as TCPA quiet hours (8am-9pm local time)
- **Developer responsibility:** Twilio does NOT enforce FDCPA limits. Your application must track attempt counts and timing.

**Python**
```python
# Track call attempts per debt
def can_attempt_call(debt_id, db):
    seven_days_ago = datetime.now() - timedelta(days=7)
    attempts = db.count_attempts(debt_id, since=seven_days_ago)
    return attempts < 7

# Include Mini-Miranda in IVR
response = VoiceResponse()
response.say("This is an attempt to collect a debt and any information obtained will be used for that purpose.")
response.pause(length=1)
response.say("Please press 1 to speak with a representative.")
response.gather(num_digits=1, action="/handle-keypress")
```

---

## WhatsApp Compliance

### Template Requirements
- Outbound messages require pre-approved Message Templates (submitted to Meta, 24-48 hour approval)
- Free-form messages only within 24-hour service window after customer initiates
- Template rejections: vague descriptions, missing variables, promotional language in utility templates

### Quality Rating
- WhatsApp enforces quality scoring — too many blocks/reports = rate limited or suspended
- Monitor quality in WhatsApp Manager dashboard
- Opt-in required before sending any WhatsApp messages

### Opt-In Best Practices
- Collect WhatsApp-specific consent (separate from SMS consent)
- Clearly state what types of messages will be sent
- Provide easy opt-out (reply STOP)

---

## CAN-SPAM (Email)

- Physical mailing address required in every marketing email
- One-click unsubscribe required (SendGrid handles automatically via List-Unsubscribe header)
- Honor unsubscribe within 10 business days
- Subject line must not be misleading
- "From" address must be accurate

See `twilio-sendgrid-email-send` for SendGrid-specific compliance features.

---

## SHAKEN/STIR (Caller ID Verification)

### Attestation Levels

| Level | Meaning | Caller ID display |
|-------|---------|-------------------|
| **A (Full)** | Carrier vouches for caller identity and right to use number | Green checkmark ✅ |
| **B (Partial)** | Carrier vouches for caller but not number ownership | Neutral display |
| **C (Gateway)** | Carrier knows where call entered network, nothing else | May show "Spam Likely" |

- Only Level A produces a trusted caller ID display
- Affects answer rates significantly for outbound campaigns
- E.164 formatting required for proper attestation
- Twilio signs outbound calls automatically when you own the number

---

## Consent Management Pattern

### Store Consent Records

```python
# Minimum consent record
consent_record = {
    "phone": "+15558675310",
    "channel": "sms",                    # sms, voice, whatsapp, email
    "consent_type": "marketing",         # marketing, transactional, debt_collection
    "consent_method": "web_form",        # web_form, verbal, paper, api
    "consent_timestamp": "2026-04-13T14:30:00Z",
    "consent_source": "checkout_page",   # where consent was collected
    "ip_address": "203.0.113.42",        # for web consent
    "opted_out": False,
    "opt_out_timestamp": None
}
```

### Opt-Out Handling

- Process STOP/CANCEL/UNSUBSCRIBE/END/QUIT keywords immediately
- Messaging Services handle keyword opt-out automatically for SMS
- For voice: maintain your own Do Not Call list
- For WhatsApp: handle via webhook when user blocks
- For email: SendGrid manages suppression lists automatically

---

## CANNOT

- **Cannot rely on Twilio to enforce compliance rules** — Your application must implement TCPA, GDPR, PCI, and other rules. Twilio provides tools, not enforcement.
- **Cannot apply A2P 10DLC registration outside the US** — Other countries have their own regimes
- **Cannot use public link shorteners (bit.ly, tinyurl, goo.gl, short.io, etc.)** — Messages with public short links are categorically filtered by carriers. Use a branded/vanity short domain (e.g., `go.yourcompany.com`) configured in your Messaging Service. Twilio's shared `twil.io` domain is not sufficient — you must register your own branded domain in Console under Messaging > Link Shortening.
- **Cannot reverse PCI Mode** — Irreversible and account-wide once enabled
- **Cannot fully clear message logs via GDPR deletion** — Twilio retains internal message logs for 400 days regardless of deletion requests
- **Cannot assume regulations are static** — Compliance requirements change. Verify current regulations before launch.
- **Cannot apply this skill's guidance outside US/EU** — India TRAI DLT, Brazil LGPD, Australia Spam Act, and other jurisdictions require additional research

---

## Next Steps

- **Registration before traffic works:** `twilio-compliance-onboarding`
- **WhatsApp sender setup:** `twilio-whatsapp-manage-senders`
- **Credential security:** `twilio-iam-auth-setup`
- **Account structure for PCI isolation:** `twilio-account-setup`