# OPS-209 — The consent record must say which act gave consent

> Every consent record must carry the confirmation method used — a ticked box, a click, or a replied keyword.

- **Rule ID:** OPS-209
- **Layer:** Operational (`OPERATIONAL`)
- **Checks:** `campaign.message_flow + privacy policy`
- **Severity:** MEDIUM — Usually survives review, but lowers your trust score or invites manual review.
- **When it bites:** Gates approval — get this wrong and registration is refused
- **How it is detected:** AI judgement over the submitted form
- **Fix type:** Fix the field — a better value in the form clears it
- **Required by:** CTIA, mytcrplus
- **Applies:** Applies to every 10DLC registration.
- **Canonical URL:** https://ekas.io/rules/10dlc/operational/ops-209/

## Why this rule exists

Two records can agree on number, timestamp and campaign and still describe completely different events: one consumer ticked an unchecked box, another replied YES to a text, a third was added by an agent. Those are not equally strong evidence, and a record that does not say which act happened cannot be graded — which is exactly the moment, months later, when it needs to be.

## How to fix it

Store the specific act on each record — checkbox, button click, SMS reply, keypress, agent entry — rather than a boolean. Done when reading one record tells you what the consumer physically did.

## Example of a compliant value

```text
Each opt-in stores confirmation_method: checkbox_ticked (or sms_reply_yes for double opt-ins).
```

## Notes

Registration-side twin: we judge whether the programme describes storing the field, never whether the stored record exists.