# CON-045 — The opt-in page must be reachable without logging in

> The registered opt-in page must load for an anonymous visitor, not sit behind a login, paywall, or member area.

- **Rule ID:** CON-045
- **Layer:** Consent flow (`CONSENT_FLOW`)
- **Checks:** `opt-in page auth state`
- **Severity:** BLOCKING — Breaking this rule gets the submission rejected outright.
- **When it bites:** Gates approval — get this wrong and registration is refused
- **How it is detected:** AI judgement over the crawled website or policy page
- **Fix type:** Fix the website — no form edit clears it
- **Required by:** Telnyx, Twilio
- **Applies:** Applies when consent was collected by web form, checkout, account settings, third party, chat, social and email.
- **Canonical URL:** https://ekas.io/rules/10dlc/consent-flow/con-045/

## Why this rule exists

Reviewers verify anonymously, so a page that renders perfectly for you and shows a sign-in wall to them is, from their side, no evidence at all. It is a silent failure: the submitter tests the link while logged in, sees their own form, and cannot reproduce the rejection.

## How to fix it

Either move the opt-in to a public page, or keep it gated and supply a hosted screenshot instead, saying in the message flow that the surface is login-gated and the screenshot is attached. Done when you can open the URL in a private browsing window and see the form.

## Common mistakes

- A preference centre inside a customer account is legitimately gated — that case is served by attaching the screenshot, not by making the account public.

## Provider rejection codes

| Provider | Code | Resubmission allowed |
| --- | --- | --- |
| Telnyx | `804` | yes |
| Twilio (gen2) | `30922` | yes |

## Notes

Where the surface genuinely is gated, CMP-065 (hosted evidence) and CMP-127 (declare it) are the rules that carry the registration, and this one is discharged by that route rather than failed.