# CON-040 — The consent basis must be an explicit opt-in, not an implied one

> The submission must rest on a consumer act that agreed to messaging — not on an existing relationship, a published number, or a prior transaction.

- **Rule ID:** CON-040
- **Layer:** Consent flow (`CONSENT_FLOW`)
- **Checks:** `campaign.message_flow + consent artifact`
- **Severity:** BLOCKING — Breaking this rule gets the submission rejected outright.
- **When it bites:** Gates approval — get this wrong and registration is refused
- **How it is detected:** AI judgement over the submitted form
- **Fix type:** Supply evidence only you hold
- **Required by:** AWS, Bandwidth, FCC
- **Applies:** Applies to every 10DLC registration.
- **Canonical URL:** https://ekas.io/rules/10dlc/consent-flow/con-040/

## Why this rule exists

Implied consent is the theory behind most of the numbers that generate complaints: the consumer gave a number to book a table or buy a part, and reads the marketing text that follows as a stranger having got hold of it. Carriers therefore treat "they are our customers" as no consent at all, and a submission that argues the relationship rather than describing an act is rejected on the argument itself.

## How to fix it

Describe the moment the consumer agreed — what they ticked, said, signed or texted, and where — and attach the evidence of it. Where no such moment exists, collect fresh consent before registering: an existing customer list cannot be argued into an opt-in. Done when the flow names an act rather than a relationship.

## Example of a compliant value

```text
Customers tick an unchecked box reading "Text me Acme Coffee offers" at https://acmecoffee.com/checkout before the order is placed; the ticked state, timestamp and disclosure version are stored against the order.
```

## Common mistakes

- "Customers provide their number when booking" describes collection, not consent — the number arriving is not the same event as agreeing to be texted.

## Notes

The catalog classes this VISION on the toll-free path (Bandwidth TFV 1402). Authored as AI_FORM because the implied-consent claim is made in the message flow rather than visible in the artifact, and the artifact half is already judged by CON-ART-002. Bandwidth applies it specifically to toll-free verification; it is left universal because the underlying FCC standard is.