{
  "id": "CON-139",
  "slug": "con-139",
  "title": "A business built on acquiring opt-in lists cannot be registered",
  "statement": "A campaign whose business model is acquiring, aggregating or monetising opt-in subscriber lists must not be registered.",
  "rationale": "Where the list IS the product, no amount of documentation fixes the campaign, because the consumers on it agreed to hear from whoever collected them and not from whoever bought them. Carriers name lead generation specifically in their prohibited categories for this reason, and the enforcement history behind 10DLC is largely this business model.",
  "layer": "CONSENT_FLOW",
  "layerSlug": "consent-flow",
  "object": "campaign business model",
  "severity": "BLOCKING",
  "detectability": [
    "AI_FORM"
  ],
  "failureClass": "HARD_STOP",
  "authorities": [
    "AT&T",
    "Bandwidth",
    "Twilio",
    "CTIA"
  ],
  "applicabilityText": "Applies to every 10DLC registration.",
  "universal": true,
  "remediation": "A lead-generation or list-acquisition programme cannot be registered under any use case. The only messaging that can be is to consumers who opted in to hear from this brand directly, under this brand's own name.",
  "notes": "Distinct from CON-NO-TRANSFER, which asks where one list came from. This asks what the business does: a retailer that once bought a list has a fixable provenance problem, while a lead vendor has nothing to fix.",
  "phase": "approval",
  "automated": true,
  "url": "https://ekas.io/rules/10dlc/consent-flow/con-139/",
  "markdown": "https://ekas.io/rules/10dlc/consent-flow/con-139.md",
  "registry": "https://ekas.io/rules/10dlc/",
  "updated": "2026-07-25",
  "licence": "CC BY 4.0 — https://creativecommons.org/licenses/by/4.0/"
}