{
  "id": "CMP-069",
  "slug": "cmp-069",
  "title": "A URL mentioned in the CTA must also be given as a link field",
  "statement": "Any URL referenced inside the message-flow text must also be supplied in the structured link fields.",
  "rationale": "The structured fields are what gets crawled and screened; a URL that exists only inside prose is read by a human and checked by nothing. Submitters reasonably assume that writing the link once is enough, and the result is a privacy policy that was never fetched, never screened, and never confirmed to exist.",
  "layer": "CAMPAIGN",
  "layerSlug": "campaign",
  "object": "campaign.message_flow ↔ campaign.privacy_url + terms_url",
  "severity": "HIGH",
  "detectability": [
    "AI_FORM"
  ],
  "failureClass": "RETRY_FIELD",
  "authorities": [
    "Bandwidth"
  ],
  "codes": [
    {
      "provider": "Bandwidth",
      "code": "2120",
      "remediable": true
    }
  ],
  "applicabilityText": "Applies to every 10DLC registration.",
  "universal": true,
  "remediation": "Copy each URL out of the flow text into the field built for it — privacy policy, terms, opt-in page — leaving it in the prose as well. Done when every link in the flow also appears in a structured field.",
  "example": "The flow mentions https://acmecoffee.com/privacy → the privacy policy field also carries https://acmecoffee.com/privacy.",
  "phase": "approval",
  "automated": true,
  "url": "https://ekas.io/rules/10dlc/campaign/cmp-069/",
  "markdown": "https://ekas.io/rules/10dlc/campaign/cmp-069.md",
  "registry": "https://ekas.io/rules/10dlc/",
  "updated": "2026-07-25",
  "licence": "CC BY 4.0 — https://creativecommons.org/licenses/by/4.0/"
}