{
  "id": "CON-027",
  "slug": "con-027",
  "title": "The opt-in URL must land on a page that carries the opt-in",
  "statement": "The page at the submitted opt-in URL must contain the opt-in form itself, not merely mention or link to it.",
  "rationale": "A reviewer opens the URL and expects to see the thing being registered. Landing on a homepage, a marketing page, or a page whose signup lives one click further in reads as evidence that could not be produced, and it is rejected without anyone hunting for the real page. Brands submit the wrong URL constantly because the opt-in is a modal or a footer widget and the page they think of as \"the signup page\" is the one that advertises it.",
  "layer": "CONSENT_FLOW",
  "layerSlug": "consent-flow",
  "object": "opt-in page DOM",
  "severity": "BLOCKING",
  "detectability": [
    "CRAWL"
  ],
  "failureClass": "RETRY_FIELD",
  "authorities": [
    "AWS",
    "Bandwidth"
  ],
  "codes": [
    {
      "provider": "Bandwidth/DCA",
      "code": "2125",
      "remediable": true
    }
  ],
  "applicability": {
    "consentMethods": [
      "web_form",
      "checkout",
      "account_settings",
      "qr",
      "third_party"
    ]
  },
  "applicabilityText": "Applies when consent was collected by web form, checkout, account settings, QR code and third party.",
  "universal": false,
  "remediation": "Submit the URL of the page the form is actually on, opening the modal first if that is where it lives and using the deep link if one exists. Done when loading that URL in a fresh browser shows the phone field and the consent control without any further clicks.",
  "example": "opt_in_url: https://acmecoffee.com/checkout — not https://acmecoffee.com",
  "pitfalls": [
    "A form that only appears after a delay, a scroll, or an exit-intent trigger is not on the page as far as a crawler is concerned — host a permanent version and register that."
  ],
  "phase": "approval",
  "automated": true,
  "url": "https://ekas.io/rules/10dlc/consent-flow/con-027/",
  "markdown": "https://ekas.io/rules/10dlc/consent-flow/con-027.md",
  "registry": "https://ekas.io/rules/10dlc/",
  "updated": "2026-07-25",
  "licence": "CC BY 4.0 — https://creativecommons.org/licenses/by/4.0/"
}