{
  "id": "CON-045",
  "slug": "con-045",
  "title": "The opt-in page must be reachable without logging in",
  "statement": "The registered opt-in page must load for an anonymous visitor, not sit behind a login, paywall, or member area.",
  "rationale": "Reviewers verify anonymously, so a page that renders perfectly for you and shows a sign-in wall to them is, from their side, no evidence at all. It is a silent failure: the submitter tests the link while logged in, sees their own form, and cannot reproduce the rejection.",
  "layer": "CONSENT_FLOW",
  "layerSlug": "consent-flow",
  "object": "opt-in page auth state",
  "severity": "BLOCKING",
  "detectability": [
    "CRAWL"
  ],
  "failureClass": "TERMINAL_WEBSITE",
  "authorities": [
    "Telnyx",
    "Twilio"
  ],
  "codes": [
    {
      "provider": "Telnyx",
      "code": "804",
      "remediable": true
    },
    {
      "provider": "Twilio",
      "code": "30922",
      "remediable": true,
      "generation": "gen2"
    }
  ],
  "applicability": {
    "consentMethods": [
      "web_form",
      "checkout",
      "account_settings",
      "third_party",
      "chat",
      "social",
      "email"
    ]
  },
  "applicabilityText": "Applies when consent was collected by web form, checkout, account settings, third party, chat, social and email.",
  "universal": false,
  "remediation": "Either move the opt-in to a public page, or keep it gated and supply a hosted screenshot instead, saying in the message flow that the surface is login-gated and the screenshot is attached. Done when you can open the URL in a private browsing window and see the form.",
  "pitfalls": [
    "A preference centre inside a customer account is legitimately gated — that case is served by attaching the screenshot, not by making the account public."
  ],
  "notes": "Where the surface genuinely is gated, CMP-065 (hosted evidence) and CMP-127 (declare it) are the rules that carry the registration, and this one is discharged by that route rather than failed.",
  "phase": "approval",
  "automated": true,
  "url": "https://ekas.io/rules/10dlc/consent-flow/con-045/",
  "markdown": "https://ekas.io/rules/10dlc/consent-flow/con-045.md",
  "registry": "https://ekas.io/rules/10dlc/",
  "updated": "2026-07-25",
  "licence": "CC BY 4.0 — https://creativecommons.org/licenses/by/4.0/"
}