{
  "id": "CMP-078",
  "slug": "cmp-078",
  "title": "Message flow must carry the privacy commitment",
  "statement": "The message-flow / CTA field must state the privacy policy link, or that opt-in data will not be shared.",
  "rationale": "The single commitment carriers care most about is that a mobile number collected for messaging is not passed on, and this is where the consumer is told it. Either form satisfies it — the link or the sentence — which is worth knowing, because a business with no separate privacy page can discharge the requirement with one clause rather than by publishing a document.",
  "layer": "CAMPAIGN",
  "layerSlug": "campaign",
  "object": "campaign.message_flow",
  "severity": "BLOCKING",
  "detectability": [
    "AI_FORM"
  ],
  "failureClass": "RETRY_FIELD",
  "authorities": [
    "Bandwidth",
    "Telnyx"
  ],
  "applicabilityText": "Applies to every 10DLC registration.",
  "universal": true,
  "remediation": "Add the privacy policy URL to the disclosure you reproduce in the flow, or state in the flow that mobile opt-in data is never shared with third parties. Done when one of the two appears in the flow text. Put it in campaign.message_flow itself — this field is graded on its own text, not on what a reviewer would find by opening your site.",
  "example": "The disclosure beside the box reads \"We never share your mobile information with third parties\" and links https://acmecoffee.com/privacy.",
  "phase": "approval",
  "automated": true,
  "url": "https://ekas.io/rules/10dlc/campaign/cmp-078/",
  "markdown": "https://ekas.io/rules/10dlc/campaign/cmp-078.md",
  "registry": "https://ekas.io/rules/10dlc/",
  "updated": "2026-07-25",
  "licence": "CC BY 4.0 — https://creativecommons.org/licenses/by/4.0/"
}