{
  "id": "CON-042",
  "slug": "con-042",
  "title": "The phone field must be optional on a general-purpose form",
  "statement": "On a form that exists for something other than SMS signup, the phone-number field must not be required to submit.",
  "rationale": "A required number on a contact or quote form takes the number as the price of the enquiry, and everything downstream treats that as a collected lead rather than an opt-in. Bandwidth states it flatly — phone numbers cannot be a required field on the website where opt-in is collected — because a number given under compulsion cannot be told apart later from one given willingly.",
  "layer": "CONSENT_FLOW",
  "layerSlug": "consent-flow",
  "object": "opt-in form phone field required attribute",
  "severity": "HIGH",
  "detectability": [
    "CRAWL"
  ],
  "failureClass": "TERMINAL_WEBSITE",
  "authorities": [
    "Bandwidth",
    "Telnyx",
    "Twilio"
  ],
  "codes": [
    {
      "provider": "Twilio",
      "code": "30931",
      "remediable": true,
      "generation": "gen2"
    },
    {
      "provider": "Twilio",
      "code": "30923",
      "remediable": true,
      "generation": "gen2"
    }
  ],
  "applicability": {
    "consentMethods": [
      "web_form",
      "account_settings",
      "third_party"
    ]
  },
  "applicabilityText": "Applies when consent was collected by web form, account settings and third party.",
  "universal": false,
  "remediation": "Drop the required attribute and the asterisk from the phone input on any form whose purpose is not SMS signup, and confirm the form submits without it. Done when a visitor can send you an enquiry giving only an email address.",
  "pitfalls": [
    "A form whose entire purpose IS SMS signup may require the number — the field is the point of the form, and this rule does not apply to it."
  ],
  "notes": "DIVERGENCE, canonical form taken: Bandwidth forbids a required phone field outright; Telnyx and the website-evidence research allow one provided the SMS consent control is itself optional. The strict-superset rule takes Bandwidth, so this fires wherever the form has another purpose. Where the phone field genuinely must stay required for that purpose, CON-043 and CON-044 are the rules that make it survivable.",
  "phase": "approval",
  "automated": true,
  "url": "https://ekas.io/rules/10dlc/consent-flow/con-042/",
  "markdown": "https://ekas.io/rules/10dlc/consent-flow/con-042.md",
  "registry": "https://ekas.io/rules/10dlc/",
  "updated": "2026-07-25",
  "licence": "CC BY 4.0 — https://creativecommons.org/licenses/by/4.0/"
}