# CMP-078 — Message flow must carry the privacy commitment

> The message-flow / CTA field must state the privacy policy link, or that opt-in data will not be shared.

- **Rule ID:** CMP-078
- **Layer:** Campaign (`CAMPAIGN`)
- **Checks:** `campaign.message_flow`
- **Severity:** BLOCKING — Breaking this rule gets the submission rejected outright.
- **When it bites:** Gates approval — get this wrong and registration is refused
- **How it is detected:** AI judgement over the submitted form
- **Fix type:** Fix the field — a better value in the form clears it
- **Required by:** Bandwidth, Telnyx
- **Applies:** Applies to every 10DLC registration.
- **Canonical URL:** https://ekas.io/rules/10dlc/campaign/cmp-078/

## Why this rule exists

The single commitment carriers care most about is that a mobile number collected for messaging is not passed on, and this is where the consumer is told it. Either form satisfies it — the link or the sentence — which is worth knowing, because a business with no separate privacy page can discharge the requirement with one clause rather than by publishing a document.

## How to fix it

Add the privacy policy URL to the disclosure you reproduce in the flow, or state in the flow that mobile opt-in data is never shared with third parties. Done when one of the two appears in the flow text. Put it in campaign.message_flow itself — this field is graded on its own text, not on what a reviewer would find by opening your site.

## Example of a compliant value

```text
The disclosure beside the box reads "We never share your mobile information with third parties" and links https://acmecoffee.com/privacy.
```