Consent per provider, for free and paid models

On October 16 we started asking for your consent once per free model, as described in this earlier post. That system is now replaced by a simpler and broader one: you consent once per provider, and that consent covers every model this provider serves. Nothing is blocked yet, so you can set it up at your own pace.

What changed

What matters now is what a provider does with your inputs, not whether the model is free. A consent is needed when a provider uses inputs for its own purposes, for example to keep them or to train its models, or has not published what it does with them, and when it is based in a country without an EU adequacy decision. Your inputs then only go there after you have agreed to the transfer to that country (Art. 49(1)(a) GDPR). This can apply to paid models too. Providers of this kind in safe countries only show a notice before you pick the model, and providers that use inputs only to answer your request need nothing at all. Every provider is shown with its label and the country it is based in.

Open the consents page. The Providers tab lists every provider that needs a consent, with its country, what it does with inputs and whether you have agreed. The Models tab lists models instead: open a model and Consent to all grants every provider it still needs in one step. Both tabs have search and filters. One consent covers all models of a provider, so a few clicks usually cover the models you use. Consents you gave per free model before keep counting for the providers they covered. You can withdraw a consent at any time on the same page, in your account settings or in the chat. Without an account, consents belong to your browser, and guests find them under Manage consents in the chat menu.

Objecting instead

If you do not want your inputs shared with such providers at all, you can object (Art. 21 GDPR). The switch sits at the top of the consents page and in your account settings. While it is on, these providers are not used for you, and a model served only by them answers with own_purpose_objected. Independent of consent or objection, we now remove identifiers such as user, metadata.user_id and safety_identifier from requests before they reach a provider that uses inputs for its own purposes.

If you use the API

Once blocking is on for a model, a request without the needed consent is refused with HTTP 403 and the code consent_required. The message names the missing providers with their countries and links the consent page for exactly that model, and param carries the provider codes:

json

HTTP/1.1 403 Forbidden

{
  "error": {
    "code": "consent_required",
    "message": "claude-opus-5.5 needs your consent for these providers: a7 (China), ih (Indonesia), pol (Hong Kong). Give it once at https://unorouter.com/consents?model=claude-opus-5.5; it covers every model these providers serve. (request id: ...)",
    "param": "CN-19,ID-01,HK-01",
    "type": "new_api_error"
  }
}

Show the link to the person who owns the key; after the consent the same request goes through. Business accounts receive consent_business instead, because these providers are not available to them. All codes are explained in the consents documentation.

When blocking starts

Not yet. Today requests without a consent are not refused. We will switch blocking on in stages, per model and per account, and announce the date beforehand in our Discord and here on the blog. If you consent now, nothing breaks when it starts.

Updated terms and privacy policy

Our Terms of Service have a new section 6 on providers in third countries: their offers are marked with the country the provider is based in, and you must not enter other people's personal data into them. The privacy policy describes the consent and the objection in detail. If you have an account, you accept the updated terms once, the next time you use the site while logged in. Your API keys are not affected.

Open the consents page now and agree to the providers you use. The full details are in the documentation.