Evidence URLs must resolve without a login
The requirementstatement
A submitted evidence URL must resolve, be publicly reachable, and not require authentication.
- Severityseverity
- BlockingBLOCKINGBreaking this rule gets the submission rejected. There is no partial credit.
- When it bitesphase
- Gates approvalapprovalGet this wrong and the brand or campaign is refused at registration.
- What is checkedobject
- consent artifact URL
- Where it liveslayer
- Consent flowCONSENT_FLOW
- How Ekas settles itdetectability
- AI · formAI_FORM
- A semantic question about what you wrote: whether a description matches a use case, whether a name looks like a filed entity. Judged by a model against written criteria.
- What the fix involvesfailureClass
- Supply evidenceTERMINAL_EVIDENCE
- Needs proof only you hold: a screenshot, a recording, a scan of the form people signed.
- Who requires itauthorities
- TCRTwilioBandwidthAWS
- When it appliesapplicabilityText
- Applies to every 10DLC registration.
Why this rule existsrationale
The most common evidence failure in practice is a cloud-storage link that shows a "request access" wall to anyone outside the organisation. The submitter tested it while logged in and saw their own file, so the failure is invisible from their side.
How to fix itremediation
Set the link to "anyone with the link can view", or host the file somewhere public, then open it in a private browsing window to confirm.
Common mistakespitfalls
- Google Drive and Dropbox default to organisation-only access, which looks fine to you and shows a wall to everyone else.
- A viewer page is not the file — link the direct image or PDF.
Rules you will hit next
Other consent flow rules at the same severity. A registration is judged as a whole, not rule by rule.
CON-008The live CTA and the declared message flow must say the same thingBlockingBLOCKINGCON-010The three subscriber-management attributes must be declared trueBlockingBLOCKINGCON-013Subscriber attributes must agree with the message bodies suppliedBlockingBLOCKINGCON-024The opt-in URL must serve a certificate that verifiesBlockingBLOCKINGCON-027The opt-in URL must land on a page that carries the opt-inBlockingBLOCKINGCON-034The business name on the artifact must match the registered brandBlockingBLOCKING
CON-023 is one of 101 consent flow rules in the 915-rule 10DLC registry. Free to cite under CC BY 4.0.