The consent record must name the page the opt-in came from
The requirementstatement
Every consent record must carry the source URL of the consent surface.
- Severityseverity
- HighHIGHRejected by at least one carrier or provider, and a common cause of failure at the rest.
- When it bitesphase
- Gates approvalapprovalGet this wrong and the brand or campaign is refused at registration.
- What is checkedobject
- campaign.message_flow + privacy policy
- Where it liveslayer
- OperationalOPERATIONAL
- How Ekas settles itdetectability
- AI · formAI_FORM
- A semantic question about what you wrote: whether a description matches a use case, whether a name looks like a filed entity. Judged by a model against written criteria.
- What the fix involvesfailureClass
- Fix the fieldRETRY_FIELD
- A better value in the form fixes it. Ekas can rewrite it and re-check.
- Who requires itauthorities
- CTIATelnyx
- When it appliesapplicabilityText
- Applies when consent was collected by web form, checkout, account settings, third party, chat, social, email and QR code.
Why this rule existsrationale
A brand usually has several places a consumer can opt in — a footer form, a checkout box, a landing page for one campaign — and they carry different disclosure wording. Storing only "web" makes every one of those records identical, so when a reviewer asks which page a specific consumer used, nobody can answer. The innocent cause is that the form posts to one endpoint, and the endpoint records itself rather than the page that called it.
How to fix itremediation
Store the full URL of the page the opt-in was submitted from — path and query included — on each consent record, and describe that in the message flow. Done when you can take any consent record and open the exact page that produced it.
A compliant exampleexample
Each opt-in stores source_url: https://acmecoffee.com/signup?src=instore-qr, alongside the timestamp and IP.
Common mistakespitfalls
- Storing the form-handler endpoint rather than the referring page produces one URL for every record, which is the same failure with a longer string in it.
Notesnotes
Registration-side twin: we judge whether the programme describes storing the field, never whether the stored record exists.
Rules you will hit next
6 other rules read campaign.message_flow + privacy policy. Fixing one field to satisfy a single rule is how a resubmission trades one rejection for another, so read these before you change anything.
OPS-056Opt-out records must keep the words the consumer actually sentBlockingBLOCKINGOPS-085The programme must scrub deactivated numbers before sendingBlockingBLOCKINGOPS-210Telemarketing consent must retain the request, its purpose and the answerBlockingBLOCKINGOPS-236An IVR opt-in must log the prompt, the keypress, the time and the callBlockingBLOCKINGOPS-261Only the charity may use the numbers a charity collectsBlockingBLOCKINGOPS-199Consent records must capture all seven required fieldsHighHIGH
OPS-207 is one of 139 operational rules in the 915-rule 10DLC registry. Free to cite under CC BY 4.0.