# Consent evidence logging (static landers)

**Campaign:** Lionrock FE transfer-gen MVP  
**consent_text_version:** `v2026-09-12-legal-a`  
**Legal status:** CONDITIONAL FAIL — keep `{{LEGAL_ENTITY_NAME}}` `{{PRIVACY_POLICY_URL}}` `{{INBOUND_DID}}` `{{LIONROCK_TRANSFER}}` `{{CONSENT_LOG_ENDPOINT}}` until filled + Legal re-skim.  
**DID:** parked — no live spend.

## Why this file exists

Pure static hosting (Cloudflare Pages / drag-drop) **cannot** append server-side JSONL by itself. Consent evidence for TCPA/PEWC needs a writable sink.

## Production pattern (required before Meta spend)

1. Replace `{{CONSENT_LOG_ENDPOINT}}` in `_consent.js` (or via build) with a real HTTPS endpoint.
2. HTML forms include hidden fields: `consent_text_version`, `consent_timestamp_utc`, `landing_url`, `utm_*`, `fbclid`.
3. On successful PEWC submit (checkbox checked), the client:
   - Builds a consent payload
   - **POSTs JSON** to `{{CONSENT_LOG_ENDPOINT}}`
   - Also writes a **localStorage** backup (demo / QA only — **not** legal-grade server evidence)

### Example server handlers (document only — wire later)

| Option | Notes |
|--------|--------|
| Cloudflare Pages Function / Worker | `POST /api/consent` → Durable Object / R2 / D1 / KV append JSONL |
| Formspree / Basin / Getform | Form `action=` + hidden fields; export CSV |
| Zapier / Make webhook | Receive JSON → Google Sheet / CRM |
| Brightcall / CRM webhook | Preferred once DID live |

### Recommended JSON line fields

```json
{
  "consent_checked": true,
  "consent_text_version": "v2026-09-12-legal-a",
  "consent_timestamp_utc": "2026-09-12T04:00:00.000Z",
  "landing_url": "https://…/niches/fe-tx.html?utm_source=…",
  "name": "…",
  "phone_digits": "5555555555",
  "state": "TX",
  "age_band": "60-69",
  "niche_slug": "fe-tx",
  "utm_source": "",
  "utm_medium": "",
  "utm_campaign": "",
  "utm_content": "",
  "utm_term": "",
  "fbclid": "",
  "user_agent": "…",
  "seller_of_record_placeholder": "{{LEGAL_ENTITY_NAME}}",
  "privacy_policy_url_placeholder": "{{PRIVACY_POLICY_URL}}",
  "did_clicked": false,
  "tags": ["consented_ai_call", "source=organic_niche", "niche=fe-tx"]
}
```

Server should also capture **client IP** and store the **exact PEWC text** keyed by `consent_text_version`.

## Demo / static backup

`_consent.js` appends rows to `localStorage["lionrock_consent_evidence"]` and `window.__lionrockConsentJsonl`.  
Use DevTools → Application → Local Storage for QA demos. **Do not** treat browser storage as production consent evidence.

## Client gates (shipped)

- PEWC checkbox **unchecked by default**
- Submit button **disabled** until checked
- Submit handler **blocks** if unchecked
- Click-to-call (`#callBtn`) **blocked** if unchecked

## Placeholder reminder

Do **not** invent a live Privacy Policy URL. Use `{{PRIVACY_POLICY_URL}}` until `privacy.html` is deployed with the site and Legal PASSes.