# CON-RECORD-FIELDS — Consent records must capture the required fields

> The flow should evidence retention of the consent record: number, timestamp, medium, the exact wording agreed to, and the consenting party.

- **Rule ID:** CON-RECORD-FIELDS
- **Layer:** Consent flow (`CONSENT_FLOW`)
- **Checks:** `campaign.message_flow`
- **Severity:** MEDIUM — Usually survives review, but lowers your trust score or invites manual review.
- **When it bites:** Gates approval — get this wrong and registration is refused
- **How it is detected:** AI judgement over the submitted form
- **Fix type:** Fix the field — a better value in the form clears it
- **Required by:** CTIA
- **Applies:** Applies to every 10DLC registration.
- **Canonical URL:** https://ekas.io/rules/10dlc/consent-flow/con-record-fields/

## Why this rule exists

CTIA enumerates the fields a consent record must hold, including a capture of the language and action used to secure it. Recording only "opted in: true" leaves you unable to show WHAT was agreed to, which is the question every complaint turns on.

## How to fix it

State in the flow that you retain the consent record, and store the disclosure version alongside the timestamp so you can reproduce what the consumer actually saw.

## Example of a compliant value

```text
For each opt-in we store the phone number, timestamp, collection medium, the disclosure version shown, and the session or agent identity.
```

## Notes

Registration-side twin of a runtime obligation — we verify the flow claims retention, not that retention happens.