{
  "id": "CMP-019",
  "slug": "cmp-019",
  "title": "Policy link fields must be 255 characters or fewer",
  "statement": "The privacy policy and terms links must each be at most 255 characters.",
  "rationale": "A link that overruns the field is stored truncated, so the reviewer follows a URL that 404s and reads it as a policy page that does not exist. The values that overrun are almost always tracking-parameter tails on an otherwise short URL, which carry nothing a reviewer needs.",
  "layer": "CAMPAIGN",
  "layerSlug": "campaign",
  "object": "campaign.privacy_url + campaign.terms_url",
  "severity": "LOW",
  "detectability": [
    "DETERMINISTIC"
  ],
  "failureClass": "RETRY_FIELD",
  "authorities": [
    "Bandwidth",
    "TCR"
  ],
  "applicabilityText": "Applies to every 10DLC registration.",
  "universal": true,
  "remediation": "Link the bare page and drop everything from the \"?\" onward — campaign tags and session parameters serve no purpose here. Done when both links open the right page from a private browsing window and each is comfortably under 255 characters.",
  "example": "https://acmecoffee.com/privacy — not https://acmecoffee.com/privacy?utm_source=tcr&utm_campaign=…",
  "notes": "TCR's own schema allows 2048; the Bandwidth CSP API caps at 255, and 255 is the portable value. Measures whichever of the two links is longer, so one finding names the field that will actually overrun.",
  "catalogIds": [
    "CMP-020",
    "POL-004"
  ],
  "phase": "approval",
  "automated": true,
  "url": "https://ekas.io/rules/10dlc/campaign/cmp-019/",
  "markdown": "https://ekas.io/rules/10dlc/campaign/cmp-019.md",
  "registry": "https://ekas.io/rules/10dlc/",
  "updated": "2026-07-25",
  "licence": "CC BY 4.0 — https://creativecommons.org/licenses/by/4.0/"
}