# OPS-217 — Consent must be tracked per consumer, not per list

> Consent must be recorded against the individual consumer rather than at list level.

- **Rule ID:** OPS-217
- **Layer:** Operational (`OPERATIONAL`)
- **Checks:** `campaign.message_flow`
- **Severity:** HIGH — Rejected by at least one carrier or provider, and a common cause of failure at the rest.
- **When it bites:** Gates approval — get this wrong and registration is refused
- **How it is detected:** AI judgement over the submitted form
- **Fix type:** Fix the field — a better value in the form clears it
- **Required by:** CTIA, FCC, TCR
- **Applies:** Applies to every 10DLC registration.
- **Canonical URL:** https://ekas.io/rules/10dlc/operational/ops-217/

## Why this rule exists

List-level consent cannot answer whether a specific person agreed, which is the only question that matters in a complaint. It is also structurally how purchased lists get laundered into a programme — a list marked "consented" with no per-number provenance.

## How to fix it

Record consent per phone number with its own timestamp and source, never as a property of a list or segment.

## Example of a compliant value

```text
Each number carries its own consent timestamp, medium and disclosure version.
```