# CMP-065 — A hosted artifact is required when the opt-in is not publicly crawlable

> Where the opt-in surface is login-gated, unpublished, on paper, verbal, or in-store, a publicly hosted screenshot URL is required in the message flow.

- **Rule ID:** CMP-065
- **Layer:** Campaign (`CAMPAIGN`)
- **Checks:** `campaign.message_flow + consent artifact`
- **Severity:** BLOCKING — Breaking this rule gets the submission rejected outright.
- **When it bites:** Gates approval — get this wrong and registration is refused
- **How it is detected:** Deterministic (settled in code from the submitted values)
- **Fix type:** Supply evidence only you hold
- **Required by:** TCR, Twilio, Bandwidth, AWS
- **Applies:** Applies when consent was collected by live verbal, IVR, paper form, point of sale, employer / HR and account settings.
- **Canonical URL:** https://ekas.io/rules/10dlc/campaign/cmp-065/

## Why this rule exists

A reviewer cannot crawl what is not on the public web, so the artifact becomes the only evidence that exists. This is the rule that makes offline collection registrable at all — without it those campaigns simply fail the website-consent checks for reasons that do not apply to them.

## How to fix it

Host the evidence at a public URL that opens without a login and cite it in the message flow. Confirm it opens in a private browsing window before submitting.

## Example of a compliant value

```text
Consent screenshot: https://cdn.acmecoffee.com/compliance/counter-form.pdf
```