Consent records must capture all seven required fields

JSONMarkdown

The requirementstatement

The programme must retain a consent record holding the number, timestamp, medium, a capture of the consent experience, the campaign, an IP or call identifier, and the consenting party.

Severityseverity
HighHIGHRejected by at least one carrier or provider, and a common cause of failure at the rest.
When it bitesphase
Gates approvalapprovalGet this wrong and the brand or campaign is refused at registration.
What is checkedobject
campaign.message_flow + privacy policy
Where it liveslayer
OperationalOPERATIONAL
How Ekas settles itdetectability
AI · formAI_FORM
A semantic question about what you wrote: whether a description matches a use case, whether a name looks like a filed entity. Judged by a model against written criteria.
What the fix involvesfailureClass
Fix the fieldRETRY_FIELD
A better value in the form fixes it. Ekas can rewrite it and re-check.
Who requires itauthorities
CTIAFCCTCR
When it appliesapplicabilityText
Applies to every 10DLC registration.

Why this rule existsrationale

CTIA enumerates these seven fields specifically, and the reason is evidentiary: when a complaint arrives eighteen months later, "opted in: true" proves nothing about what the consumer actually agreed to. The capture-of-experience field is the one almost everybody omits, and it is the one that matters most — it is the only record of the wording shown at the moment of consent.

How to fix itremediation

Store all seven fields per opt-in, and version the disclosure text so you can reproduce exactly what a given consumer saw. Describe this in the message flow — a reviewer treats an undescribed record-keeping practice as an absent one.

A compliant exampleexample

For each opt-in we store: phone number, UTC timestamp, acquisition medium, the versioned disclosure text shown, the campaign, the originating IP (or call ID for phone consent), and the account or session identity that consented.

Common mistakespitfalls

  • Storing a boolean flag with a date is the most common shortfall — it cannot answer "what did they agree to?".

Rules you will hit next

6 other rules read campaign.message_flow + privacy policy. Fixing one field to satisfy a single rule is how a resubmission trades one rejection for another, so read these before you change anything.

OPS-056Opt-out records must keep the words the consumer actually sentBlockingBLOCKINGOPS-085The programme must scrub deactivated numbers before sendingBlockingBLOCKINGOPS-210Telemarketing consent must retain the request, its purpose and the answerBlockingBLOCKINGOPS-236An IVR opt-in must log the prompt, the keypress, the time and the callBlockingBLOCKINGOPS-261Only the charity may use the numbers a charity collectsBlockingBLOCKINGOPS-207The consent record must name the page the opt-in came fromHighHIGH

All operational rules

OPS-199 is one of 139 operational rules in the 915-rule 10DLC registry. Free to cite under CC BY 4.0.

Reading the rules is the easy part.

Ekas runs every rule that gates approval, 823 of these 915, against your registration before it reaches the carrier. It reads your site, your policy pages and your opt-in the way a reviewer would, and hands you the fix, not just the verdict.

Talk to UsHow 10DLC works