# CMP-019 — Policy link fields must be 255 characters or fewer

> The privacy policy and terms links must each be at most 255 characters.

- **Rule ID:** CMP-019
- **Layer:** Campaign (`CAMPAIGN`)
- **Checks:** `campaign.privacy_url + campaign.terms_url`
- **Severity:** LOW — Best practice. Worth fixing, rarely fatal on its own.
- **When it bites:** Gates approval — get this wrong and registration is refused
- **How it is detected:** Deterministic (settled in code from the submitted values)
- **Fix type:** Fix the field — a better value in the form clears it
- **Required by:** Bandwidth, TCR
- **Applies:** Applies to every 10DLC registration.
- **Canonical URL:** https://ekas.io/rules/10dlc/campaign/cmp-019/

## Why this rule exists

A link that overruns the field is stored truncated, so the reviewer follows a URL that 404s and reads it as a policy page that does not exist. The values that overrun are almost always tracking-parameter tails on an otherwise short URL, which carry nothing a reviewer needs.

## How to fix it

Link the bare page and drop everything from the "?" onward — campaign tags and session parameters serve no purpose here. Done when both links open the right page from a private browsing window and each is comfortably under 255 characters.

## Example of a compliant value

```text
https://acmecoffee.com/privacy — not https://acmecoffee.com/privacy?utm_source=tcr&utm_campaign=…
```

## Notes

TCR's own schema allows 2048; the Bandwidth CSP API caps at 255, and 255 is the portable value. Measures whichever of the two links is longer, so one finding names the field that will actually overrun.