{
  "id": "POL-194",
  "slug": "pol-194",
  "title": "The terms must not say consumer data is shared",
  "statement": "The SMS terms must not indicate that consumer data or opt-in information is shared with third parties.",
  "rationale": "Twilio treats a sharing statement in either the policy or the terms as making the whole business noncompliant, so a careful privacy policy does not protect a terms page that says the opposite. The terms are usually drafted by whoever handles commercial contracts, who has no reason to know the messaging clause exists.",
  "layer": "POLICY_PAGE",
  "layerSlug": "policy-page",
  "object": "SMS terms and ToS body",
  "severity": "BLOCKING",
  "detectability": [
    "AI_FORM"
  ],
  "failureClass": "TERMINAL_POLICY",
  "artifact": "sms_terms",
  "authorities": [
    "Twilio",
    "Bandwidth"
  ],
  "codes": [
    {
      "provider": "Twilio",
      "code": "30932",
      "remediable": true,
      "generation": "gen2"
    }
  ],
  "applicabilityText": "Applies to every 10DLC registration.",
  "universal": true,
  "remediation": "Remove any sharing language from the terms and mirror the privacy policy's non-sharing clause there instead. Done when both documents say the same thing about who gets the number.",
  "example": "We do not share your mobile number or your consent with anyone except the service providers who deliver our messages.",
  "notes": "The same defect in the privacy policy is POL-062 and POL-063; POL-070 is the cross-document contradiction. This rule fails the terms on their own terms, whether or not the policy agrees.",
  "phase": "approval",
  "automated": true,
  "url": "https://ekas.io/rules/10dlc/policy-page/pol-194/",
  "markdown": "https://ekas.io/rules/10dlc/policy-page/pol-194.md",
  "registry": "https://ekas.io/rules/10dlc/",
  "updated": "2026-07-25",
  "licence": "CC BY 4.0 — https://creativecommons.org/licenses/by/4.0/"
}