Keep security and account messages on

How to do it

These are the messages an attacker hopes the owner never sees. They cover a new sign-in, a password or email change, and a new second factor or passkey. They also cover a new API key and a changed payout account. Let people pick which channel they arrive on, but never offer a switch that turns them off everywhere. Show them on the settings page as "always on", with the reason. Keep them free of marketing, so no unsubscribe rule applies, as Have consent before any marketing message says. Which events count is set in Tell people about every change to their sign-in.

Examples

JavaScript example

export function channelsForMandatory(type, chosen) {
  if (!type.mandatory) return chosen;
  return chosen.length ? chosen : [type.fallbackChannel ?? 'email'];
}

Python example

def channels_for_mandatory(kind, chosen: list[str]) -> list[str]:
    if not kind.mandatory:
        return chosen
    return chosen or [kind.fallback_channel or "email"]

How to check

A test turns off every preference for a user, then changes the account email. The old address still gets the notice. A catalogue test fails if a type marked mandatory has no channel the person cannot switch off.

Related rules

• NTF-3 Let people choose per type and channel in Notifications
• NTF-2 Have consent before any marketing message in Notifications
• ACC-22 Tell people about every change to their sign-in in Accounts and identity