# CON-125 — Consent must not be claimed on behalf of unnamed partners

> The opt-in language must not purport to grant consent to "our partners", "affiliates", "third parties", or a linked partner list.

- **Rule ID:** CON-125
- **Layer:** Consent flow (`CONSENT_FLOW`)
- **Checks:** `consent disclosure text`
- **Severity:** BLOCKING — Breaking this rule gets the submission rejected outright.
- **When it bites:** Gates approval — get this wrong and registration is refused
- **How it is detected:** AI judgement over the crawled website or policy page
- **Fix type:** Fix the website — no form edit clears it
- **Required by:** TCR, CTIA, AWS, Twilio, AT&T
- **Applies:** Applies to every 10DLC registration.
- **Canonical URL:** https://ekas.io/rules/10dlc/consent-flow/con-125/

## Why this rule exists

A consumer cannot consent to being messaged by a set of businesses they have not been told about, so this wording grants nothing while looking like it grants everything — and every carrier treats a number sent under it as having no consent behind it. It is standard boilerplate in lead-generation templates, which is how it reaches brands that have no intention of sharing anything.

## How to fix it

Delete the partner and affiliate wording from the consent sentence and name only the entities that will actually send. If a partner genuinely needs to message these consumers, they must collect their own consent under their own brand. Done when the sentence contains no open-ended category of recipient.

## Example of a compliant value

```text
By checking this box you agree to receive recurring automated marketing texts from Acme Coffee. (No partner, affiliate, or third-party clause.)
```

## Common mistakes

- Linking a page that lists the partners does not cure it: the consumer would have to read a list to know who they are agreeing to, and reviewers reject the pattern rather than the length of the list.

## Notes

Distinct from CON-NO-TRANSFER, which is about where the consent CAME FROM. This rule is about a consent the brand did collect itself, worded to extend to senders it cannot bind. A brand can pass that rule and fail this one on the same page.