# CON-041 — The opt-in form must have a phone-number field

> The opt-in form must collect a mobile number through a field of its own.

- **Rule ID:** CON-041
- **Layer:** Consent flow (`CONSENT_FLOW`)
- **Checks:** `opt-in form phone input`
- **Severity:** BLOCKING — Breaking this rule gets the submission rejected outright.
- **When it bites:** Gates approval — get this wrong and registration is refused
- **How it is detected:** AI judgement over the crawled website or policy page
- **Fix type:** Fix the website — no form edit clears it
- **Required by:** AWS, Bandwidth, Ringover
- **Applies:** Applies when consent was collected by web form, checkout, account settings, QR code and third party.
- **Canonical URL:** https://ekas.io/rules/10dlc/consent-flow/con-041/

## Why this rule exists

A form with no number field cannot be where SMS consent is collected, whatever its consent text says — so the registration points at a surface that does not do what it claims. The usual cause is honest: the brand registered their newsletter page, where the only field is an email address, because that is where the SMS checkbox was added.

## How to fix it

Add a mobile-number input to the form the consent control sits on, and label it as a mobile number rather than a generic "phone". Done when a consumer can give you a number and their agreement in the same submission.

## Common mistakes

- Collecting the number on a later step than the consent control splits the two, and a reviewer looking at the registered page sees consent with nothing to attach it to.

## Provider rejection codes

| Provider | Code | Resubmission allowed |
| --- | --- | --- |
| Bandwidth/DCA | `2139` | yes |