# CON-094 — The policy links at the opt-in must open real policy pages

> The Terms and Privacy Policy links beside the consent control must resolve to live pages carrying those documents — not 404s, placeholders, or unfinished templates.

- **Rule ID:** CON-094
- **Layer:** Consent flow (`CONSENT_FLOW`)
- **Checks:** `policy links on the opt-in surface`
- **Severity:** BLOCKING — Breaking this rule gets the submission rejected outright.
- **When it bites:** Gates approval — get this wrong and registration is refused
- **How it is detected:** AI judgement over the crawled website or policy page
- **Fix type:** Fix the privacy policy or SMS terms
- **Required by:** CTIA, TCR, Twilio, Bandwidth
- **Applies:** Applies to every 10DLC registration.
- **Canonical URL:** https://ekas.io/rules/10dlc/consent-flow/con-094/

## Why this rule exists

A dead policy link is worse than a missing one: the consent block claims the documents exist and the reviewer proves they do not, which puts the whole submission's accuracy in question rather than just the link. It happens most on sites where the policies were generated during a rebuild and the routes changed afterwards.

## How to fix it

Open both links from a private browsing window and confirm each returns a real, finished document. Fix the routes rather than the link text, and check for template markers — a generated policy that still says {{COMPANY_NAME}} resolves fine and fails just as hard. Done when both links return a page that names your business.

## Common mistakes

- A link that redirects to the homepage rather than 404ing looks healthy to a link checker and is treated as a missing policy by a reviewer.

## Notes

Partially settleable today: where the policy text has been fetched, this can be judged from the content. Where the fetch failed, the registry carries no HTTP status, so the rule returns UNCLEAR rather than assuming a 404 — the same crawler gap CON-024 records.