# CON-123 — Every entity allowed to send must be named in the consent

> The consent language must name each business that will send under it, not only the one the consumer is transacting with.

- **Rule ID:** CON-123
- **Layer:** Consent flow (`CONSENT_FLOW`)
- **Checks:** `consent disclosure text`
- **Severity:** BLOCKING — Breaking this rule gets the submission rejected outright.
- **When it bites:** Gates approval — get this wrong and registration is refused
- **How it is detected:** AI judgement over the crawled website or policy page
- **Fix type:** Fix the website — no form edit clears it
- **Required by:** AT&T, T-Mobile
- **Applies:** Applies to every 10DLC registration.
- **Canonical URL:** https://ekas.io/rules/10dlc/consent-flow/con-123/

## Why this rule exists

AT&T requires consent to explicitly name the entities authorised to send, because the consumer's expectation is set by the name they read. A franchise group, a dealer network or a parent with several trading brands routinely collects once and sends from all of them, and every message from a name the consumer never saw reads to them as a leak of their number.

## How to fix it

List each sending entity by name in the consent sentence, or narrow the programme so only the named brand sends. Where the list is long, name the group and link a page that enumerates the members — the page must be reachable before the consumer agrees. Done when every number that will appear as a sender traces to a name in the disclosure.

## Example of a compliant value

```text
By checking this box you agree to receive recurring automated marketing texts from Acme Coffee and from your local Acme Coffee franchise location.
```

## Common mistakes

- Naming a parent company the consumer has never heard of instead of the trading name they recognise satisfies the letter and defeats the purpose — name both.

## Provider rejection codes

| Provider | Code | Resubmission allowed |
| --- | --- | --- |
| Twilio | `30506` | yes |