# CON-QR-DEST — QR opt-in must resolve to a compliant surface

> A QR code used for opt-in must land on a page carrying the full consent disclosure, or the disclosure must be printed beside the code.

- **Rule ID:** CON-QR-DEST
- **Layer:** Consent flow (`CONSENT_FLOW`)
- **Checks:** `consent surface`
- **Severity:** BLOCKING — Breaking this rule gets the submission rejected outright.
- **When it bites:** Gates approval — get this wrong and registration is refused
- **How it is detected:** AI judgement over the submitted form
- **Fix type:** Produce a document that does not exist yet
- **Required by:** CTIA, TCR
- **Applies:** Applies when consent was collected by QR code.
- **Canonical URL:** https://ekas.io/rules/10dlc/consent-flow/con-qr-dest/

## Why this rule exists

A QR code carries no information a consumer can evaluate — it is an opaque instruction to trust wherever it goes. The disclosure therefore has to exist either next to the code or on the page it opens, and a QR that fires a pre-filled SMS bypasses both.

## How to fix it

Point the QR at a hosted opt-in page carrying the full disclosure and a real checkbox, and supply that URL or a capture of it. If the code appears on print where you also control the surrounding space, print the disclosure beside it as well.

## Common mistakes

- A QR that opens a pre-filled "text JOIN to 55512" message collects no disclosed consent at all — the consumer never saw terms.