# CON-096 — Nothing in the flow may contradict the no-sharing promise

> No part of the opt-in surface or its linked policy may indicate that opt-in data is shared with third parties.

- **Rule ID:** CON-096
- **Layer:** Consent flow (`CONSENT_FLOW`)
- **Checks:** `opt-in surface + linked privacy policy`
- **Severity:** BLOCKING — Breaking this rule gets the submission rejected outright.
- **When it bites:** Gates approval — get this wrong and registration is refused
- **How it is detected:** AI judgement over the crawled website or policy page
- **Fix type:** Fix the privacy policy or SMS terms
- **Required by:** AWS, Twilio, GoHighLevel
- **Applies:** Applies to every 10DLC registration.
- **Depends on:** CON-095
- **Canonical URL:** https://ekas.io/rules/10dlc/consent-flow/con-096/

## Why this rule exists

A policy routinely carries the required no-sharing sentence in its SMS section while a general data-sharing clause elsewhere says the opposite, and reviewers read the whole document and treat the permissive clause as controlling. A checker that only looks for the good sentence therefore passes a policy that will be rejected — which is worse than not checking, because the brand submits believing it is covered.

## How to fix it

Find the permissive clause and carve mobile data out of it explicitly, rather than adding a second sentence that contradicts it. Done when the sharing section itself says mobile information is excluded — a reviewer reading only that section reaches the right answer.

## Example of a compliant value

```text
We may share aggregated, non-identifying data with partners. This sharing expressly excludes mobile phone numbers and SMS opt-in data, which are never shared with third parties for marketing purposes.
```

## Common mistakes

- A cookie or advertising-partner section is where this usually hides — the SMS section is clean and the marketing section three headings earlier is not.

## Notes

The inverse trap, on the consent surface rather than the policy page. Depends on CON-095: until the no-sharing statement is located, there is nothing for a contradiction to contradict. POL-064 states the same trap for the policy document read on its own.