{
  "id": "CON-008",
  "slug": "con-008",
  "title": "The live CTA and the declared message flow must say the same thing",
  "statement": "The consent wording quoted in the message flow must be the wording actually printed on the live opt-in surface.",
  "rationale": "The flow is the brand's account of the consent and the page is the consent itself, so where they differ the page wins and the registration describes something that does not happen. It is rarely dishonest: the flow was written from the disclosure the team intended to ship, and the page was changed afterwards by someone who never saw the campaign record.",
  "layer": "CONSENT_FLOW",
  "layerSlug": "consent-flow",
  "object": "campaign.message_flow vs live opt-in page",
  "severity": "BLOCKING",
  "detectability": [
    "CRAWL"
  ],
  "failureClass": "RETRY_FIELD",
  "authorities": [
    "Bandwidth",
    "Twilio",
    "TCR"
  ],
  "applicability": {
    "consentMethods": [
      "web_form",
      "checkout",
      "account_settings",
      "third_party",
      "chat",
      "social",
      "email"
    ]
  },
  "applicabilityText": "Applies when consent was collected by web form, checkout, account settings, third party, chat, social and email.",
  "universal": false,
  "remediation": "Copy the consent sentence off the live page into the message flow verbatim, rather than paraphrasing it. Where the page is the thing that is wrong, fix the page first and then quote it. Done when the quoted sentence and the printed one match word for word.",
  "example": "Customers opt in at https://acmecoffee.com/checkout by ticking an unchecked box reading: \"Text me Acme Coffee offers and rewards updates.\" — quoted exactly as printed.",
  "pitfalls": [
    "Tidying the punctuation or capitalisation while copying is enough to read as a different disclosure to a reviewer comparing them side by side."
  ],
  "notes": "The catalog classes this DETERMINISTIC, and it would be, given a crawl that says WHICH page each block of text came from. The registry carries one undifferentiated websiteText, so a string comparison cannot tell \"the CTA was reworded\" from \"we fetched the homepage and the CTA is at /checkout\" — and failing a compliant registration for the second is the worse error. Authored as judged until the crawler carries a per-page map; both audits the catalog asks for (CON-009) fall out of the same comparison.",
  "catalogIds": [
    "CON-009"
  ],
  "phase": "approval",
  "automated": true,
  "url": "https://ekas.io/rules/10dlc/consent-flow/con-008/",
  "markdown": "https://ekas.io/rules/10dlc/consent-flow/con-008.md",
  "registry": "https://ekas.io/rules/10dlc/",
  "updated": "2026-07-25",
  "licence": "CC BY 4.0 — https://creativecommons.org/licenses/by/4.0/"
}