The consent basis must be an explicit opt-in, not an implied one

The requirementstatement

The submission must rest on a consumer act that agreed to messaging — not on an existing relationship, a published number, or a prior transaction.

Severityseverity: BlockingBLOCKINGBreaking this rule gets the submission rejected. There is no partial credit.
When it bitesphase: Gates approvalapprovalGet this wrong and the brand or campaign is refused at registration.
What is checkedobject: campaign.message_flow + consent artifact
Where it liveslayer: Consent flowCONSENT_FLOW
How Ekas settles itdetectability: AI · formAI_FORM; A semantic question about what you wrote: whether a description matches a use case, whether a name looks like a filed entity. Judged by a model against written criteria.
What the fix involvesfailureClass: Supply evidenceTERMINAL_EVIDENCE; Needs proof only you hold: a screenshot, a recording, a scan of the form people signed.
Who requires itauthorities: AWSBandwidthFCC
When it appliesapplicabilityText: Applies to every 10DLC registration.

Why this rule existsrationale

Implied consent is the theory behind most of the numbers that generate complaints: the consumer gave a number to book a table or buy a part, and reads the marketing text that follows as a stranger having got hold of it. Carriers therefore treat "they are our customers" as no consent at all, and a submission that argues the relationship rather than describing an act is rejected on the argument itself.

How to fix itremediation

Describe the moment the consumer agreed — what they ticked, said, signed or texted, and where — and attach the evidence of it. Where no such moment exists, collect fresh consent before registering: an existing customer list cannot be argued into an opt-in. Done when the flow names an act rather than a relationship.

A compliant exampleexample

Customers tick an unchecked box reading "Text me Acme Coffee offers" at https://acmecoffee.com/checkout before the order is placed; the ticked state, timestamp and disclosure version are stored against the order.

Common mistakespitfalls

"Customers provide their number when booking" describes collection, not consent — the number arriving is not the same event as agreeing to be texted.

Notesnotes

The catalog classes this VISION on the toll-free path (Bandwidth TFV 1402). Authored as AI_FORM because the implied-consent claim is made in the message flow rather than visible in the artifact, and the artifact half is already judged by CON-ART-002. Bandwidth applies it specifically to toll-free verification; it is left universal because the underlying FCC standard is.

Rules you will hit next

5 other rules read campaign.message_flow + consent artifact. Fixing one field to satisfy a single rule is how a resubmission trades one rejection for another, so read these before you change anything.

CMP-065A hosted artifact is required when the opt-in is not publicly crawlableBlockingBLOCKING CON-ART-001An artifact proving consent collection must be attachedBlockingBLOCKING CON-KEYWORD-CTAKeyword opt-in requires the advertised call to actionBlockingBLOCKING CON-VERBAL-SCRIPTVerbal opt-in requires the documented scriptBlockingBLOCKING CON-FLOW-METHOD-MATCHThe described opt-in method must match the evidence suppliedHighHIGH CON-008The live CTA and the declared message flow must say the same thingBlockingBLOCKING

All consent flow rules

CON-040 is one of 101 consent flow rules in the 915-rule 10DLC registry. Free to cite under CC BY 4.0.