{
  "id": "OPS-210",
  "slug": "ops-210",
  "title": "Telemarketing consent must retain the request, its purpose and the answer",
  "statement": "Where the Telemarketing Sales Rule applies, the programme must retain the consent request as it was presented, the purpose consent was sought for, and the consent actually given with its date and the consenting party.",
  "rationale": "The TSR is stricter than the carrier framework and is enforced by a different body, so a brand can satisfy every 10DLC requirement and still be exposed. What it adds is the request: the FTC wants the ask preserved in the same form the consumer met it, because a permissive record of the answer says nothing about what the question was. The rule also settles a common shortcut explicitly — an IP address plus a timestamp is not a record of consent.",
  "layer": "OPERATIONAL",
  "layerSlug": "operational",
  "object": "campaign.message_flow + privacy policy",
  "severity": "BLOCKING",
  "detectability": [
    "AI_FORM"
  ],
  "failureClass": "RETRY_FIELD",
  "authorities": [
    "FTC"
  ],
  "applicability": {
    "useCases": [
      "MARKETING",
      "MIXED",
      "SWEEPSTAKE",
      "LOW_VOLUME"
    ]
  },
  "applicabilityText": "Applies when the use case is MARKETING, MIXED, SWEEPSTAKE and LOW_VOLUME.",
  "universal": false,
  "remediation": "Retain three things per consumer: a copy of the consent request in the format it was presented, the purpose it was sought for, and the consent given with its date, the consenting person and their number. Done when a record answers \"what were they asked, what for, and what did they say\" without anybody reconstructing it.",
  "example": "Each marketing opt-in stores: the rendered disclosure as shown (disclosure_version 2026-03-a), purpose=\"recurring promotional offers from Acme Coffee\", and the consent event — 2026-03-04, Jane Doe, +1 415-555-0134, checkbox ticked.",
  "pitfalls": [
    "Storing the current disclosure text rather than the version shown at the time satisfies neither half — the request must be the one that consumer met."
  ],
  "notes": "Absorbs OPS-211 (purpose), OPS-212 (the consent, date, name and number) and OPS-213, which states the sufficiency test rather than a fourth field. Tagged to the marketing-style use cases because the TSR reaches telemarketing; a transactional programme outside its scope is not failed for the absence.",
  "catalogIds": [
    "OPS-211",
    "OPS-212",
    "OPS-213"
  ],
  "phase": "approval",
  "automated": true,
  "url": "https://ekas.io/rules/10dlc/operational/ops-210/",
  "markdown": "https://ekas.io/rules/10dlc/operational/ops-210.md",
  "registry": "https://ekas.io/rules/10dlc/",
  "updated": "2026-07-25",
  "licence": "CC BY 4.0 — https://creativecommons.org/licenses/by/4.0/"
}