# CMP-127 — A consent surface a reviewer cannot reach must be declared as such

> Where the opt-in sits behind a login, is unpublished, is spoken, or is on paper, the submission must say so explicitly.

- **Rule ID:** CMP-127
- **Layer:** Campaign (`CAMPAIGN`)
- **Checks:** `campaign.message_flow`
- **Severity:** HIGH — Rejected by at least one carrier or provider, and a common cause of failure at the rest.
- **When it bites:** Gates approval — get this wrong and registration is refused
- **How it is detected:** AI judgement over the submitted form
- **Fix type:** Fix the field — a better value in the form clears it
- **Required by:** AWS, Twilio
- **Applies:** Applies to every 10DLC registration.
- **Canonical URL:** https://ekas.io/rules/10dlc/campaign/cmp-127/

## Why this rule exists

A reviewer who cannot find the opt-in assumes it does not exist, because that is far more often true than the alternative. Saying "this opt-in is inside the customer account portal, screenshot attached" converts a dead end into a documented one — the same registration, differing only in whether the reviewer had to guess.

## How to fix it

Add one sentence naming why the surface is not reachable and what stands in for it. Done when the flow text answers the question a reviewer would otherwise have to ask.

## Example of a compliant value

```text
The opt-in toggle sits inside the authenticated account portal and cannot be crawled, so a screenshot taken from a live account is attached: https://cdn.acmecoffee.com/compliance/portal-optin.png
```

## Provider rejection codes

| Provider | Code | Resubmission allowed |
| --- | --- | --- |
| Twilio | `30909` | yes |