# OPS-207 — The consent record must name the page the opt-in came from

> Every consent record must carry the source URL of the consent surface.

- **Rule ID:** OPS-207
- **Layer:** Operational (`OPERATIONAL`)
- **Checks:** `campaign.message_flow + privacy policy`
- **Severity:** HIGH — Rejected by at least one carrier or provider, and a common cause of failure at the rest.
- **When it bites:** Gates approval — get this wrong and registration is refused
- **How it is detected:** AI judgement over the submitted form
- **Fix type:** Fix the field — a better value in the form clears it
- **Required by:** CTIA, Telnyx
- **Applies:** Applies when consent was collected by web form, checkout, account settings, third party, chat, social, email and QR code.
- **Canonical URL:** https://ekas.io/rules/10dlc/operational/ops-207/

## Why this rule exists

A brand usually has several places a consumer can opt in — a footer form, a checkout box, a landing page for one campaign — and they carry different disclosure wording. Storing only "web" makes every one of those records identical, so when a reviewer asks which page a specific consumer used, nobody can answer. The innocent cause is that the form posts to one endpoint, and the endpoint records itself rather than the page that called it.

## How to fix it

Store the full URL of the page the opt-in was submitted from — path and query included — on each consent record, and describe that in the message flow. Done when you can take any consent record and open the exact page that produced it.

## Example of a compliant value

```text
Each opt-in stores source_url: https://acmecoffee.com/signup?src=instore-qr, alongside the timestamp and IP.
```

## Common mistakes

- Storing the form-handler endpoint rather than the referring page produces one URL for every record, which is the same failure with a longer string in it.

## Notes

Registration-side twin: we judge whether the programme describes storing the field, never whether the stored record exists.