{
  "id": "CON-041",
  "slug": "con-041",
  "title": "The opt-in form must have a phone-number field",
  "statement": "The opt-in form must collect a mobile number through a field of its own.",
  "rationale": "A form with no number field cannot be where SMS consent is collected, whatever its consent text says — so the registration points at a surface that does not do what it claims. The usual cause is honest: the brand registered their newsletter page, where the only field is an email address, because that is where the SMS checkbox was added.",
  "layer": "CONSENT_FLOW",
  "layerSlug": "consent-flow",
  "object": "opt-in form phone input",
  "severity": "BLOCKING",
  "detectability": [
    "CRAWL"
  ],
  "failureClass": "TERMINAL_WEBSITE",
  "authorities": [
    "AWS",
    "Bandwidth",
    "Ringover"
  ],
  "codes": [
    {
      "provider": "Bandwidth/DCA",
      "code": "2139",
      "remediable": true
    }
  ],
  "applicability": {
    "consentMethods": [
      "web_form",
      "checkout",
      "account_settings",
      "qr",
      "third_party"
    ]
  },
  "applicabilityText": "Applies when consent was collected by web form, checkout, account settings, QR code and third party.",
  "universal": false,
  "remediation": "Add a mobile-number input to the form the consent control sits on, and label it as a mobile number rather than a generic \"phone\". Done when a consumer can give you a number and their agreement in the same submission.",
  "pitfalls": [
    "Collecting the number on a later step than the consent control splits the two, and a reviewer looking at the registered page sees consent with nothing to attach it to."
  ],
  "phase": "approval",
  "automated": true,
  "url": "https://ekas.io/rules/10dlc/consent-flow/con-041/",
  "markdown": "https://ekas.io/rules/10dlc/consent-flow/con-041.md",
  "registry": "https://ekas.io/rules/10dlc/",
  "updated": "2026-07-25",
  "licence": "CC BY 4.0 — https://creativecommons.org/licenses/by/4.0/"
}