# CON-008 — The live CTA and the declared message flow must say the same thing

> The consent wording quoted in the message flow must be the wording actually printed on the live opt-in surface.

- **Rule ID:** CON-008
- **Layer:** Consent flow (`CONSENT_FLOW`)
- **Checks:** `campaign.message_flow vs live opt-in page`
- **Severity:** BLOCKING — Breaking this rule gets the submission rejected outright.
- **When it bites:** Gates approval — get this wrong and registration is refused
- **How it is detected:** AI judgement over the crawled website or policy page
- **Fix type:** Fix the field — a better value in the form clears it
- **Required by:** Bandwidth, Twilio, TCR
- **Applies:** Applies when consent was collected by web form, checkout, account settings, third party, chat, social and email.
- **Canonical URL:** https://ekas.io/rules/10dlc/consent-flow/con-008/

## Why this rule exists

The flow is the brand's account of the consent and the page is the consent itself, so where they differ the page wins and the registration describes something that does not happen. It is rarely dishonest: the flow was written from the disclosure the team intended to ship, and the page was changed afterwards by someone who never saw the campaign record.

## How to fix it

Copy the consent sentence off the live page into the message flow verbatim, rather than paraphrasing it. Where the page is the thing that is wrong, fix the page first and then quote it. Done when the quoted sentence and the printed one match word for word.

## Example of a compliant value

```text
Customers opt in at https://acmecoffee.com/checkout by ticking an unchecked box reading: "Text me Acme Coffee offers and rewards updates." — quoted exactly as printed.
```

## Common mistakes

- Tidying the punctuation or capitalisation while copying is enough to read as a different disclosure to a reviewer comparing them side by side.

## Notes

The catalog classes this DETERMINISTIC, and it would be, given a crawl that says WHICH page each block of text came from. The registry carries one undifferentiated websiteText, so a string comparison cannot tell "the CTA was reworded" from "we fetched the homepage and the CTA is at /checkout" — and failing a compliant registration for the second is the worse error. Authored as judged until the crawler carries a per-page map; both audits the catalog asks for (CON-009) fall out of the same comparison.